Pop-ups out the wazoo!

Question

rjeffers 0 Light Poster

22 Years Ago

I've got pop-up driving me crazy. I'm using Pop-up Blocker from Panicware that I've very satisfied with, but I have some that get by it. Mainly "Warning - Your computer may be infected with spyware", and Netzero, a couple different real player music downloads, PowWow web, and all the free dates and romances I could ever ask for. Also, now Pop-up Blocker blocks my internet explorer, so I have to hold the Ctrl button when I open. I've ran Adaware, Spybot, and I have Spywareblaster updated and running. I'm gonna remove Weatherbug, just as soon as I make this post. Thanks for any help..........here's the HJT log.

Logfile of HijackThis v1.97.7
Scan saved at 9:26:42 PM, on 9/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\documents and settings\owner\local settings\temp\xrhA.exe
C:\documents and settings\owner\local settings\temp\p.exe
C:\documents and settings\owner\local settings\temp\h6E.exe
C:\documents and settings\owner\local settings\temp\9MCkC.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\documents and settings\owner\local settings\temp\TDnIWi.exe
C:\documents and settings\owner\local settings\temp\Fxcx.exe
C:\WINDOWS\System32\cmpbk324.exe
C:\documents and settings\owner\local settings\temp\K.exe
C:\documents and settings\owner\local settings\temp\Wr9AG.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\PROGRA~1\Web Offer\wo.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
c:\documents and settings\owner\local settings\temp\6Nv.exe
c:\CSV5P072.exe
C:\WINDOWS\System32\IEHost.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\mydtf32.exe
C:\WINDOWS\System32\nbtautou.exe
C:\Program Files\CxtPls\CxtPls.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\AwuQ.exe
C:\WINDOWS\System32\RekO4.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\CxtPls\CxtPls.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {62F98DEE-F9DA-45F0-949F-5A62878D2E51} - C:\WINDOWS\System32\oagfc.dll (file missing)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Owner\Local Settings\Temp\b15.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [xrhA] C:\documents and settings\owner\local settings\temp\xrhA.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [p] C:\documents and settings\owner\local settings\temp\p.exe
O4 - HKLM\..\Run: [h6E] C:\documents and settings\owner\local settings\temp\h6E.exe
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Wszv.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [9MCkC] C:\documents and settings\owner\local settings\temp\9MCkC.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TDnIWi] C:\documents and settings\owner\local settings\temp\TDnIWi.exe
O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\Owner\LOCALS~1\Temp\tb_setup.exe /dcheck
O4 - HKLM\..\Run: [Fxcx] C:\documents and settings\owner\local settings\temp\Fxcx.exe
O4 - HKLM\..\Run: [bb5cecdbfc58] C:\WINDOWS\System32\cmpbk324.exe
O4 - HKLM\..\Run: [K] C:\documents and settings\owner\local settings\temp\K.exe
O4 - HKLM\..\Run: [Wr9AG] C:\documents and settings\owner\local settings\temp\Wr9AG.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [6Nv] c:\documents and settings\owner\local settings\temp\6Nv.exe
O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [439S3tg] mydtf32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [L0q2RjM7e] nbtautou.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Dialpad US Java Applet -
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - ?
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -

microsoft:windows virus-malware

2 Contributors
1 Reply
181 Views
18 Hours Discussion Span
Latest Post 22 Years Ago Latest Post by mikeandike22

Dani AI

Generated 6 Months Ago

Good call by to stress making a system-restore point before touching the registry. The symptoms described by — lots of persistent popups despite running blockers and anti‑spyware — are classic of multiple adware/ad‑injectors that install persistent startup items and browser helper objects. A cautious, staged cleanup minimizes damage and the chance of reinfection.

Start with a backup and a restore point. Disconnect the PC from the network and reboot into Safe Mode (or Safe Mode with Networking only if an updated scanner must be downloaded). Use the system configuration utility or a trusted startup manager to disable non‑Microsoft startup entries and services; then delete suspicious files from temporary folders while they’re not running. Run full, signature‑updated scans with an antivirus and a dedicated anti‑malware/on‑demand scanner. After scans, inspect browser settings and remove unknown toolbars or helper objects; reset the browser to defaults if search/homepage values look altered.

Do not use automatic “fix all” options blindly. Logs from tools like HijackThis are valuable, but fixes should be targeted — identify which startup entries and browser helper objects are malicious before removing them. If an entry can’t be removed while Windows is running, use Safe Mode or an offline/rescue environment. If third‑party popup software is interfering with browser startup (holding Ctrl to open), uninstall that third‑party blocker and rely on the browser’s own popup controls or a well‑supported alternative.

If problems persist after these steps, restore a known‑good image or perform a clean reinstall; repeated reinfection often means a persistent service/driver was missed. Finally, patch the OS and browser, run only up‑to‑date security tools, avoid bundled toolbars/offerware, and use the principle of least privilege to prevent repeat infections.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

mikeandike22 18 Nearly a Posting Virtuoso · Answer 1 · 2004-09-04T20:41:29+00:00

First off always remember to create system restore points before fooling around with registry files.
ok these files look a little bit suspicious
C:\documents and settings\owner\local settings\temp\xrhA.exe
C:\documents and settings\owner\local settings\temp\p.exe
C:\documents and settings\owner\local settings\temp\h6E.exe
C:\documents and settings\owner\local settings\temp\9MCkC.exe
C:\documents and settings\owner\local settings\temp\TDnIWi.exe
C:\documents and settings\owner\local settings\temp\Fxcx.exe
C:\WINDOWS\System32\cmpbk324.exe
C:\documents and settings\owner\local settings\temp\K.exe
C:\documents and settings\owner\local settings\temp\Wr9AG.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\Program Files\Web_Rebates\WebRebates0.exe

O4 - HKLM\..\Run: [xrhA] C:\documents and settings\owner\local settings\temp\xrhA.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [p] C:\documents and settings\owner\local settings\temp\p.exe
O4 - HKLM\..\Run: [h6E] C:\documents and settings\owner\local settings\temp\h6E.exe
O4 - HKLM\..\Run: [2P6WFAX43ZHE7C] C:\WINDOWS\System32\Wszv.exe
O4 - HKLM\..\Run: [Fxcx] C:\documents and settings\owner\local settings\temp\Fxcx.exe
O4 - HKLM\..\Run: [bb5cecdbfc58] C:\WINDOWS\System32\cmpbk324.exe
O4 - HKLM\..\Run: [K] C:\documents and settings\owner\local settings\temp\K.exe
O4 - HKLM\..\Run: [Wr9AG] C:\documents and settings\owner\local settings\temp\Wr9AG.exe
O4 - HKLM\..\Run: [6Nv] c:\documents and settings\owner\local
settings\temp\6Nv.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [L0q2RjM7e] nbtautou.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: WeatherBug (HKCU)