win32.pornpopup

Topic opened at starters request:

. I recently had a topic on the malware section of the forum which I thought had been resolved but I need the topic reopened. The first scan after the last post was fine. A second scan 2 days later showed the win32.pornpopup had returned.

Hi,

can you tell me what scan you are referring to?

Please provide a new DDS and GMER scan


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT




Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.

• Double click the exe file.
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.
  
  
  [external image: Posted Image]
  Click the image to enlarge it
  
  
  
• In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Hi The scan was done with Spybot - Search & Destroy which I update / scan at least a couple of times a week. I have scanned as requested and attached the logs. Thanks in anticipation.

Hi,

there are no indications of malware in your logs.

Can you tell me exactly what spybot reports,

what it is exactly that it finds and where it finds it.

What behaviour is the computer displaying that might indicate it is still infected.

do you connect via a router:

If so - reset the router

• This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
• Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
• If you don’t know the router's default password, you can look it up. HERE
• You also need to reconfigure any security settings you had in place prior to the reset.
• You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

NEXT

reset the Hosts file:

Please download HostsXpert

• Unzip HostsXpert to it's own folder in a convenient place such as C:\HostsXpert
• Run: HostsXpert.exe
• Click: Restore MS Hosts File
• Click: Replace
• Click: OK
• Click: Make ReadOnly
• Close HostsXpert.

NEXT

Flush the DNS

• Go to Start > Run > type: cmd
• Press OK or Hit Enter.
• At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
• Hit Enter.
• You will get a confirmation that the flush was successful.
• Close the command box.

NEXT

Open your Spybot Search and Destroy

go to the Recovery section inside Spybot-S&D and purge all the files in the Recovery section.

Hi Spybot reports win32.pornpopup. I'm afraid I did not take note of it's location. Spybot just offered the option of fixing it which I selected but then it usually returns after a few days. If it returns again I will take more note of the details. If it does return would it be better from your point of view if I did not ask Spybot to fix the problem? I am currently not experiencing any problems with the computer. I am just concerned that my 11 year old nephew uses the computer and I am getting a message about porn pop ups. I don't use a router I connect via a modem. I have reset the hosts file, flushed the DNS and purged all the files in the recovery section of Spybot as requested. Thanks for your continued help.

I would like to know where Spybot is locating this file, perhaps it is just in your browsers cookies or temporary internet files, use the TFC Temp file cleaner program regularly to clear all your temp files and cookies.

I'll try scanning with Spybot over the next few days and see what happens. If it finds a problem I will note it's location and post it. I've also ran TFC again.

Hi I have copied this from Spybot's scan result. As you suspected it is in the browser's cookies. This appeared after using TFC. Is it possible to remove them permanently to stop them reappearing? — Search result list — Win32.PornPopUp: Tracking cookie (Internet Explorer: Nicholas) (Cookie, nothing done) Cookie:[removed]/ () Win32.PornPopUp: Tracking cookie (Firefox: Nicholas (default)) (Cookie, nothing done) .clickcash.com/ (GUID_ViewJoin)

Hi

Try the following:

1. Delete all currently saved cookies from your computer. In Internet Explorer, click Tools, Internet Options and then click the Delete Cookies button on the General tab. In Firefox 1.0, click Tools, Options. Click the Privacy icon in the sidebar and then click the Clear button to the right of the Cookies heading.
2. Specify that you want to block all third-party cookies. In Internet Explorer, click Tools, Internet Options. On the Privacy tab, click Advanced. Click to select the Override automatic cookie handling check box, and then click Block under the Third-party Cookies heading. In Firefox 1.0, click Tools, Options. Click the Privacy icon in the sidebar and then click the plus sign to the left of the Cookies heading to expand your list of options. Click to select both options: Allow sites to set cookies and for the originating web site only.

Hi I've deleted my current cookies and blocked third party cookies on both Firefox and IE. Hopefully this has done the trick. I will keep scanning over the next few days and post back with the results. Many thanks again for all your help.

You are welcome hopefully, that resolves the issue for you

Since my last post I have scanned my computer 3 times and each time it has been clear. So it seems all your hard work has paid off. It is such a relief not to have warning messages. Thanks again for your patience and persistence. Nick.

Hi,

follow the clean up steps from my previous post

http://forums.whatthetech.com/win32_pornpo…122#entry660122


set a new restore point:

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
We need to set a new system restore point:

Click Start > Run > copy and paste the following into the run box:

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.

Now remove all previous Restore Points:
Click Start > Run > copy and paste the following into the run box:

cleanmgr

Choose to scan drive C:\ (if C:\ is your main drive) At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.


stay safe

~CB

All done. Thanks again. Nick.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.