What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need help w/ Win32.Pornpopup

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi, I have a problem with Win32.Pornpopup. Everytime I run Spybot Search and Destroy, I find Win32.Pornpop up cookies.
1st SS&D search ->
DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


FastClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Chrome: Chrome) (Cookie, fixed)

2nd SS&D search ->
FastClick: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)

Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


Win32.PornPopUp: Tracking cookie (Firefox: Barron (default)) (Cookie, fixed)


I also ran:
ESET Antivirus scan -> found nothing
Malwarebytes -> found nothing
Super Antispyware -> found nothing (except some adware cookies)

I read some of the forums of Win32.Pornpopup around here but I didnt do anything yet in fear that I might accidently make a mistake.

Could someone help me?
I am not sure where this trojan is and how did I even get it.

I have no symptoms on my computer so far. (edit #3 -> symptoms started to show up - listed @ end of topic)
I use chrome to play z100 and to check my email, and firefox for everything else.
I use NoScript on Firefox.

Thanks for the help!


edit: I ran the HiJackThis and here are my results (DDS didn't support my OS)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:41:20 PM, on 6/17/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Barron\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
O4 - HKCU\..\Run: [Google Update] "C:\Users\Barron\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Barron\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 7946 bytes


edit #2: Ran HouseCall Online Scanner and found this:
atiacm64.dll RogueAV_709 (Trojan Horse) -> clean and removed.

edit #3: since I removed that atiacm64.dll RogueAV_709 (Trojan Horse), I had some symptoms.
-> the minute I restarted my computer, Spybot window popped up w/ 3 new registry key changes (something about autochk or something)
-> everytime I run IE, UAC notifies me if I want to continue to run Adobe Flash Player which is weird.
-> When I opened Firefox after the removal, it asked that firefox was not my default browser and if I wanted to make it to (which is weird because it had always been my default)

Thats all I did for now. I'll wait to see what instructions you guys have to help me.
Thanks.
Post #2
Posted Image


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.


Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".
Post #3 last edited
Hi, thanks for the quick reply and the help. I did all the steps -> Showing those 2 options for Windows, clearing Java Cache, running ATF Cleaner and ran Malwarebytes. Here is the report: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4210 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 6/17/2010 4:45:58 PM mbam-log-2010-06-17 (16-45-58).txt Scan type: Quick scan Objects scanned: 121826 Time elapsed: 2 minute(s), 2 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) So far, my computer seems to be fine. The only weird thing that happened was earlier before you gave me the directions. (HouseCall detected the trojan -> removed/cleaned -> I rebooted computer -> firefox was no longer my default browser -> Internet Explorer keeps wanting to install a plug-in on my default page (msn.com) After doing those steps you gave me, when I open IE, I get a message on the top of msn.com that says "This website wants to install the following add-on: 'Adobe Flash Player' from 'Adobe Systems Incorporated'. If you trust the website and the add-on and want to install, click here…" But it no longer auto accepts like before. After restarting my computer: One thing that changed was my AIM (AOL Instant Messenger) window became stretched to the way it was when I first downloaded it. But ever since I first used it, I shrinked the AIM window to the smallest possible to save desktop space. Also, when I logged on to my AIM screenname, the "Import Buddies" popped up just like it did when I first installed it. I am not sure if this is normal (from the ATF cleaning) or is this a symptom of the trojan? What should I do next?
Post #4
If you want FF to be your default browser, you should be able to do that. My guess with the other issues could be from the ATF Cleaning or the Trojan.
Post #5
Yeah, I set firefox back to my default browser. So far it seems that firefox remains to be my default and nothing is trying to change it. My AIM settings were changed back to default mode since ATF Cleaner (or Trojan) still not sure which. Besides from this, I don't see any visible problems. I still feel a bit paranoid because the trojan seem to have slipped into my computer and ESET, SuperAntispyware, Malwarebytes and Spybot Search and Destroy didnt detect it. Is it safe to say that my computer is clean?
Post #6

Is it safe to say that my computer is clean?

I don't see anything bad but you can never be 100% sure. 64 Bit OS isn't suppose to get infected but we see a lot of them.

The todays Malware and other infections can disable all your protection to infect your computer.
The main idea is to steal your personal information or trick you into purchasing their fake anti-virus / anti-spyware program.
Post #9 last edited
Hey, I think I'm still infected. I started to run a few online scans (norton, panda, and mcafee) because my internet was having lag spikes and this doesnt usually happen. They found nothing but I had a new symptom. My C: Drive had 109 gb of space (out of 499 GB total) and during the scans, it dropped down to .7 MB space and after the scans it went up to 6.14 GB of space. But it never went back to 109 GB of space. I am not sure what happen to the 103 GB of space that just disappeared. I am thinking it is the virus thats causing this. What should I do? Edit #1: I googled a bit and I found this program that tells me where the GB is (TreeSize) And I found out that 131 GB is in C:\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized I went to Control Panels -> Internet Options -> General Tab- -> Browsing History -> Delete -> unchecked "Preserve Favorites website data" and I got my 131 GB back. But right now I'm concern if this is caused by a trojan or was it the online scanners I used that build this up? I don't know if it would be best to reformat or to run some different tests to see if there is anything wrong with my PC. Let me know what you think I should do. Thanks again! This is causing a huge mess for me because I don't know where all these are coming from since there are so many different possibilities. Edit#2: Just want to mention that my C drive is back to 184 GB (instead of 109 because I also uninstalled a few programs and cleared my system restore points)
Post #10
I'd be very very surprised if an infection was doing this. I suggest you start a new topic in our Windows forum and see what the Tech Team suggest.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI