Popup Hell too, bannerconnect and firstadsolution popups

jelsea · 2006-07-28, 06:21

No matter what I do ive tried various spyware removes I just can't get rid of these damm popups form bannerconnect and firstadsolution. I hear you guys are the best, I hope so.

Here is my HIjack log.

Logfile of HijackThis v1.99.1
Scan saved at 8:09:10 PM, on 7/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PGPserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Hijack\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {BBF261CA-5C0E-42A0-AA1D-128B9EF7D504} - C:\Program Files\Outlook Express\medonuga.dll (file missing)
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\System32\xeymi.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [spywarebot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [khoxre] C:\WINDOWS\System32\lqkgrg.exe reg_run
O4 - HKLM\..\Run: [ACTX1] C:\WINDOWS\v1201.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\System32\irssyncd.exe
O4 - HKCU\..\Run: [hevas] C:\WINDOWS\System32\lqkgrg.exe reg_run
O4 - Global Startup: PGPtray.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1153990696695
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\System32\xeymi.dll
O20 - AppInit_DLLs: OCMAPIHK.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\System32\PGPserv.exe
O23 - Service: Ventrilo - Unknown owner - C:\VentriloSrv\ventrilo_svc.exe (file missing)

jelsea · 2006-07-28, 07:51

Cleaned all Malware with spybot but still can't seem to get rid of the ads. What keeps makeing them popup. Please any help on this.

pskelley · 2006-07-28, 17:44

Hello and welcome to the forum, you have a bunch of weird stuff in this HJT log, including several nasty trojans and markers that indication Qoologic trojan may be present. I would stay offline until you are clean, this junk will attract more.
Let's do this to see what happens.

1) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

2) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O2 - BHO: (no name) - {BBF261CA-5C0E-42A0-AA1D-128B9EF7D504} - C:\Program Files\Outlook Express\medonuga.dll (file missing)
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\System32\xeymi.dll (file missing)
O4 - HKLM\..\Run: [spywarebot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
(rouge spyware)
O4 - HKLM\..\Run: [khoxre] C:\WINDOWS\System32\lqkgrg.exe reg_run
O4 - HKLM\..\Run: [ACTX1] C:\WINDOWS\v1201.exe
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\System32\irssyncd.exe
O4 - HKCU\..\Run: [hevas] C:\WINDOWS\System32\lqkgrg.exe reg_run
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\System32\xeymi.dll

Close all programs but HJT and all browser windows, then click on "Fix Checked"

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\WINDOWS\v1201.exe <<< file

C:\WINDOWS\System32\irssyncd.exe <<< file

C:\WINDOWS\System32\lqkgrg.exe <<< file

C:\Program Files\SpywareBot\ <<< folder

Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart the computer and post a new HJT log along with any comments you think will help. How is the computer running now?

Thanks...pskelley
Safer Networking Forums

C:\Program Files\Java\jre1.5.0_04\ <<< out of date
Your Java program needs updating, see this: http://forums.spybot.info/showpost.p...80&postcount=2

jelsea · 2006-07-28, 18:15

I fixed the prob through re-install. I went through all these threads pretty much did what everyone else had previous done to fix this problem. My HJT was pretty much clean, and got rid of the malious files, but still the pop-ups would not stop. I just decided to reinstall takes less time then trying to find the bad file causing it that no longer leaves any trace.

pskelley · 2006-07-28, 18:22

Thanks for letting us know

Here is some information that may help you stay clean in the future.
Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.org/viewtopic.php?t=957
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

tashi

will close the topic in a day or so.

Thanks...pskelley
Safer Networking Forums
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

**tashi** · 2006-08-02, 19:22

This topic has been archived.

2006-07-28, 06:21	#1
jelsea Junior Member Join Date: Jul 2006 Posts: 3	Popup Hell too, bannerconnect and firstadsolution popups No matter what I do ive tried various spyware removes I just can't get rid of these damm popups form bannerconnect and firstadsolution. I hear you guys are the best, I hope so. Here is my HIjack log. Logfile of HijackThis v1.99.1 Scan saved at 8:09:10 PM, on 7/27/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\PGPserv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\WINDOWS\System32\wuauclt.exe C:\Hijack\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: (no name) - {BBF261CA-5C0E-42A0-AA1D-128B9EF7D504} - C:\Program Files\Outlook Express\medonuga.dll (file missing) O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\System32\xeymi.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [spywarebot] C:\Program Files\SpywareBot\SpywareBot.exe -boot O4 - HKLM\..\Run: [PrevxOne] C:\Program Files\Prevx1\PXConsole.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [khoxre] C:\WINDOWS\System32\lqkgrg.exe reg_run O4 - HKLM\..\Run: [ACTX1] C:\WINDOWS\v1201.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\System32\irssyncd.exe O4 - HKCU\..\Run: [hevas] C:\WINDOWS\System32\lqkgrg.exe reg_run O4 - Global Startup: PGPtray.exe.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing) O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\pgplsp.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1153990696695 O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\System32\xeymi.dll O20 - AppInit_DLLs: OCMAPIHK.DLL O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing) O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\System32\PGPserv.exe O23 - Service: Ventrilo - Unknown owner - C:\VentriloSrv\ventrilo_svc.exe (file missing)

2006-08-02, 19:22	#6
tashi Member of Team Spybot Join Date: Oct 2005 Location: USA Posts: 21,066 Rated LASSHes: 4	This topic has been archived. __________________ UNITE-ASAP Microsoft MVP. Consumer Security 2006-2009 Please help us improve Spybot, download our distributed testing client

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

2006-07-28, 07:51	#2
jelsea Junior Member Join Date: Jul 2006 Posts: 3	Cleaned all Malware with spybot but still can't seem to get rid of the ads. What keeps makeing them popup. Please any help on this.

2006-07-28, 17:44	#3
pskelley In Memoriam -Always in our heart Join Date: Oct 2005 Location: Clearwater, Florida Posts: 20,559	Hello and welcome to the forum, you have a bunch of weird stuff in this HJT log, including several nasty trojans and markers that indication Qoologic trojan may be present. I would stay offline until you are clean, this junk will attract more. Let's do this to see what happens. 1) How to make files and folders visible: Click Start > Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders. Uncheck: Hide file extensions for known file types Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK. 2) Please download ATF Cleaner by Atribune http://www.atribune.org/public-beta/ATF-Cleaner.exe Save it to your Desktop. We will use this later. 3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items: O2 - BHO: (no name) - {BBF261CA-5C0E-42A0-AA1D-128B9EF7D504} - C:\Program Files\Outlook Express\medonuga.dll (file missing) O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\System32\xeymi.dll (file missing) O4 - HKLM\..\Run: [spywarebot] C:\Program Files\SpywareBot\SpywareBot.exe -boot (rouge spyware) O4 - HKLM\..\Run: [khoxre] C:\WINDOWS\System32\lqkgrg.exe reg_run O4 - HKLM\..\Run: [ACTX1] C:\WINDOWS\v1201.exe O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\System32\irssyncd.exe O4 - HKCU\..\Run: [hevas] C:\WINDOWS\System32\lqkgrg.exe reg_run O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing) O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing) O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\System32\xeymi.dll Close all programs but HJT and all browser windows, then click on "Fix Checked" RIGHT Click on Start then click on Explore. Locate and delete these items: C:\WINDOWS\v1201.exe <<< file C:\WINDOWS\System32\irssyncd.exe <<< file C:\WINDOWS\System32\lqkgrg.exe <<< file C:\Program Files\SpywareBot\ <<< folder Run ATF Cleaner Double-click ATF-Cleaner.exe to run the program. Click Select All found at the bottom of the list. Click the Empty Selected button. Click Exit on the Main menu to close the program. Restart the computer and post a new HJT log along with any comments you think will help. How is the computer running now? Thanks...pskelley Safer Networking Forums C:\Program Files\Java\jre1.5.0_04\ <<< out of date Your Java program needs updating, see this: http://forums.spybot.info/showpost.p...80&postcount=2

2006-07-28, 18:15	#4
jelsea Junior Member Join Date: Jul 2006 Posts: 3	I fixed the prob through re-install. I went through all these threads pretty much did what everyone else had previous done to fix this problem. My HJT was pretty much clean, and got rid of the malious files, but still the pop-ups would not stop. I just decided to reinstall takes less time then trying to find the bad file causing it that no longer leaves any trace.

2006-07-28, 18:22	#5
pskelley In Memoriam -Always in our heart Join Date: Oct 2005 Location: Clearwater, Florida Posts: 20,559	Thanks for letting us know Here is some information that may help you stay clean in the future. Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online: http://boards.cexx.org/viewtopic.php?t=957 http://russelltexas.com/malware/allclear.htm http://forum.malwareremoval.com/viewtopic.php?t=14 http://www.bleepingcomputer.com/forums/topict2520.html http://cybercoyote.org/security/not-admin.shtml tashi will close the topic in a day or so. Thanks...pskelley Safer Networking Forums If you are reading this information...thank a teacher, If you are reading it in English...thank a soldier.