Popup Ads Tell Me What To Delete

Hello ,welcome to the forum. Important: Do this before any fix. Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT). You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT. Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste. The reason we do this is Hijackthis creates backup files just in case you'd need to restore one and we'll be cleaning out the temp files. Empty Recycle Bin Reboot and "copy/paste" a new log file into this thread.

This is what I suggest you do.

Download CWShredder from my signature below. Unzip it on the desktop.
Open CWShredder and with ALL other windows closed, click fix.


Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

This was the result of Trend Micro, we're making progress, thanks for all the help thus far. System just moves slow and popups are getting around my pop up stopper. Virus Scan 0 virus cleaned, 0 virus deleted Results: We have detected 40 infected file(s) with 40 virus(es) on your computer: 0 virus(es) cleaned, 40 virus(es) uncleanable, 0 virus(es) deleted, 0 virus(es) undeletable, 0 virus(es) passed. Detected File Associated Virus Name Action taken C:\Documents and Settings\Default User\Local Settings\Temp\6RJaX.exe TROJ_MIDADDLE.A Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\7.exe TROJ_STILEN.A Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\i38.tmp TROJ_TVMEDIA.DR Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\itnaelo.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\ksatipat.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\passv.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\pinu.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\piteni.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Default User\Local Settings\Temp\update_1.exe TROJ_DLDR.4 Uncleanable C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\G56VKLMZ\Gdvf[1].cab (Gdvf.exe) BKDR_BDI.A Uncleanable C:\Documents and Settings\Donna\Local Settings\Temporary Internet Files\Content.IE5\MB8C4Y9R\rgog[1].cab (rgog.exe) BKDR_BDI.A Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\6RJaX.exe TROJ_MIDADDLE.A Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\7.exe TROJ_STILEN.A Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\i280A.tmp TROJ_DROP.A Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\i38.tmp TROJ_TVMEDIA.DR Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\i6C.tmp TROJ_DROP.A Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\itnaelo.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\ksatipat.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\passv.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\pinu.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\piteni.dat TROJ_AGENT.PC Uncleanable C:\Documents and Settings\Owner\Local Settings\Temp\update_1.exe TROJ_DLDR.4 Uncleanable C:\WINDOWS\Downloaded Program Files\mm21.INF INF_DLOADER.A Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\6RJaX.exe TROJ_MIDADDLE.A Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\7.exe TROJ_STILEN.A Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\i38.tmp TROJ_TVMEDIA.DR Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\itnaelo.dat TROJ_AGENT.PC Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\ksatipat.dat TROJ_AGENT.PC Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\passv.dat TROJ_AGENT.PC Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\pinu.dat TROJ_AGENT.PC Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\piteni.dat TROJ_AGENT.PC Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\update_1.exe TROJ_DLDR.4 Uncleanable C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G56VKLMZ\Gdvf[1].cab (Gdvf.exe) BKDR_BDI.A Uncleanable C:\WINDOWS\system32\wtbktgtg\fugclqur.dll TROJ_AGENT.JU Uncleanable C:\WINDOWS\system32\wtbktgtg\gyjdkaxw.dll TROJ_AGENT.JU Uncleanable C:\WINDOWS\system32\pruttct.exe TROJ_PRUTEC.B Uncleanable C:\WINDOWS\system32\tvmsys.exe TROJ_TVMEDIA.DR Uncleanable C:\WINDOWS\Szgwxvh.exe TROJ_DOWNLOAD.A Uncleanable C:\EDow_AS2.exe TROJ_WEBSEARCH.A Uncleanable C:\x.bat BAT_LOWZONES.F Uncleanable Trojan/Worm Check 0 worm/Trojan horse deleted What we checked: Malicious activity by a Trojan horse program. Although a Trojan seems like a harmless program, it contains malicious code and once installed can cause damage to your computer. Results: We have detected 0 Trojan horse program(s) and worm(s) on your computer: 0 Worm(s)/Trojan(s) deleted, 0 worm(s)/Trojan(s) undeletable, 0 worm(s)/Trojan(s) passed. Trojan/Worm Name Trojan/Worm Type Action taken Spyware Check 1 spyware program removed What we checked: Whether personal information was tracked and reported by spyware. Spyware is often installed secretly with legitimate programs downloaded from the Internet. Results: We have detected 25 spyware(s) on your computer: 1 spyware(s) removed, 1 spyware(s) unremovable, 22 spyware(s) passed. Spyware Name Spyware Type Action taken BHO_E2Give.A Browser Help Object Unremovable COOKIE_45 Cookie Pass COOKIE_169 Cookie Pass COOKIE_407 Cookie Pass COOKIE_410 Cookie Pass COOKIE_442 Cookie Pass COOKIE_534 Cookie Pass COOKIE_592 Cookie Pass COOKIE_960 Cookie Pass COOKIE_1144 Cookie Pass COOKIE_1169 Cookie Pass COOKIE_1564 Cookie Pass COOKIE_2513 Cookie Pass COOKIE_2842 Cookie Pass COOKIE_2921 Cookie Pass COOKIE_3004 Cookie Pass COOKIE_3184 Cookie Pass COOKIE_3185 Cookie Pass COOKIE_3186 Cookie Pass COOKIE_3201 Cookie Pass COOKIE_3205 Cookie Pass COOKIE_3206 Cookie Pass COOKIE_3237 Cookie Pass ADW_SURFKICK Adware Unknown ADW_IPSENTRY.A Adware Removal successful Microsoft Vulnerability Check 20 vulnerabilities detected What we checked: Microsoft known security vulnerabilities. These are issues Microsoft has identified and released Critical Updates to fix. Results: We have detected 20 vulnerability/vulnerabilities on your computer. Risk Level Issue How to Fix Important This remote code execution vulnerability could allow a malicious user or a malware to take complete control of the affected system if the affected user is currently logged on with administrative privileges. The malicious user or malware can execute code on the system giving them the ability to install or run programs and view or edit data with full privileges. Thus, this vulnerability can conceivably be used by a malware for replication purposes.;The vulnerability is caused by an unchecked buffer in the Microsoft Office WordPerfect Converter. MS04-027 Critical This vulnerability lies in the way the affected components process JPEG image files. An unchecked buffer within this process is the cause of the vulnerability.;This remote code execution vulnerability could allow a malicious user or a malware to take complete control of the affected system if the affected user is currently logged on with administrative privileges. The malicious user or malware can execute arbitrary code on the system giving them the ability to install or run programs and view or edit data with full privileges. Thus, this vulnerability can conceivably be used by a malware for replication purposes. MS04-028 Important An unchecked buffer exists in the NetDDE services that could allow remote code execution. An attacker who is able to successfully exploit this vulnerability is capable of gaining complete control over an affected system. However, the NetDDe services are not automatically executed, and so would then have to be manually started for an attacker to exploit this vulnerability. This vulnerability also allows attackers to perform a local elevation of privilege, or a remote denial of service (DoS) attack. MS04-031 Critical This is another privately reported vulnerability about Windows Compressed Folders. There is vulnerability on the way that Windows processes Compressed (Zipped) Folders that could lead to remote code execution. Windows can not properly handle the extraction of the ZIP folder with a very long file name. Opening a specially crafted compressed file, a stack-based overflow occurs, enabling the remote user to execute arbitrary code. MS04-034 Critical This security bulletin focuses on the following vulnerabilities: Shell Vulnerability (CAN-2004-0214), and Program Group Converter Vulnerability (CAN-2004-0572). Shell vulnerability exists on the way Windows Shell launches applications that could enable remote malicious user or malware to execute arbitrary code. Windows Shell function does not properly check the length of the message before copying to the allocated buffer. Program Group Converter is an application used to convert Program Manager Group files that were produced in Windows 3.1, Windows 3.11, Windows for Workgroups 3.1, and Windows for Workgroups 3.11 so that they can still be used by later operating systems. The vulnerability lies in an unchecked buffer within the Group Converter Utility. MS04-037 Important This security advisory explains the two discovered vulnerabilities in Microsoft Word for Windows 6.0 Converter, which is used by WordPad in converting Word 6.0 to WordPad file format. Once exploited, this remote code execution vulnerability could allow a malicious user or a malware to take complete control of the affected system if the affected user is currently logged on with administrative privileges. MS04-041 Critical A remote code execution vulnerability exists in HyperTerminal because of a buffer overrun. If a user is logged on with administrator privileges, an attacker could exploit the vulnerability by constructing a malicious HyperTerminal session file that could potentially allow remote code execution and then persuade a user to open this file. This malicious file may enable the attacker to gain complete control of the affected system. This vulnerability could also be exploited through a malicious Telnet URL if HyperTerminal had been set as the default Telnet client. MS04-043 Important This security update addresses and resolves two windows vulnerabilites, both of which may enable the current user to take control of the affected system. Both of these vulnerabilites require that the curernt user be able to log on locally and execute programs. They cannot be exploited remotely, or by anonymous users. A privilege elevation vulnerability exists in the way that the Windows Kernel launches applications. This vulnerability could allow the current user to take complete control of the system. A privilege elevation vulnerability exists in the way that the LSASS validates identity tokens. This vulnerability could allow the current user to take complete control of the affected system. MS04-044 Critical This update resolves a newly-discovered, publicly reported vulnerability. A vulnerability exists in the HTML Help ActiveX control in Windows that could allow information disclosure or remote code execution on an affected system. MS05-001 Critical This update resolves several newly-discovered, privately reported and public vulnerabilities. An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, install programs, view, change, or delete data, or create new accounts that have full privileges. MS05-002 Important This update resolves a newly-discovered, privately reported vulnerability. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full privileges. While remote code execution is possible, an attack would most likely result in a denial of service condition. MS05-003 Important A vulnerability in ASP.NET allows an attacker to bypass the security of an ASP.NET Web site, and access a machine. The attacker gains unauthorized access to some areas of the said Web site, and is able to control it accordingly. The actions that the attacker could take would depend on the specific content being protected. MS05-004 Important This is an information disclosure vulnerability. An attacker who successfully exploits this vulnerability could remotely read the user names for users who have an open connection to an available shared resource. MS05-007 Important This remote code execution vulnerability exists in the way Windows handles drag-and-drop events. An attacker could exploit the vulnerability by constructing a malicious Web page that could potentially allow an attacker to save a file on the users system if a user visited a malicious Web site or viewed a malicious e-mail message. MS05-008 Critical This remote code execution vulnerability exists in the processing of PNG image formats. An attacker who successfully exploits this vulnerability could take complete control of an affected system. MS05-009 Critical This remote code execution vulnerability exists in Server Message Block (SMB). It allows an attacker who successfully exploits this vulnerability to take complete control of the affected system. MS05-011 Critical This privilege elevation vulnerability exists in the way that the affected operating systems and programs access memory when they process COM structured storage files. This vulnerability could grant a currently logged-on user to take complete control of the system.;This remote code execution vulnerability exists in OLE because of the way that it handles input validation. An attacker could exploit the vulnerability by constructing a malicious document that could potentially allow remote code execution. MS05-012 Critical This vulnerability exists in the DHTML Editing Component ActiveX Control. This vulnerability could allow information disclosure or remote code execution on an affected system. MS05-013 Critical This update resolves known vulnerabilities affecting Internet Explorer. An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. MS05-014 Critical A remote code execution vulnerability exists in the Hyperlink Object Library. This problem exists because of an unchecked buffer while handling hyperlinks. An attacker could exploit the vulnerability by constructing a malicious hyperlink which could potentially lead to remote code execution if a user clicks a malicious link within a Web site or e-mail message. MS05-015

1. Open My Computer 2. Right click on your hard drive that you wish to clean (C drive, for example) 3. In the context menu that opens, select properties 4. Under the general tab you should select Disk Cleanup 5. Windows will scan your drive which will take a few seconds/minutes 6. A box will display the various files you can remove. Check all boxes except compress old files (If listed) 7. Click OK and windows will comply. Restart your computer. Reboot and "copy/paste" a new log file into this thread. Also please describe how your computer behaves at the moment.

I suggest you do this:

Use Add/Remove Programs and remove:
WildTangent
AdTools Service
Preview AdService
SpySpotter


Run HijackThis again and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R3 - Default URLSearchHook is missing

O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\dlmax.dll

O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll

O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe

O4 - HKLM\..\Run: [lenmt] C:\WINDOWS\lenmt.exe

O4 - HKLM\..\Run: [Preview AdService] C:\Program Files\Preview AdService\PrevAdServ.exe

O4 - HKLM\..\Run: [SpySpotter] C:\PROGRA~1\SPYSPO~1\SpySpotter.exe

O4 - HKLM\..\Run: [qpujlqd] c:\windows\system32\qpujlqd.exe

O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe

O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe /startupscan

O4 - HKCU\..\Run: [pruttct] C:\WINDOWS\System32\pruttct.exe

O4 - HKCU\..\RunOnce: [pruttct] C:\WINDOWS\System32\pruttct.exe

O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/…tterInstall.cab

Close ALL windows and browsers except HijackThis and click "Fix checked"


Search for and delete these files if listed:
C:\WINDOWS\System32\pruttct.exe
C:\WINDOWS\lenmt.exe
c:\windows\system32\qpujlqd.exe
C:\WINDOWS\farmmext.exe



1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Close all windows and browsers.
Open HijackThis
Click on Config
Click on Misc Tools
Click on Open Process Manager
Click once on the file below to select it: Do for each file.

C:\WINDOWS\System32\pruttct.exe
C:\WINDOWS\dlmax.dll
C:\WINDOWS\systb.dll
C:\WINDOWS\farmmext.exe

Click: Kill Process to end process

Click on the Back button to exit Process Manager

Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\dlmax.dll

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll

O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe

O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe

O4 - HKCU\..\Run: [pruttct] C:\WINDOWS\System32\pruttct.exe

O4 - HKCU\..\RunOnce: [pruttct] C:\WINDOWS\System32\pruttct.exe


Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these files
C:\WINDOWS\farmmext.exe
C:\WINDOWS\System32\pruttct.exe
C:\WINDOWS\dlmax.dll
C:\WINDOWS\systb.dll


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Run Hijack This again and put a check by these.

O4 - HKLM\..\Run: [AOL 9.0 Optimized] AOLCLIENT.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked"


Search for and delete this file.
AOLCLIENT.EXE


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log