• Welcome Guest, to the Spybot Forums! It's 2025, and we just upgraded our forum software.

    Today is Safer Internet Day, and with our new forum, you can finally use passkeys to login. That was about time!

    Of course, you could ask if a forum is still useful, with so many social media networks out there where you might already have an account, and met a lot of users. You can now use your login from some of those networks to log in here. And by posting here, your question and data is stored on our servers and not automatically shared with a whole social media network.

    We'll also start using the forum for small bits of information, announcements and more again.

POPUPS provoked from NSB3.DLL it is not detected

Dumonlu

New member
Hello, I had problems with certain popups that appeared when opening IE or some application related with internet, analise the system with Spybot, and several Anti-Spywares, without any result, so I began to look for it in the system and at the end of two days I found it.

The file that was sending the popups was NSB3.DLL

Also create the follow icons in the desk and in c:\windows\system32 when it install:

babe3sdassadasdaa123.ico
free stuff xxdd.ico
free stuffddasd.ico
hotbabes1zasd.ico
popup blocker1xdxaasd.ico
searchfastd.ico
spyware killed (39) xaasdd.ico

NSB3.DLL is loaded automatically from certain you paginate web,

Some popups that shows

hxxp://209.200.10.92/cgi-bin/t50/ezlclk.fcgi?id=1055 | personal loans
hxxp://209.200.10.92/cgi-bin/t50/ezlclk.fcgi?id=1073 |the vegas casino
hxxp://209.200.10.92/cgi-bin/t50/ezlclk.fcgi?id=1086 |adult dating sites

Location
It is in C:\windows\system32\nsb3.dll

Entrances of the registration
\HKEY_CURRENT_USER\SOFTWARE\NSB3 .DLL
\HKEY_USERS\S -1-5-21-1214440339-789336058-1957994488-1003 \SOFTWARE\NSB3.DLL

To Uninstall
Delete nsb3.dll and the icons from c:\windows\system32
Delete entry key in the reg.

Please take it into account for that it bothers

NOTE: Why does no antispyware detect it?,IT CAN BE OF A SYSTEM FILE?????
I have Windows XP...

Thanks and GL....
 
Last edited by a moderator:
Hello.

If you have files you can zip and send:
detections AT spybot.info
Replace AT with @ and remove spaces

Please do the following:
Open SpyBot, check for and get any updates available, close all browsers, check for problems and fix everything found. Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except:

Uncheck[ ] do not report disabled or known legitimate Items.
uncheck[ ] Include a list of services in report.
Uncheck[ ] Include uninstall list in report.

Now select (near the top) view report.
Press export in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach or post that report please.
 
Back
Top