Can't stop Pop-Ups!!!Help!!

Question

zman11 0 Newbie Poster

19 Years Ago

I've been experiencing bad pop-ups for a few weeks now, and am at my wits end. I've used 4 different SpyWare removals, to no avail. They come fast & and regularly, and don't seem to be blocked by the IExplore blocker, or another program I've installed. I deleted all files in Documents & Settings/Local Settings/Temp & Temp Internet Files, and that hasn't solved the problem. Below is my log file I've just created from HiJack This. Thanks for any help in solving this Dilemma! Steve

Logfile of HijackThis v1.99.1
Scan saved at 7:15:57 AM, on 9/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\scrnsave.scr
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HijackThis\HijackThis.exe
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nso78.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://systemdoctor.com/download/2006/cab/SystemDoctor2006FreeInstall.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\Steven\LOCALS~1\Temp\winfix.chm::/SystemDoctor2006FreeInstall.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\lsass.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

virus-malware

3 Contributors
13 Replies
402 Views
1 Day Discussion Span
Latest Post 19 Years Ago Latest Post by kylethedarkn

Dani AI

Generated 9 Months Ago

Good work by , and — the HJT-based cleanup you described is exactly the right first move for adware/toolbar infections. To reduce the chance of a silent reinfection, use a short verification checklist now and keep a recovery plan ready.

Run a thorough autostart and process audit. Autoruns will show IE add‑ons, toolbars, AppInit DLLs and other persistence points so suspicious entries can be disabled or traced to a file on disk. Use Process Explorer to inspect any running process that looks odd (right‑click → Properties → DLLs/Handle view). After that, run at least two up‑to‑date scanners (for example an on‑demand anti‑malware like Malwarebytes plus an online scanner such as ESET or Microsoft Safety Scanner) to catch leftovers and PUPs that one product may miss. (learn.microsoft.com)

Quick network/browser hygiene (do these from an elevated command prompt and reboot): reset Winsock, reset WinHTTP proxy, and flush DNS. Also reset Internet Explorer settings if IE is involved, and restore the hosts file to default if it has unexpected entries. Commands that are commonly used:

netsh winsock reset
netsh winhttp reset proxy
ipconfig /flushdns

Follow the browser reset and hosts‑file guidance from Microsoft if the browser or name resolution was altered. (learn.microsoft.com)

If symptoms persist after those steps, run an offline rescue scan (bootable rescue disk) or a dedicated rootkit check—these run outside Windows and can remove files or MBR/boot infections that live‑in‑memory scanners miss. If a machine is still running Windows XP, consider migrating to a supported OS: unpatched XP is a long‑term risk and makes reinfection far more likely. Back up critical data before any major remediation or reinstall. (support.kaspersky.com)

If any specific entry reappears after being removed, post the autoruns/process names and a fresh scan log; that level of detail will point to the remaining persistence mechanism.

All 13 Replies

Xpenetrator 11 Posting Whiz in Training

19 Years Ago

Hard to tell what exactly pested your system from the log alone. The O20 entry is strange and one BHO can point to 50 or more different malwares. What exactly is to read in these popups? Which (fake) products, companies or warnings?

kylethedarkn 23 A.K.A. The Laughing Man

19 Years Ago

Xxpenetrator is right. lsass.dll(not to be confused with lsass.exe)Is the Adware Purityscan. And the other is a nastie toolbar.

Lets Start by doing the following. Run HJT and place a checkmark next to the following.
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nso78.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\lsass.dll
Click fix checked.

Now reboot to safe mode by tapping F8 during starup and selectiing safe mode.

Using my computer find and delete the following files.
C:\Windows\System32\lsass.dll
C:\WINDOWS\system32\nso78.dll

Reboot back to normal mode.
Post a new HJT log here.
Still having pop-ups?

Xpenetrator 11 Posting Whiz in Training

19 Years Ago

Yep, Kylethedarkn is right, too and has found them...:mrgreen: I guess the toolbar thingie (nso78.dll, its relatives are described here: ) brought you the PartyPoker ads.

Further, it looks like you should get rid of these:
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://systemdoctor.com/download/200...reeInstall.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - mk:@MSITStore:C:\DOCUME~1\Steven\LOCALS~1\Temp\winfix.chm::/SystemDoctor2006FreeInstall.cab

"Systemdoctor2006" is a rogue antispyware. Description and removal instructions here: http://www.bleepingcomputer.com/forums/topic58656.html But the registry entry described there is missing in your log, you've got these two above instead...I'm confused... Maybe it had no chance yet (or you didn't allow) to install it's ".../run" entry.
You can delete this stuff in the same way Kylethedarkn described for the other entries.

kylethedarkn 23 A.K.A. The Laughing Man

19 Years Ago

yes that is a toolbar that changes it name to avoid deleting. If you see anything resembling that delete it. If you cant delete it in safe mode then post that back here and then i'll give you further instructions.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

zman11 0 Newbie Poster · Answer 1 · 2006-09-18T07:37:24+00:00

Lots of Party Poker ads. a slew of different stuff as well. I too didn't see anything overly malicious in the log print out. I'd been scanning the forum posts for stuff like that. Oh well...

zman11 0 Newbie Poster · Answer 2 · 2006-09-18T18:37:20+00:00

interesting--when I went to remove nso78.dll, it isn't there anymore. On the same line as it appeared previously, is something called nseC.dll. Should I remove that one??

Xpenetrator 11 Posting Whiz in Training · Answer 3 · 2006-09-18T20:32:22+00:00

Yes, try to remove that one, too. But it may come back with a new filename. The thing that generates these *.dll files may be still on your computer and maybe it hides itself from HJT. Please rename HiJackThis.exe to something else.com (MickeyMouse.com or Somethingelse.com), run it and post the new log.
I found some similar files under the same CLSID in other HJT logs and normally it should go away by fixing it with HJT and deleting the file. I don't know why you get new ones yet. I've just read that HJT needs some run/fix/reboot cycles in some cases. Maybe this helps and you can try to kill this Browser Helper Object (BHO) repeatedly. No useful file will slip accidentally into that place...:mrgreen:

Xpenetrator 11 Posting Whiz in Training · Answer 4 · 2006-09-18T20:35:00+00:00

Hey kylethedarkn, look at the posting times... we both should join a synchronized swimming team...:cheesy:

kylethedarkn 23 A.K.A. The Laughing Man Team Colleague · Answer 5 · 2006-09-18T20:38:33+00:00

Yeah
Yeah good Idea we might be dealing with a vaundo infection here.

Xpenetrator 11 Posting Whiz in Training · Answer 6 · 2006-09-18T21:49:45+00:00

we might be dealing with a vaundo infection here.

Yes or at least the same kind of stuff- let's see what the new log says. The mentioned CLSID and this kind of filename seems to be typical for Adware.WhenU... annoying but rather harmless.

:
Looks like a software called "Superantispyware" can cope with this adware. There is some debate about the overall quality of that software but maybe it helps you. http://www.superantispyware.com/superantispywarefreevspro.html (30-day trial version, you have to give them an email address.)

zman11 0 Newbie Poster · Answer 7 · 2006-09-18T22:23:00+00:00

Boy, I want everyone who's been helping me to know I am Soooo grateful for all your time & effort! (my wife too--she's was giving me a hard time about the poker pop-ups.)

I had HJT fix the aforementioned items. After this, I could no longer find the suspect dll files to manully delete them. Did HJT delete them for me? (I know how to locate them, since I WAS able to find them before the fix). As of now, I don't see any more pop-ups! Yeah!--hope they don't come back. In any case, posted below is my newest HJT log. I'll write back later if the pop-ups return. Thanks again, Steve

Logfile of HijackThis v1.99.1
Scan saved at 12:11:57 PM, on 9/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

Xpenetrator 11 Posting Whiz in Training · Answer 8 · 2006-09-18T23:39:12+00:00

Yay...:mrgreen: Your log looks better now.

After this, I could no longer find the suspect dll files to manully delete them. Did HJT delete them for me?

If you can't find them, I assume they're gone (for the time being). HJT doesn't delete them automatically but we ignore that for now - we'll see if they come back anyway. BTW I was wondering if you renamed HJT and couldn't find a process entry that looks like HJT. Strange.

Here some (preliminary) final advice: I found vague indications that your nasty was maybe downloaded by a script known as HTML-Exploit. It uses (same ole story...) vulnerabilities of Internet Explorer. Consider switching to Firefox or Opera as your standard browser. After a while you might appreciate their advanced browsing features, but in any case you'll be surfing the net much safer. For the cases you need IE (MS-updates and so on), it will still be there. Also, I saw a Bittorrent client on your computer - use it with extreme caution and daily antivirus updates only. I'll be crossing my fingers for you that all is fine now. :)

kylethedarkn 23 A.K.A. The Laughing Man Team Colleague · Answer 9 · 2006-09-19T06:00:59+00:00

kylethedarkn 23 A.K.A. The Laughing Man

19 Years Ago

Good job everyone.

Can't stop Pop-Ups!!!Help!!

Dani AI

Recommended Answers Collapse Answers

All 13 Replies

Recommended Answers