Popup/spyware thread (I know, I know...)

[Stubb]

I know we get a lot of these. I've searched and need help.

I'm not very computer savvy, so bear with me.

I've run Ad-aware 6.0 a few times a week on my PC since I downloaded it, which was several months ago. It seems to wipe out the problems right away.

Last week, I opened my Internet Explorer and was taken to a page called about:blank. No big deal, I go in and change my homepage back to yahoo, and it's ok for a while.

I try to reopen my IE, and this about:blank comes up again.

At about this time I started to get a popup just about every time I went to a new page (except on talkbass, strangely) saying that I may have spyware on my computer (no, really? ).

What I want to do is to get rid of these popups and also to get control of my homepage once again.

I've ran Ad-aware 6 several times since I got this problem, also deleted cookies and temp files. No help.

I just downloaded "Hijack This," but I'll need some help with it if indeed that is what will probably fix the problem.







Damn porn sites.

 

[bryan bailey]

Spybot Serach & Destroy

 

[Dan Molina]

download "hijack this" from download.com and post your log.

 

[jazzbo]

www.majorgeeks.com

 

[HeavyDuty]

A different spin - do you have the Google toolbar for IE? Adaware sometimes thinks it's spyware, and can reset your home screen to blank.

"about:blank" is simply a browser window with no location, like a new, empty Word doc.

 

[Tyler Hole]

Scan for a virus. I had a Trojan that did this.

 

[Bryan R. Tyler]

download "hijack this" from download.com and post your log.

Yup. Hijack This took care of a similar problem for me that Spybot and AdAware couldn't fix.

 

[StrudelBass]

Popup/Spyware just feed off my computer and boy does it piss me off! (I agree, those porn files... :scowl: ) I have the same problem except my homepage was changed to www.zestyfind.com (who would use this when there is google?) and the buttons to change my home page were disabled. I actually enjoy the about:blank as my homepage because I hate loading. I've tried AdAware and Spybot, I'll try this Hijack This now.

 

[StrudelBass]

I know my log wasn't asked for, but I need help on this too so I've attached it.

 

[Davidoc]

Heh, did you guys miss the part where he said he has hijack this, but doesn't know what to do with it?

Anyhow, post your log!!! (for me, when in doubt I "fix" (delete) anything questionable; if I'm missing anything afterwards, i'll just reinstall it, but that usually doesn't happen.)

Also, did you try simply ctrl+alt+deleting and seeing if there are any processes running under your windows login that shouldn't be there?

Edit: now let's take a look at strudel's log. ( i don't know what i'm talking about, but i'll give it a shot anyhow)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Invalid Link Removed

-delete this

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Invalid Link Removed

delete

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zestyfind.com/

-BINGO! (delete)

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
Invalid Link Removed

-delete this too

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/

-Delete

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Link Removed

-Delete this
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Invalid Link Removed

-ditto

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Invalid Link Removed

-you have alot of **** from this site, scrap it all

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Invalid Link Removed

-more ****

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

Another big issue-delete this

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

That's ok, if you want that toolbar there

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL

-That's ok too

O3 - Toolbar: Seek multi - {A3226FFE-3940-A553-BD7F-8635CD4A76B6} - C:\PROGRAM FILES\INSIDE MORE CLOCK\MOVE GPL.DLL (file missing)

-If you want this toolbar, I guess it's ok

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

-probably safe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

-Keep it

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A

'tis fine

O4 - HKCU\..\Run: [AIM] D:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl

-yea whatever

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

totally alright

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

yea, why not, (i'l probably delete it though, doens't matter)

O9 - Extra button: Real.com (HKLM)

-if you want the button, sure

O9 - Extra button: AIM (HKLM)

-ditto

O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll

-trash all this ****

O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - Invalid Link Removed
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - Link Removed
O16 - DPF: {9A19966F-AE0E-4699-8CCE-9B6F5F1C352C} (NPKXSite Control) - Link Removed
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - Invalid Link Removed
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - Link Removed
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: Yahoo! Poker - Link Removed
O16 - DPF: Yahoo! Pool 2 - Link Removed
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = address.com

-I don't feel like adressing the rest, but they look mostly harmless; they're software/driver related stuff that you may wanna keep.

 

[Dan Molina]

Yeah most searchbar companies are natorious, stick to the main ones like yahoo and google otherwise get rid of it.

 

[beaglesandbass]

i have been having problems with spy ware also

search and destroy hasn't helped

damn porn

here's my log

 

[StrudelBass]

This topic is a blessing! I'm so glad I'm not forced to visit that no-name search engine everytime I open Internet Explorer. One problem still is that my home page buttons in internet options are still disabled.

I still get random popups too, and that REALLY pisses me off.

How many times must I run AdAware... no, I think we know the real problem here. I'll leave you guessing...

 

[Sonorous]

From Internet Explorer.

Tools: Internet Options: Connections: LAN Settings: Uncheck the box that says "Auto Detect Settings"

 

[StrudelBass]

Already was unchecked.

 

[MJ5150]

Anyone else like Bazooka besides me?

-Mike

 

[beaglesandbass]

Already was unchecked.

me too

 

[tappel]

Check this out:
Invalid Link Removed

Personally, I'd suggest all IE users find another browser for casual surfing. Only use IE for your most trusted sites.

Tom

 

[Stubb]

I hope this works... if not, I'll have to ask questions on how to get this uploaded (trying to tell me it's an invalid file type).


Don't think this is working...

I saved it as a .txt file (it was trying to do as .log before), and it uploaded fine. How do I get it off of my computer alone and out into the world, for you guys to fix my problems for me?

 

[MJ5150]

Uninstall this: C:\Program Files\BroadJump\Client Foundation\CFD.exe. You can do it from the Add/Remove Programs applet.

Disable the RealSched, and QTTask programs as well. You can do that when you type "msconfig" in the Run command.

Did you install the "My Way" program? If not, get rid of it.

-Mike