I subscribed to spy sweeper.
Ran a sweep. It would hang up.
Ran sweep again but deselected sweep for toot kits.
Removed all found threats.
Seems to have solved the problem. I am not currently getting any unwanted popups.
Thanks.
HJT Log:
Logfile of HijackThis v1.99.1
Scan saved at 11:32:33 AM, on 3/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Documents and Settings\Bob\My Documents\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.comcast.net/comcast.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.comcast.net/comcast.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [acvb] C:\WINDOWS\Config\acvb.exe
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [*acvb] C:\WINDOWS\Config\acvb.exe
O4 - HKLM\..\Run: [*dbdvd] C:\WINDOWS\Web\dbdvd.exe
O4 - HKLM\..\Run: [*antiac] C:\WINDOWS\security\antiac.exe
O4 - HKLM\..\Run: [*sysmsvc] C:\WINDOWS\Driver Cache\sysmsvc.exe
O4 - HKLM\..\Run: [*runimg] C:\WINDOWS\repair\runimg.exe
O4 - HKLM\..\Run: [*webjava] C:\WINDOWS\Help\webjava.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=48835
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) -
http://h20270.www2.h...staller_gmn.cab
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) -
http://aaar.mlxchang...ectComboBox.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.micros...b?1135632515218
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) -
http://aaar.mlxchang...ClientUtils.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) -
http://aaar.mlxchang...ol/IRCSharc.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://zone.msn.com/...ro.cab34246.cab
O20 - Winlogon Notify: igfxcui - igfxsrvc.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
Spy Sweeper Log:
********
11:00 AM: | Start of Session, Thursday, March 09, 2006 |
11:00 AM: Spy Sweeper started
11:00 AM: Sweep initiated using definitions version 629
11:00 AM: Starting Memory Sweep
11:05 AM: Memory Sweep Complete, Elapsed Time: 00:04:16
11:05 AM: Starting Registry Sweep
11:06 AM: Registry Sweep Complete, Elapsed Time:00:00:54
11:06 AM: Starting Cookie Sweep
11:06 AM: Found Spy Cookie: 2o7.net cookie
11:06 AM: guest@112.2o7[2].txt (ID = 1958)
11:06 AM: Found Spy Cookie: 888 cookie
11:06 AM: guest@888[1].txt (ID = 2019)
11:06 AM: guest@888[3].txt (ID = 2019)
11:06 AM: Found Spy Cookie: websponsors cookie
11:06 AM: guest@a.websponsors[2].txt (ID = 3665)
11:06 AM: Found Spy Cookie: yieldmanager cookie
11:06 AM: guest@ad.yieldmanager[2].txt (ID = 3751)
11:06 AM: Found Spy Cookie: adecn cookie
11:06 AM: guest@adecn[2].txt (ID = 2063)
11:06 AM: Found Spy Cookie: adknowledge cookie
11:06 AM: guest@adknowledge[2].txt (ID = 2072)
11:06 AM: Found Spy Cookie: hbmediapro cookie
11:06 AM: guest@adopt.hbmediapro[2].txt (ID = 2768)
11:06 AM: Found Spy Cookie: hotbar cookie
11:06 AM: guest@adopt.hotbar[1].txt (ID = 4207)
11:06 AM: Found Spy Cookie: atwola cookie
11:06 AM: guest@atwola[1].txt (ID = 2255)
11:06 AM: Found Spy Cookie: banner cookie
11:06 AM: guest@banner[1].txt (ID = 2276)
11:06 AM: Found Spy Cookie: burstnet cookie
11:06 AM: guest@burstnet[1].txt (ID = 2336)
11:06 AM: Found Spy Cookie: cassava cookie
11:06 AM: guest@cassava[1].txt (ID = 2362)
11:06 AM: guest@cs.hotbar[1].txt (ID = 2798)
11:06 AM: Found Spy Cookie: go.com cookie
11:06 AM: guest@espn.go[2].txt (ID = 2729)
11:06 AM: guest@go[1].txt (ID = 2728)
11:06 AM: Found Spy Cookie: clickandtrack cookie
11:06 AM: guest@hits.clickandtrack[2].txt (ID = 2397)
11:06 AM: guest@hotbar[1].txt (ID = 2797)
11:06 AM: guest@msnportal.112.2o7[1].txt (ID = 1958)
11:06 AM: Found Spy Cookie: nextag cookie
11:06 AM: guest@nextag[2].txt (ID = 5014)
11:06 AM: guest@proxy.espn.go[1].txt (ID = 2729)
11:06 AM: Found Spy Cookie: reunion cookie
11:06 AM: guest@reunion[1].txt (ID = 3255)
11:06 AM: Found Spy Cookie: rightmedia cookie
11:06 AM: guest@rightmedia[1].txt (ID = 3259)
11:06 AM: guest@rsi.espn.go[1].txt (ID = 2729)
11:06 AM: Found Spy Cookie: tvguide cookie
11:06 AM: guest@rsi.tvguide[1].txt (ID = 3600)
11:06 AM: guest@sdc.tvguide[1].txt (ID = 3600)
11:06 AM: guest@sports.espn.go[1].txt (ID = 2729)
11:06 AM: Found Spy Cookie: tacoda cookie
11:06 AM: guest@tacoda[1].txt (ID = 6444)
11:06 AM: guest@tvguide[2].txt (ID = 3599)
11:06 AM: guest@www.888[1].txt (ID = 2020)
11:06 AM: Found Spy Cookie: burstbeacon cookie
11:06 AM: guest@www.burstbeacon[1].txt (ID = 2335)
11:06 AM: guest@www.tvguide[2].txt (ID = 3600)
11:06 AM: guest@yieldmanager[1].txt (ID = 3749)
11:06 AM: mildred@ad.yieldmanager[2].txt (ID = 3751)
11:06 AM: mildred@adknowledge[2].txt (ID = 2072)
11:06 AM: mildred@adopt.hbmediapro[2].txt (ID = 2768)
11:06 AM: Found Spy Cookie: belnk cookie
11:06 AM: mildred@belnk[1].txt (ID = 2292)
11:06 AM: mildred@dist.belnk[2].txt (ID = 2293)
11:06 AM: mildred@hits.clickandtrack[1].txt (ID = 2397)
11:06 AM: Found Spy Cookie: reliablestats cookie
11:06 AM: mildred@stats1.reliablestats[2].txt (ID = 3254)
11:06 AM: mildred@yieldmanager[2].txt (ID = 3749)
11:06 AM: Cookie Sweep Complete, Elapsed Time: 00:00:03
11:06 AM: Starting File Sweep
11:16 AM: Found Adware: apropos
11:16 AM: wingenerics.dll (ID = 50187)
11:17 AM: Found Adware: gatorclone
11:17 AM: bvca.dat (ID = 61655)
11:23 AM: Found Adware: hotbar
11:23 AM: hotbar.inf (ID = 62344)
11:23 AM: File Sweep Complete, Elapsed Time: 00:17:44
11:23 AM: Full Sweep has completed. Elapsed time 00:23:03
11:23 AM: Traces Found: 44
11:25 AM: Removal process initiated
11:25 AM: Quarantining All Traces: apropos
11:25 AM: apropos is in use. It will be removed on reboot.
11:25 AM: wingenerics.dll is in use. It will be removed on reboot.
11:25 AM: Quarantining All Traces: hotbar
11:25 AM: Quarantining All Traces: gatorclone
11:25 AM: Quarantining All Traces: 2o7.net cookie
11:25 AM: Quarantining All Traces: 888 cookie
11:25 AM: Quarantining All Traces: adecn cookie
11:25 AM: Quarantining All Traces: adknowledge cookie
11:25 AM: Quarantining All Traces: atwola cookie
11:25 AM: Quarantining All Traces: banner cookie
11:25 AM: Quarantining All Traces: belnk cookie
11:25 AM: Quarantining All Traces: burstbeacon cookie
11:25 AM: Quarantining All Traces: burstnet cookie
11:25 AM: Quarantining All Traces: cassava cookie
11:25 AM: Quarantining All Traces: clickandtrack cookie
11:25 AM: Quarantining All Traces: go.com cookie
11:25 AM: Quarantining All Traces: hbmediapro cookie
11:25 AM: Quarantining All Traces: hotbar cookie
11:25 AM: Quarantining All Traces: nextag cookie
11:25 AM: Quarantining All Traces: reliablestats cookie
11:25 AM: Quarantining All Traces: reunion cookie
11:25 AM: Quarantining All Traces: rightmedia cookie
11:25 AM: Quarantining All Traces: tacoda cookie
11:25 AM: Quarantining All Traces: tvguide cookie
11:25 AM: Quarantining All Traces: websponsors cookie
11:25 AM: Quarantining All Traces: yieldmanager cookie
11:26 AM: Preparing to restart your computer. Please wait...
11:26 AM: Removal process completed. Elapsed time 00:00:43
********