• 0

Popups which I cant block or delete


Question

16 answers to this question

Recommended Posts

  • 0

Have you tried Microsoft AntiSpyware and/or HiJackThis?

Make sure you know what you are doing when using HiJackThis, majority of the results listed are safe and you do not want to remove. Either ask for help here (your log as well) or post your log here: http://www.hijackthis.de

  • 0

Logfile of HijackThis v1.99.1

Scan saved at 17:07:34, on 20/10/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\Documents and Settings\Oli\My Documents\AveDesk12\AveDesk.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE

C:\Program Files\Rainlendar\Rainlendar.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\ewido\security suite\ewidoctrl.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Oli\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [AVEDESK] "C:\Documents and Settings\Oli\My Documents\AveDesk12\AveDesk.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O17 - HKLM\System\CCS\Services\Tcpip\..\{FFDCA8B9-7527-470C-AB0C-46ACAA68B894}: NameServer = 194.72.6.51,194.72.6.52

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: MsgPlusLoader.dll

O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\WINDOWS\system32\iprepair.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

  • 0

To proceed with your HijackThis log, Run HijackThis again and put a CheckMark next to these entries and Click on Fix Checked.

Please make sure that all Internet Explorer and Windows Explorer windows are closed.

  Quote
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: MsgPlusLoader.dll

The log is generally clean of spywares though .. Did you installed that "helpful advertising support" with Msgplus ..?

  • 0

also remove

O17 - HKLM\System\CCS\Services\Tcpip\..\{FFDCA8B9-7527-470C-AB0C-46ACAA68B894}: NameServer = 194.72.6.51,194.72.6.52

If this Domain does not belong to your ISP, or your firms network, these entries should be fixed. 'SearchList' entries should be fixed too.

  • 0

well, thats something for me to take note lol.

I don't know, but if popup killers dont work, as far as i know, the pop ups are coming from inside. try other programs to search for spyware. Like NoAdware, or even one called bazooka scanner.

SecretMaker is an all-in-one usefull program, and it has a popup killer integrated. you could check it out.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • It funny how in a few short years Intel has become the budget brand. I just had to do an unexpected platform swap on my main system due to memory stability issues that suddenly developed. I went with a 9800X3D, but seeing these prices making me regret not at least considering this direction. I really don't need top-tier performance, and between a cheaper CPU and cheaper board, the Intel option looks like it would have been $300-400 cheaper. I already have a 360 AIO, so the extra heat wouldn't have been a big deal. Oh well, live and learn. I normally am the kind of person that will consider something like this for weeks, but I needed to move quickly and my decision point was "9800X3D is a fantastic chip, and Ultra-200 is basically a joke" which is true, but what I didn't consider is a CPU like this 265K is still worlds head of my 5800X, and I really don't need more than that. Its just the enthusiast mindset :-)
    • The only compelling reason for 99% of people will be Windows 10's end-of-support on October, nothing more.
    • This thread has run its course. The complaint has been noted and we'll handle things on our side.  Again, for future reference please report a post that you have an issue with and we will investigate.  <Thread closed>
    • AMD Ryzen 9000, 8000, 7000 CPUs have a vulnerable TPM-Pluton, major firmware fix released by Sayan Sen Last week, the Trusted Computing Group (TCG), which is the developer of the Trusted Platform Module (TPM) security standard, alerted the press and AMD about a new TPM vulnerability on Ryzen processors. Tracked under ID "CVE-2025-2884" (AMD is tracking it as "AMD-SB-4011"), the vulnerability allows an attacker to exploit the vulnerability by sending malicious commands to read data stored in the TPM via an information disclosure flaw or potentially impact TPM availability on systems through a denial of service attack. This is a type of out-of-bound read security flaw. The TCG notes that the flaw occurs in the CryptHmacSign function due to improper validation of a message digest or hash via the hash-based message authentication code (HMAC) signature scheme, leading to an out-of-bounds situation. TCG explains in its VRT0009 advisory: The Common Vulnerability Scoring System (CVSS) score of the flaw is 6.6 indicating a medium level of severity. This is typically the case for most local-level attacks as in order to exploit such a flaw, the threat actor must have physical access to a device. Regardless, AMD has issued firmware to patch the vulnerability on Ryzen 7000, 8000 (Zen 4) and Ryzen 9000 (Zen 5) parts. AMD has confirmed that AGESA (AMD Generic Encapsulated Software Architecture) firmware Combo PI (Platform Initialization) 1.2.0.3e mitigates the flaw. The company notes that the said firmware fixes "ASP fTPM + Pluton TPM" issue. If you are wondering, ASP refers to AMD Secure Processor which is "a dedicated hardware component embedded in every system-on-a-chip." AMD's motherboard vendor partners like Asus and MSI have already begun rolling out the firmware update. MSI has a blog post about the 1.2.0.3e Combo PI as it mentions several new upcoming features including support for new CPUs, better memory compatibility, and more. MSI writes: Interestingly, Asus notes that this firmware update is irreversible as it is a major release. Thus one would hope that it is a very stable release and given that this is the "e" stepping of the firmware, there are pretty good chances of that. Other vendors like Gigabyte and ASRock are yet to release their updates.
    • Really?? Having a sense of humor is a sign of intelligence...what does that say about someone who totally misses the joke and can only respond by parroting a political talking point they heard others make?
  • Recent Achievements

    • Apprentice
      Wireless wookie went up a rank
      Apprentice
    • Week One Done
      bukro earned a badge
      Week One Done
    • One Year In
      Wulle earned a badge
      One Year In
    • One Month Later
      Wulle earned a badge
      One Month Later
    • One Month Later
      Simmo3D earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      604
    2. 2
      ATLien_0
      281
    3. 3
      +FloatingFatMan
      179
    4. 4
      Michael Scrip
      151
    5. 5
      Steven P.
      111
  • Tell a friend

    Love Neowin? Tell a friend!