Member Avatar for dustdogz

i keep getting popups in IE even after running ad-aware..spyware and other various spyware/adware detectors. I ran Hijackthis and came up with this report. Know some things i shouldnt remove but not sure about some other. Any help would be greatly appreciated. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 2:12:36 PM, on 3/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\PROGRA~1\ETRUST~1\ETRUST~1\VetTray.exe
C:\Documents and Settings\Dustin\Application Data\astr.exe
C:\Program Files\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\m?hta.exe
C:\PROGRA~1\ETRUST~1\ETRUST~1\VetMsg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\Dustin\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebaumsworld.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {054CECEC-2971-21F1-7D82-5087ECF3BC9D} - C:\WINDOWS\system32\qmhbhjxc.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0C4CECEA-2907-5387-7D8B-22879FF6BCEE} - C:\WINDOWS\system32\qmhbhjxc.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {AF9ECF1C-0187-5E05-8A3F-7BC5397A1496} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: (no name) - {2CA511C5-C677-4e33-A018-EADF07E08299} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKCU\..\Run: [Tbsa] C:\Documents and Settings\Dustin\Application Data\astr.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Program Files\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\PROGRA~1\ETRUST~1\ETRUST~1\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

  • 3 Contributors
  • 2 Replies
  • 130 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

A short practical guide based on this thread: has persistent popups despite running scanners and posted a HijackThis log. correctly noted HijackThis was run from a temporary folder; move it to a permanent folder so backups are not lost. closed the thread because a new, focused thread was started in the Virus forum. The steps below prioritize safety and preserve your ability to recover if something goes wrong.

  1. Make a full safety backup first. Create a System Restore point and export the registry.
  2. Move HijackThis to a permanent folder (for example, C:\HJT), then reboot to Safe Mode with Networking. Run up-to-date full scans with a current anti-malware scanner and a second-opinion scanner. Clean temp files before rescanning.
  3. Run HijackThis from the permanent folder and save the new log. Do not use the Fix buttons unless an experienced responder explicitly tells you which entries to remove. Post the new log in the Virus/Spyware forum for targeted help.

Check specific IE-related areas: use Internet Explorer’s Manage Add-ons to disable unknown toolbars/BHOs, consider an IE Reset if add-ons persist, and review startup items with msconfig or Autoruns. Inspect running programs with a tool like Process Explorer. Review the Hosts file and Scheduled Tasks for suspicious entries.

Cautions and next steps: avoid blind deletions of items you do not recognize, keep security software enabled, and apply Windows/IE updates. If popups continue after cleaning, consider creating a new user profile or a clean OS reinstall. For faster help, post the fresh HijackThis log in the Virus/Spyware forum and list which scans you have already run.

Recommended Answers

All 2 Replies

Member Avatar for deonnanicole

Hi. :) First, you have HijackThis in a temporary folder. You need to put it in a permanent one, as one of the steps you may need to do will be deleting all of your temp files/folders. If HijackThis is in a temp folder, you will lose it along with any backups it made. Next, all hijackthis logs should be posted in the viruses/spyware forum. There, one of the security experts can take a look at your log and see what needs to be done.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.