Pop-ups Keep Showing Up

Hello rnjc, and welcome to the TomCoyote Forums. I will be helping you get your system cleaned up and protected. I am currently reviewing your HiJackThis log and will post back shortly. Thank you for your patience. Regards, Dave

Hello rnjc,

Please follow these instructions exactly as described and I recommend that
you print them out to use as a reference during the fix. I find it easy to keep
track of what you're doing by crossing out each item as you go.

You are running Spyware Begon. This is a program that advertises itself as removing spyware, but it apparently gives false positives to get you to buy it and then does a miserable job. Some even think that it may install malware. I recommend that you remove it in Add/Remove Programs. See this post for details about these programs: http://www.spywarewarrior.com/rogue_anti-spyware.htm

To remove, Click Start > Control Panel > Double Click Add/Remove Programs:
Select Spyware Begone and click on the Change/Remove button.

I also noticed that you are using WildTangent, and while it is technically not considered spyware it does have built in components to update itself and gather information about your computer. You can find more information about it here:
http://www.pchell.com/support/wildtangent.shtml

If you decide to remove it use Add/Remove Programs to uninstall it.

We need to stop a process from running so HJT can fix IT.
Please open Task Manager with Ctrl-Alt-Del and END TASK on the following file:

C:\WINDOWS\system32\?hkntfs.exe

Now you can run HiJackThis. Check the boxes next to these items:

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\Program Files\eSyndicate\esyn.dll (file missing)
O2 - BHO: (no name) - {EAA7FF4C-6585-460A-8921-3DE67BFB5FE8} - C:\WINDOWS\system32\lnqvyf.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [Mreof] C:\WINDOWS\system32\?hkntfs.exe
O16 - DPF: IEToolbarCab - http://www.animetoolbar.com/DailyToolbar.CAB

If you are uninstalling WildTangent remove the following line also

O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program
Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

Now close all browser and explorer windows, and tell HijackThis to "Fix checked".

We need to make sure all hidden files are showing so please:
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Now boot the computer into safe mode:
*Restart the computer.
*As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*Press Enter.

Using Windows Explorer delete the following file and folder respectively:

C:\WINDOWS\system32\?hkntfs.exe > file
c:\freescan > folder

If you're uninstalling WildTangent delete this folder if present:

C:\Program Files\WildTangent > folder

Now reboot and post a new HJT log for review.

Regards,

Dave

Hello rnjc,

Congratulations, your system is clean. Here are a few tips to prevent malware from
infesting your computer in the future.

In addition to updating and running Adaware, Pest Patrol, and your Anti-Virus I recommend the following:

• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with this program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here: Using Spybot - Search & Destroy to remove Spyware, Malware, and Hijackers
  
• Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
• Install SpywareGuard - SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method. You can download SpywareGuard here:
  http://www.javacoolsoftware.com/sgdownload.html
  A tutorial on installing & using this product can be found here:
  http://www.bleepingcomputer.com/forums/tutorial50.html
  
• This point cannot be stressed enough! - Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you
  WILL NOT be protected when new malicious programs are released.

Here is a link to an article written by Tony Klein, that also
gives some great advice on preventing further infection.

This is a great tutorial on Hardening IE.

I recommend cleaning out your temporary internet files. CCleaner is a
freeware system optimisation tool for PCs. It removes unnecessary junk
from your computer allowing it to run more efficiently and securely.
Please download CCleaner from one of the two websites below:
http://www.majorgeeks.com/download4191.html
http://www.ccleaner.com/

Install CCleaner. Now open and click on the Windows tab.
Check the following items:
Under Internet Explorer:
Temporary Internet Files
History
Recently Typed URLs
Delete Index.dat files
Under System:
Empty Recycle Bin
Temporary Files
Memory Dumps
Chkdsk File Fragments
Old Prefetch Data

Next: click the Options button and then click the Settings tab
Uncheck: Only delete files older than 48 hrs. and click OK

Prior to running click on the Check for updates now… link
Then click the Run Cleaner button. It should only take a few seconds
to complete and exit when it is done.

Follow this list and your potential for being infected again will reduce dramatically.

Regards,

Dave