What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Huntbar,popups, No Roadrunner Connection

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Good news and bad news - I ran the FixBinet twice and on the second run it was clean! This was after going into the temp folder and deleting the offending folders in Safe Mode, and I think FixBinet said it deleted one of the folders. Just finished running SpyBot, Trojan Hunter, AntiSPyware and AdAware and they all came up clean - I think. For some reason, AdAware got stuck on the IE Favorites folder (ran it twice with same result), and the Trojan Hunter only came up with one suspicious file: C:\WINDOWS\SYSTEM32\Cache\pop.exe - stating it's a suspicious UPX-packed file in a Windows system folder. I haven't deleted it yet though. The only bad news is that I still can't connect through IE or Firefox. In the past even after deleting some spyware it seemed that the connection would be good at least for a little while, but now it just times out and says the page can't be displayed. In System information, under tools.NetDiagnostics itr says there's a problem with the DNSServerSearchOrder had failed. (But, I'm just checking it now and it says everything Passes, but could be it's just because I'm online with AOL at the same time.) So, I'm not sure what's going on there. Well, I guess just let me know if you think I'm clean now and if you have any idea why AdAware would get hung up - hadn't done that before. Thanks, Pete
Post #32

C:\WINDOWS\SYSTEM32\Cache\pop.exe


This is 180Search http://securityresponse.symantec.com/avcen…ware.ncase.html

Save this removal utility to your desktop. Reboot but you don't have to reboot into safe mode, but you can if you want. Just don't reconnect to the net Run the removal utility twice http://securityresponse.symantec.com/avcenter/Fix180Sh.exe




Are you an AOL or roadrunner customer and when the tech was out did he find anything wrong with your line? Also can you please detail your setup, are you networking multiple computer, any info is good. 56K shouldn't have any connection issues but DSL and cable can present problems.
Post #33
Quiet - I ran the symantec utility and it came up clean. My AVG virus scanner had actually found that Windows/cache/pop.exe file and deleted it during a scheduled scan last night. It also took care of 3 Downloader.Small viruses/files - not sure where they came from. But it looks like everything is clean right now.
The RoadRunner/IE was running great Friday night - so I'm hoping I didn't mess up any files when I was looking around in the registry. I tried to do a system restore to a point on 3/31/05 but it wouldn't let me do it for some reason.

As for my internet connection, I have had dial-up AOL hooked up to this PC for about 10 years without any problems, but we recently decided to switch to RoadRunner broadband. But I'm keeping AOL until the RR gets straightened out. They had to hook it up to my second PC in the basement - so there's a cable running into the cable modem downstairs, and then I put a linksys network adapter in this PC upstairs to hook up by wireless. It says there's an excellent connection to the downstairs cable modem, and like I said it was working fine for a while until I got hijacked.
While we've been cleaning it up, I had at least been able to connect intermittently, but the past few days I can't connect with IE at all. I've tried turnng off all Virus/Firewalls to make sure there wasn't a conflict, but that didn't work - so now I have the ZoneAlarm firewall and AVG Virus scan back on and have disabled the Windows security features. I had installed Firefox to see if that browser worked any better but it hasn't so I deleted that for now also.
When I run the system information net diagnostic scans it says there's a DNSServer problem, saying the [removed], etc. numbers don't ping. I'm not sure if you want me to post to another board to work on tihs, but if you have any ideas that would be great, otherwise I'll probably put one more call into RoadRunner this week.
And if there's anything needing cleaning let me know, here's my recent HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 4:38:59 PM, on 4/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.rr.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7BEC965-8019-46F1-855C-B31ACB970D42}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alr
Post #34
I am a good malware fighter, however I don't have a lot of experience with networks, nor Internet Connections. It's best to have RoadRunner diagnose your problems with the line. Your hijackthis and findit logs are clean. I see nothing of concern in either log. The IP you posted points to dt083nb2.tampabay.res.rr.com, so that's good. The ip in your Hijackthis log points too, nstot.proxy.aol.com. It's possible that there is conflict but that difficult to say. If you were to remove that 017 line, you could very well kill your internet connection. So I don't recommend removing that line. I will leave your thread open for a few days, report back if you are experiencing any problems. First see if RoadRunner can diagnose the problem. If you have any other questions, don't hesitate to ask.
Post #35
To prevent the hijackers from taking over your system, increase the level of security on your system. Don't allow the hijackers to take you over!! Review these articles to increase the level of security.

http://www.computercops.biz/postt7736.html
http://www.markusjansson.net/eienbid.html

Also reset your restore points

Turn off System Restore.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot.

Turn System Restore Back On.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI