Ran Ad-aware And Spybot, But Pop-ups Still Come

I've run Ad-aware and Spy-bot S&D several times and installed their latest updates, and after every check, they say that my computer is OK. However, the very next day, the pop-ups come back and my browser gets hijacked again. I've tried for months now to try and get rid of this spyware, but to no success. Any help would be greatly appreciated.

To anyone other than the originator of this topic: do not use this thread to try to fix your system or anyone elses by copying it - this is not an automatic fix and requires the logs to be properly interpreted.

Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

Hey, thanks for responding so quickly. I ran FINDnFIX, and here are the results: »»»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»»» –The directory 'junkxxx' is now included as a Subfolder in the FINDnfix folder and is the destination for the file to be moved.. -*Previous directions will no longer work… »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q837009-Q832894-Q831167 The type of the file system is NTFS. C: is not dirty. Tue 20 Jul 04 18:35:49 6:35pm up 0 days, 1:25 »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» *For *Helpers/Mods and/or users that are not familiar with any of the items on the scan results- I recommend using an alternative, once you know what to look for! »»»»»»»»»»»»»»»»»»***LOG!***(*modified 7/20)»»»»»»»»»»»»»»»» »»»*»»»*Boards that are not personally authorised by me are not allowed to use this fix!»»»*»»»* Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… C:\WINDOWS\System32\HLPKEE.DLL +++ File read error \\?\C:\WINDOWS\System32\HLPKEE.DLL +++ File read error »»»»» (*2*) »»»»»…….. **File C:\FINDnFIX\LIST.TXT HLPKEE.DLL Can't Open! »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ hlpkee.dll Tue May 25 2004 10:28:20p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K unknown/hidden files… No matches found. »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLPKEE.DLL »»»»»(*5*)»»»»» **File C:\WINDOWS\SYSTEM32\DLLXXX.TXT ¯ Access denied ® ………………… HLPKEE.DLL …..57344 25.05.2004 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\HLPKEE.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… C:\WINDOWS\SYSTEM32\ hlpkee.dll Tue May 25 2004 10:28:20p A…R 57,344 56.00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57,344 bytes 56.00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\HLPKEE.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***) DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group OWNER-7WGH0314M\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created…»»»»»» 6:36pm up 0 days, 1:26 Tue 20 Jul 04 18:36:55 A C:\FINDnFIX\keyback.hiv –a– - - - - - 8,192 07-20-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 287 07-20-2004 winkey.reg *Temp backups… . .. keyback2.hi_ winkey2.re_ C:\FINDNFIX\ JUNKXXX Tue Jul 20 2004 6:35:46p .D… 1 item found: 0 files, 1 directory. »»Performing string scan…. 00001150: vk > f AppInit_DLLs G 00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ h l p k e e . d l l 000011D0: &( - h vk UDeviceNotSelectedTimeout 00001210: 1 5 P 9 0 vk ' zGDIProce 00001250:ssHandleQuota" vk Spooler2 y e s _ 00001290: h 0 ` vk 5swapdisk vk 000012D0: . TransmissionRetryTimeout h 0 ` 00001310: vk ' T USERProcessHandleQuotao 00001350: 00001390: 000013D0: 00001410: 00001450: 00001490: 000014D0: 00001510: 00001550: 00001590: 000015D0: ———- WIN.TXT fùAppInit_DLLs֍æG¸ÿÿÿC ————– ————– $01180: AppInit_DLLs $011F7: UDeviceNotSelectedTimeout $01247: zGDIProcessHandleQuota $012E0: TransmissionRetryTimeout $01330: USERProcessHandleQuotao ————– ————– C:\WINDOWS\System32\hlpkee.dll ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 A handle was successfully obtained for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key. This key has 0 subkeys. The AppInitDLLs value exists and reports as 62 bytes, including the 2 for string termination. [AppInitDLLs] Ansi string : "C:\WINDOWS\System32\hlpkee.dll" 0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O. 0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e. 0020 6d 00 33 00 32 00 5c 00 68 00 6c 00 70 00 6b 00 | m.3.2.\.h.l.p.k. 0030 65 00 65 00 2e 00 64 00 6c 00 6c 00 00 00 | e.e…d.l.l… 

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the HLPKEE.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

Nearly there, open the FINDnFIX folder again and open the Files2 folder. Double-click on the ZIPZAP.bat. It will quickly clean the rest and will make a copy of the bad file(s) in the same folder (junkxxx.zip) and open your email client with instructions. Simply drag and drop the junkxxx.zip file from the folder into the mail message and submit to the specified addresses.

Please be sure to include a link to this thread in the body of your email. Reboot when done, then delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

When I click on zipzap.bat, it brings me to a website that asks me for my Microsoft Passport. Can you tell me what this is? *edit: Lol, nevermind. I did a google search on it and found out what it was. Jeez, I am so clueless

Okay, I've gotten through the Microsoft Passport sign in, but when I drag and drop the junkxxx.zip file into my message, it brings me to another folder with two things: the FindnFix folder and output.txt. I didn't know what to do here, so instead I tried attaching the zip file to the message, but hotmail detected a virus in the attachment, so I couldn't send it. Can you tell me what to do?

Don't worry about the email, finish the remaining instructions.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html#1507
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.html#1507
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html#1507
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html#1507
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html#1507
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html#1507
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html#1507
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html#1507
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\VisualIPInsight\IPClient.exe" -l
O4 - HKLM\..\Run: [Mwg] C:\windows\temp\Mwg.exe
O4 - HKLM\..\Run: [qCJ] C:\windows\temp\qCJ.exe
O4 - HKLM\..\Run: [524A1AD5] C:\WINDOWS\System32\dazhq.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

Reboot when done. Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Rescan with HJT and post a new log here for a final check over.

Click here to download TheKillbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Full Path of File to Delete' box, copy and paste the following:

C:\WINDOWS\System32\kqulass.exe

Make sure the 'Delete on reboot' is checked and click the red delete file button. You'll be prompted to reboot, do so.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

With only HJT running remove the following entries by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [524A1AD5] C:\WINDOWS\System32\kqulass.exe
O4 - HKLM\..\RunServices: [3F988FEB] C:\WINDOWS\System32\kqulass.exe

Reboot, rescan with HJT and post a new log for a final check over.