HJT log - popup from anywhere even when im offine

Question

civic 0 Light Poster

21 Years Ago

Logfile of HijackThis v1.97.7
Scan saved at 4:41:35 PM, on 13/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\slrundll.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\mHotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\foyyiehl.exe
C:\Program Files\Sonique\sqstart.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kazaa Lite\KazaaLite.kpp
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Bobby Ly\My Documents\Setups\hijackthis1977\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ninemsn.com.au/
O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [ynaqqah] C:\WINDOWS\System32\foyyiehl.exe
O4 - HKCU\..\Run: [SoniqueQuickStart] C:\Program Files\Sonique\sqstart.exe -nostick
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F99924A4-CD05-4871-A873-D1570EC71740}: NameServer =

HEEEEEELLLLLP:!: :!: :!:

microsoft:windows-nt-2000-xp virus-malware

4 Contributors
12 Replies
197 Views
1 Day Discussion Span
Latest Post 21 Years Ago Latest Post by crunchie

Dani AI

Generated 6 Months Ago

This thread shows the classic pattern of resident adware: persistent popups that appear even when the machine is offline point to something running locally (a startup entry, service, scheduled task or a hosts/DNS redirect) rather than a transient web banner. ’s logs and the good suggestions from , and are on the right track — remove P2P if you use it, get an updated HijackThis and clean browser helper objects — but the next steps below focus on the deeper checks that stop offline popups for good.

Isolate and back up. Unplug network access while cleaning and copy important personal files to an external drive.
Look for resident offenders: boot to Safe Mode, run up-to-date scanners (multiple engines), then use a startup inspection tool (Autoruns/Process Explorer) to disable unknown run/auto-start entries. Export registry keys or create a system image before you change anything.
Check scheduled tasks and Windows services for unfamiliar entries and disable them temporarily. Also inspect the hosts file (C:\Windows\System32\drivers\etc\hosts) and the adapter DNS settings — restore DNS to automatic or a trusted public server, then run ipconfig /flushdns.
Remove unwanted BHOs/toolbars from the browser (Manage Add-ons or a dedicated removal tool) and reset the browser if needed. After removals, reboot and run fresh scans and an updated HijackThis; post the new log if problems persist.
If a suspicious file remains, submit it to a multi-engine scanner (VirusTotal) rather than deleting unknown signed system files. If cleanup fails or the system integrity is doubtful, a clean OS reinstall is the safest option.

Final notes: change important passwords from a clean device after cleanup, avoid running P2P without careful caution, and keep anti‑malware and autorun tools current.

All 12 Replies

dlh6213 27 Posting Maven

21 Years Ago

1. As long as you have Kazaa and other P2P programs installed, they will continue to create problems. Go to Add/Remove Programs in the Control Panel and remove them. Run Kazaabegone from here to be sure all remnants of kazaa have been removed:

2. Close all windows, scan with the updated HJT, and have it fix this entry:
O4 - HKLM\..\Run: [ynaqqah] C:\WINDOWS\System32\foyyiehl.exe

3. Go to C:\WINDOWS, System32 folder and delete this, if found: foyyiehl.exe

4. Update hijackthis to v1.98.2.

5. Empty the contents of all Temp and Temporary Internet folders for all users.

6. Follow the recommendations in this thread to clean up some of the remaining problems:
http://www.daniweb.com/techtalkforums/thread5690.html (don't leave out SpywareBlaster)

7. Close all windows, scan with the updated HJT, and post a new log.

crunchie 990 Most Valuable Poster

21 Years Ago

This one should stop the pop-ups;

O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll

caperjack 875 I hate 20 Questions

21 Years Ago

And this one showes up red in hijackhelper.
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) -

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

civic 0 Light Poster · Answer 1 · 2004-11-13T19:49:54+00:00

btw kazza-lite dont hav n e probs coz i had it 4 ages + ill only listen to the higher mods (mayb) btw2 THXXXXXXXXXXXXXXXXXXXXXXXX

civic 0 Light Poster · Answer 2 · 2004-11-13T19:51:33+00:00

+ crunchie !port! is betta!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! but i do barrack 4 the eagles

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 3 · 2004-11-13T19:59:46+00:00

You can put your trust in both dlh6213 and caperjack. They have been helping out with logs for quite a while :).

BTW. Where did the Dockers finish :).

caperjack 875 I hate 20 Questions Team Colleague · Answer 4 · 2004-11-13T20:06:04+00:00

btw kazza-lite dont hav n e probs coz i had it 4 ages + ill only listen to the higher mods (mayb) btw2 THXXXXXXXXXXXXXXXXXXXXXXXX

my opinon on this is as long as you watch what you download and have a good antivirus program Kazaa lite is OK .don't use it any more i use this one now ARES P2P ,if you do get it when you install ,watch for the option to uncheck to install NAv Helper and The Search toolbar .
ARES= http://www.aresgalaxy.org/

civic 0 Light Poster · Answer 5 · 2004-11-14T08:34:24+00:00

nah i still got it ill giv u the addy it says...http://xadsjt-a.offeroptimizer.com+ the first section xadsjt-a is normally differnent -it is always xa....- but the offer... part is always the same

civic 0 Light Poster · Answer 6 · 2004-11-14T08:35:50+00:00

civic 0 Light Poster

21 Years Ago

btw soz ppl bout the no trustin c**p

caperjack 875 I hate 20 Questions Team Colleague · Answer 7 · 2004-11-14T16:28:07+00:00

nah i still got it ill giv u the addy it says...http://xadsjt-a.offeroptimizer.com+ the first section xadsjt-a is normally differnent -it is always xa....- but the offer... part is always the same

Run hijack again and post a new log ! :rolleyes:

civic 0 Light Poster · Answer 8 · 2004-11-14T18:20:07+00:00

Logfile of HijackThis v1.97.7
Scan saved at 8:21:13 PM, on 14/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\slrundll.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\mHotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sonique\sqstart.exe
C:\Program Files\Kazaa Lite\KazaaLite.kpp
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sonique\Sonique.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Bobby Ly\My Documents\Setups\hijackthis1977\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ninemsn.com.au/
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [KAZAA] "C:\Program Files\Kazaa Lite\kpp.exe" "C:\Program Files\Kazaa Lite\KazaaLite.kpp" /SYSTRAY
O4 - HKCU\..\Run: [SoniqueQuickStart] C:\Program Files\Sonique\sqstart.exe -nostick
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F99924A4-CD05-4871-A873-D1570EC71740}: NameServer =

Nuthins red btw

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 9 · 2004-11-14T18:53:39+00:00

You need to update hijackthis to version 1.98.2. Run hijackthis & go to *Config\Misc Tools\Check for update on-line*. If the site is down, go Remove the old version by deleting the file manually. Unzip the new version into the hijackthis folder.

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll

O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) -
NProtect Adware

Download, install and keep updated, Spywareblaster from www.javacoolsoftware.com to help keep your system clean.

HJT log - popup from anywhere even when im offine

Dani AI

Recommended Answers Collapse Answers

All 12 Replies

Recommended Answers