Member Avatar for mandy101w

I ended up with fastsearch on my pc, probably from kazaa which I deleted that crap long ago. I am still stuck with this search engine and also a box popping up now called actulice that when open says "modF". I don't know where it came from but it is driving me crazy, it pops up every ten mins. I deleted it out of regedit, but it keeps coming back. I ran hijacker and this is what it comes up with. The pogo games listed I play often, I have once deleted everything that said webcounter, but it came back....any help from you guys and it would be greatly appreciated. If it goes away and never comes back, I will gravel at your feet.
thanx Amanda :cry:

Logfile of HijackThis v1.97.7
Scan saved at 8:17:48 AM, on 5/24/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE
C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE
C:\PROGRAM FILES\SPYHUNTER\POPUPBLOCKER\ENIGMAPOPUPSTOP.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SGAMEM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://in.webcounter.cc/---/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://in.webcounter.cc/-/?ydtfs about:blank (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://in.webcounter.cc/-/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://in.webcounter.cc/---/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://in.webcounter.cc/-/?ydtfs about:blank (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://in.webcounter.cc/---/?ydtfs (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?ydtfs (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?ydtfs (obfuscated)
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE
O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
O4 - HKLM\..\Run: [SpyHunter] C:\PROGRAM FILES\SPYHUNTER\SPYHUNTER.exe
O4 - HKLM\..\Run: [Soundmx] C:\WINDOWS\SYSTEM\soundmx.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [SGAMEM] C:\WINDOWS\SYSTEM\SGAMEM.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: Squelchies by pogo -
O16 - DPF: Tri-Peaks by pogo -
O16 - DPF: Fortune Bingo by pogo -
O16 - DPF: Jungle Gin by pogo -
O16 - DPF: Pop Fu by pogo -
O16 - DPF: Word Whomp Whackdown by pogo -
O16 - DPF: Word Whomp by pogo -
O16 - DPF: Dominoes by pogo -
O16 - DPF: Tumble Bees by pogo -
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: World Class Solitaire by pogo -
O16 - DPF: Buckaroo Blackjack TM by pogo -
O16 - DPF: Checkers by pogo -
O16 - DPF: Showbiz Slots by pogo -
O16 - DPF: Mah Jong Garden by pogo -
O16 - DPF: Backgammon by pogo -
O16 - DPF: Pirate's Gold by pogo -
O16 - DPF: High Stakes Poker by pogo -
O16 - DPF: Ali Baba Slots TM by pogo -
O16 - DPF: Texas Hold'em Poker by pogo -
O16 - DPF: Showbiz Slots 2 by pogo -
O16 - DPF: High Stakes Pool by pogo -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: Euchre by pogo -
O16 - DPF: Phlinx by pogo -
O16 - DPF: Yahoo! Gin -
O19 - User stylesheet: C:\WINDOWS\Web\tips.ini
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)

  • 3 Contributors
  • 4 Replies
  • 199 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

Fastsearch and the accompanying "actulice" pop-ups are classic persistent adware: they change Internet Explorer's search/home settings and install a small process or startup hook that keeps restoring those settings after simple deletes. The behavior seen in the HijackThis output — repeated search/homepage entries and a popup process that reappears after removal — usually means something else is re-creating the entries at boot (a Run/RunServices entry, a scheduled task, a tiny resident EXE, or a helper DLL). Manual deletion without finding that restorer will only be temporary.

Recommended cleanup workflow (safe, ordered steps):

  • Disconnect the machine from the network before cleaning to stop callbacks and reinfection.
  • Boot to Safe Mode so fewer processes are active.
  • Run a dedicated FastSearch/IE-hijacker removal tool (as suggested) and then full scans with up-to-date anti-spyware and antivirus engines. Repeat scans until clean.
  • Disable suspicious startup items (msconfig / Startup folder), check Scheduled Tasks, and look for unknown resident processes. Back up the registry before any edits.
  • Produce a fresh HijackThis log and have experienced helpers review any entries that are unclear rather than deleting system items blindly.
  • Reset Internet Explorer search/home settings via Internet Options and clear Temp/Cache/Cookies. Reboot and re-scan.

If the infection persists after the above, a repair install or backing up data and performing a full reinstall is often the fastest, most reliable fix (this is what ultimately did with success). A final caution: editing the registry or deleting files can break the system if done incorrectly — always back up first and seek a second opinion on suspicious entries. As pointed out, variants of the popup can require different specific file removals, so consider multiple tools and a community review of your final log if unsure.

Prevention: avoid P2P/adware bundles, keep antivirus/antispyware signatures current, run limited-user accounts for everyday use, and keep runtime components (Java, etc.) patched.

Recommended Answers

All 4 Replies

Member Avatar for DMR

The actulice pop-up is a bit tricky. The beastie responsible for it seems to come in a few different flavors, with different users reporting different filenames for the culprit and, correspondingly, different fixes.

Have a close read through thread I've linked to below; the different solutions posted there seem to have worked for many people:

http://www.computing.net/security/wwwboard/forum/11720.html

Member Avatar for mandy101w

Thanks for your help...I did all of what you said, but actulice and fastsearch still came back. I ended up downloading sun java and deleting the microsoft version, then doing a system software recovery for about 3/4 of the disk, shutting it down and then rebooting. this caused my pc to exchange a medium list of software and ditch some things. all of my files were saved and i only had to download Word, and my printer software then add the printer and it is running better than ever right now.

thanks
amanda

Member Avatar for DMR

Hey, sometimes the "shotgun" approach to troubleshooting is the way to go... :mrgreen:

Glad you got it sorted!

* Marking this as solved.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.