Have an XP SP1 computer that has recently started getting pop-ups. They are IE windows that have no toolbars. The windows are attempting to connect to ads1.revenue.net and empnads.com (at least those two, mostly the latter domain). The windows take up about 1/4 of a screen on 1024x768 resolution. They start popping up a short time after bootup and continue every few minutes, but rather infrequently.
I have scanned with Spybot S&D and Adaware 1.06 with newest update. Adaware finds something called Ebates Moneymaker and "removes" it but it keeps coming back. I've also found that there's something called
msawt.exe that I haven't been able to identify as a legitimate process. Also that
eliteljs32.exe looks kind of questionable to me.
Hijack this log:
Logfile of HijackThis v1.99.1http://www3.ca.com/virusinfo/webscan.cab http://installs.spamblockerutility.com/ins…ckerutility.cab
Download this tool:
LQfix.zip
Unzip it to your Desktop.
Don't use it yet!
The above Registry file was written specifically for this infection and is not to be used on any other infection as it could damage a person's PC IMPORTANT! Reboot the computer into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
Doubleclick LQfix.bat that you saved on your desktop before.
A doswindow will open and close again, that is normal.
Reboot into normal mode and scan with HijackThis. Post the new log as a reply to this thread.
Hans,
Thanks for the prompt reply. In the meantime, before I read your post, I ran Panda Software's online Active Scan and it found and removed some items. I rebooted and re-ran Hijack This. The log is below. The pop-ups are still occurring.
Do I need a new file from you now or do I run the one you linked to?
Note that msawt.exe is now gone. eliteljs32.exe is still there, though.
Thanks
Logfile of HijackThis v1.99.1http://www3.ca.com/virusinfo/webscan.cab http://installs.spamblockerutility.com/ins…ckerutility.cab
You didn't run the LQFix.bat in safe mode. Please do so. If you don't do it in safe mode it will not work.
You didn't run the LQFix.bat in safe mode.
Hans,
I did not run the LQFix.bat
at all . As I mentioned in my post, in the meantime I had changed my registry items and re-run Hijack This due to the fact Panda detected a Trojan. In my post, I asked if I should still run the LQFix.bat file considering that I had made those changes just to be certain. Perhaps you missed that fact. I apologize if I did not make it clear that I had never run the LQFix.bat, but I thought that should be obvious since I was asking if I should run it.
So, should I still run the given LQFix.bat file considering that it has changed since my first Hijack This log was posted? Thanks.
My mistake, didn't understand you entirely
Yes, please run the LQFix give above.
Went into Safe Mode. Ran batch file. Rebooted into normal mode. Re-ran Hijack This. Here is new log:
Logfile of HijackThis v1.99.1http://www3.ca.com/virusinfo/webscan.cab http://installs.spamblockerutility.com/ins…ckerutility.cab
Download
rkfiles.zip
UNZIP the contents to a permanent folder
Reboot in
SAFE MODE !! Important !!
°To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key
Please set your system to show all files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
Doubleclick
rkfiles.bat
It will scan for a while.
Wait till the doswindow closes and reboot back to normal mode.
Post the contents of C:\log.txt in your next reply.
Did all that and now post c:\log.txt file below:C:\rkfiles
Thanks!
Download LQFix again (it has been updated) and run it again in safe mode.
Boot into normal mode and post a new HijackThis log
Rebooted in Safe Mode. Ran batch file. Rebooted in Normal Mode. Ran Hijack This. Log file below:
Logfile of HijackThis v1.99.1http://www3.ca.com/virusinfo/webscan.cab http://installs.spamblockerutility.com/ins…ckerutility.cab
Looks good, how's everything running?
Looks good, how's everything running?
174383
Been running pretty good actually since the first LQFix.bat. No popups. Thanks.
Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:
Spywareblaster <= SpywareBlaster will prevent spyware from being installed. Spywareguard <= SpywareGuard offers real-time protection from spyware installation attempts. How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware. How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware. To protect yourself further:
IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
I also suggest that you delete your Temp folders regularly. Use
CleanUp! to do this automatically for you!
Thanks for the tips, particularly for IE/Spyad. I'd been looking for something similar for a while.
Yes, please run the LQFix give above.
Download LQFix again (it has been updated) and run it again in safe mode.
Boot into normal mode and post a new HijackThis log