Results 1 to 5 of 5

Thread: Neverending Popups

  1. #1
    Junior Member
    Join Date
    Feb 2007
    Posts
    3

    Angry Neverending Popups

    I've been getting pop-ups that won't go away no matter what I do. It's been a long time since I was infected with anything, so I'm a bit out of practice reading these log files. Can you help me?
    Logfile of HijackThis v1.99.1
    Scan saved at 1:38:05 AM, on 2/26/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\HP\KBD\KBD.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\After Dark\After Dark.exe
    C:\WINDOWS\NCLAUNCH.EXe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
    C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe

    Thanks so much.

  2. #2
    Junior Member
    Join Date
    Feb 2007
    Posts
    3

    Default

    Please disregard above post. I am being helped in the Malware Removal forums and do not want to take up someone's time Thank you for providing this service, it has always been a helpful place to go and still remains so!

  3. #3
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Hi Trish and welcome to the forum. Please start over here: "BEFORE you POST" -Preliminary Steps
    http://forums.spybot.info/showthread.php?t=288
    Read and follow those instruction, especially this one:

    You are running HJT.exe from a .zip file in a Temporary Directory. This is unsafe as we will have no backups. That is why you received this message when you used HJT: http://russelltexas.com/malware/images/unsafefolder.gif
    Please use the information in the following link to place HJT in a permanent, safe folder, I prefer C:\HJT\HijackThis.exe. If you need additional instructions use these: http://russelltexas.com/malware/createhjtfolder.htm

    Using Post Reply to stay in this topic, post the logs requested in the "BEFORE you POST" instructions.
    This time, when you get the notepad from HJT, make sure "Word Wrap" IS NOT checked under format. Then click on Edit then Select All. Copy and paste the highlited information. This will give you a complete HJT log instead of the partial you posted the first time.
    Please also give me a little more information, like where are you being directed with popups? If you are receiving any error messages, please post those "word for word". I will be notified when you post and respond with instructions as soon as possible after that.

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  4. #4
    Junior Member
    Join Date
    Feb 2007
    Posts
    3

    Default

    Sorry, it was late last night when I posted this, and had just downloaded and unzipped the updated HJT. The pop-ups were for "cleaning" programs for the most part. Shaba had me install no-lop and run it on another forum. Waiting on a reply on my new logs, altho from looking them over, I see I will be deleting a few files. I appreciate your quick response. I will leave Shaba to work them out so I won't be wasting both of your time. Once again, you guys in this forum do a great job and help heaps of people

  5. #5
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Thanks for making us aware. You must have read the "Before you Post" information:
    Multi forum posters waste valuable volunteer resources, so please don't.
    Shaba also helps here and he will do an excellant job cleaning your computer. I will close this topic, and leave you with this valuable information.

    Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
    http://forums.spybot.info/showthread.php?t=279
    http://russelltexas.com/malware/allclear.htm
    http://forum.malwareremoval.com/viewtopic.php?t=14
    http://www.bleepingcomputer.com/forums/topict2520.html
    http://cybercoyote.org/security/not-admin.shtml

    Thanks...pskelley
    Safer Networking Forums
    http://www.spybot.info/en/donate/index.html
    If you are reading this information...thank a teacher,
    If you are reading it in English...thank a soldier.

    This topic is closed at the members request, they are receiving help from Shaba at another forum.
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •