| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 69586 | 2006-06-06 05:59:00 | popup that comes up on every webpage | floyds (3095) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 460986 | 2006-06-06 05:59:00 | efverytime i go to a webpage the same popup loads, well 2 different versions. ive run adaware and noads but it keeps coming back. only way ive gotten rid of it is to have google nopopups running but i find the bar and the icon on my mouse pointer annoying .. any ideas please :waughh: |
floyds (3095) | ||
| 460987 | 2006-06-06 06:08:00 | post a hijackthis log. also what have you allowed through your firewall? |
tweak'e (69) | ||
| 460988 | 2006-06-06 06:24:00 | came up with this....im into unusual terroritry here :confused: Logfile of HijackThis v1.99.1 Scan saved at 5:18:16 p.m., on 6/06/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe F:\WINDOWS\SOUNDMAN.EXE F:\Program Files\QuickTime\qttask.exe F:\Program Files\iRiver\HSeries\iHPDetect.exe F:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe F:\WINDOWS\VM_STI.EXE F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe F:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe F:\WINDOWS\System32\ctfmon.exe F:\Program Files\NoAds\NoAds.exe F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe F:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE F:\WINDOWS\System32\nvsvc32.exe F:\Program Files\Kerio\Personal Firewall\persfw.exe F:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe F:\WINDOWS\System32\PAStiSvc.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe F:\WINDOWS\System32\MsPMSPSv.exe F:\Program Files\MSN Messenger\msnmsgr.exe F:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe F:\Program Files\Common Files\Adobe\Web\AOM.exe F:\Documents and Settings\glen\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nzherald.co.nz/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {F484C398-C71D-4482-8700-A9CCE5D2A0BE} - F:\WINDOWS\system32\win32hp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Soltek] F:\WINDOWS\System32\autorun.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [CTStartup] F:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [RoxioEngineUtility] "F:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iHP-100] F:\Program Files\iRiver\HSeries\iHPDetect.exe O4 - HKLM\..\Run: [MimBoot] F:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mimboot.exe O4 - HKLM\..\Run: [MMTray] F:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [SSC_UserPrompt] F:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Jet Detection] F:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [SSBkgdUpdate] F:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot O4 - HKLM\..\Run: [BigDogPath] F:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NoAds] "F:\Program Files\NoAds\NoAds.exe" O4 - Global Startup: Acrobat Assistant.lnk = F:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://f:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://f:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://f:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://f:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://f:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://f:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - messenger.zone.msn.com O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - www.creative.com O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - a1540.g.akamai.net O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - 219.89.125.199 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - messenger.zone.msn.com O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - messenger.msn.com O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - www.creative.com O17 - HKLM\System\CCS\Services\Tcpip\..\{716FFAC1-8B2C-434E-A50B-0E15AC898EE2}: NameServer = 192.168.1.1 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - F:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: LiveUpdate - Symantec Corporation - F:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - F:\Program Files\Kerio\Personal Firewall\persfw.exe O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe O23 - Service: STI Simulator - Unknown owner - F:\WINDOWS\System32\PAStiSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe |
floyds (3095) | ||
| 460989 | 2006-06-06 07:53:00 | O2 - BHO: (no name) - {F484C398-C71D-4482-8700-A9CCE5D2A0BE} - F:\WINDOWS\system32\win32hp.dll suspect. btw what is written on the popup? have you got messanger service turned off? also update windows to SP2 :) |
tweak'e (69) | ||
| 460990 | 2006-06-06 07:57:00 | Boot into safe mode, run hijackthis again (unzip it first), then tick these entries and tick fix checked. O2 - BHO: (no name) - {F484C398-C71D-4482-8700-A9CCE5D2A0BE} - F:\WINDOWS\system32\win32hp.dll O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - (no file) I dont know what this belongs to - Do you? O4 - HKLM\..\Run: [Soltek] F:\WINDOWS\System32\autorun.exe O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - a1540.g.akamai.net O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k |
Speedy Gonzales (78) | ||
| 460991 | 2006-06-06 08:33:00 | its a home loans popup | floyds (3095) | ||
| 460992 | 2006-06-06 08:52:00 | O2 - BHO: (no name) - {F484C398-C71D-4482-8700-A9CCE5D2A0BE} - F:\WINDOWS\system32\win32hp.dll looks like this was the culprit thanx for your help peoples :D |
floyds (3095) | ||
| 1 | |||||