popups

Hello lowkey and Welcome to TomCoyote,

Please do the following:

======
Combofix

• Download this file - combofix.exe
• Double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

lowkey - 06-08-29 20:11:01.71 ComboFix 06.08.27BT - Running from: C:\Documents and Settings\ ((((((((((((((((((((((((((((((( Files Created from 2006-07-29 to 2006-08-29 )))))))))))))))))))))))))))))))))) 2006-08-27 20:27 9,488 –a—— C:\WINDOWS\system32\sporder.dll 2006-08-27 20:27 61,440 –a—— C:\WINDOWS\system32\pavipc.dll 2006-08-27 20:27 45,056 –a—— C:\WINDOWS\system32\avldr.dll 2006-08-27 20:27 446,464 –a—— C:\WINDOWS\system32\HHActiveX.dll 2006-08-27 20:27 253,952 –a—— C:\WINDOWS\system32\PavSHook.dll 2006-08-27 20:27 131,072 –a—— C:\WINDOWS\system32\TpUtil.dll 2006-08-27 20:27 102,400 –a—— C:\WINDOWS\system32\SYSTOOLS.DLL 2006-08-22 16:23 78,488 –a—— C:\WINDOWS\system32\XMD5.dll 2006-08-22 16:23 101,888 –a—— C:\WINDOWS\system32\vb6stkit.dll 2006-08-22 16:22 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll 2006-08-22 13:31 139,264 –a—— C:\WINDOWS\MirarSetup_876075.exe 2006-08-22 13:31 115,160 –a—— C:\WINDOWS\Eim03.exe 2006-08-21 10:36 78,848 –a—— C:\WINDOWS\system32\nsx87.dll 2006-08-16 23:10 2,977,792 ——— C:\WINDOWS\UNNMP.exe 2006-08-16 23:08 155,648 –a—— C:\WINDOWS\system32\NeroCheck.exe 2006-08-16 23:07 3,031,040 ——— C:\WINDOWS\UNNeroVision.exe 2006-08-16 23:06 38,912 ——— C:\WINDOWS\system32\picn20.dll 2006-08-16 21:01 106,496 ——— C:\WINDOWS\system32\TwnLib20.dll 2006-08-04 15:46 414,272 –a—— C:\WINDOWS\system32\DivXc32f.dll 2006-08-04 15:46 414,272 –a—— C:\WINDOWS\system32\DivXc32.dll 2006-08-04 15:23 243,824 –a—— C:\WINDOWS\unicows.dll 2006-08-04 10:37 196,608 –a—— C:\WINDOWS\system32\dtu100.dll 2006-08-02 21:06 737,280 –a—— C:\WINDOWS\iun6002.exe 2006-08-02 20:36 109,568 ——— C:\WINDOWS\system32\pxinsi64.exe 2006-08-02 20:36 108,544 ——— C:\WINDOWS\system32\pxcpyi64.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-08-29 00:31 ——– d——– C:\Program Files\WinTV 2006-08-29 00:26 ——– d——– C:\Program Files\Messenger 2006-08-28 22:46 ——– d——– C:\Program Files\RegVac Registry Cleaner 2006-08-28 18:13 ——– d——– C:\Program Files\Internet Explorer 2006-08-28 18:11 9216 –a—-t- C:\WINDOWS\system32\drivers\fnetmon.sys 2006-08-28 18:11 44928 –a—-t- C:\WINDOWS\system32\drivers\APPFLT.SYS 2006-08-28 18:11 36224 –a—-t- C:\WINDOWS\system32\drivers\netfltdi.sys 2006-08-28 18:11 30208 –a—-t- C:\WINDOWS\system32\drivers\dsaflt.sys 2006-08-28 18:11 178944 –a—-t- C:\WINDOWS\system32\drivers\idsflt.sys 2006-08-28 18:11 17536 –a—-t- C:\WINDOWS\system32\drivers\smsflt.sys 2006-08-28 18:11 115968 –a—-t- C:\WINDOWS\system32\drivers\netflt.sys 2006-08-28 18:11 11264 –a—-t- C:\WINDOWS\system32\drivers\wnmflt.sys 2006-08-28 02:06 ——– d——– C:\Program Files\WinRAR 2006-08-27 22:27 ——– d——– C:\Documents and Settings\Application Data\Yahoo! 2006-08-27 20:27 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-08-27 20:25 ——– d——– C:\Program Files\Panda Software 2006-08-27 20:21 ——– d——– C:\Program Files\Yahoo! 2006-08-27 20:20 ——– d——– C:\Program Files\Common Files\Scanner 2006-08-27 20:14 ——– d——– C:\Program Files\Common Files 2006-08-27 19:49 ——– d——– C:\Program Files\Common Files\Panda Software 2006-08-27 15:44 ——– d——– C:\Program Files\RegistrySmart 2006-08-26 13:19 ——– d——– C:\Program Files\XoftSpy 2006-08-24 18:17 ——– d——– C:\Program Files\Warez 2006-08-24 07:05 ——– d——– C:\Program Files\Java 2006-08-24 07:03 ——– d——– C:\Program Files\Common Files\Java 2006-08-23 19:54 ——– d——– C:\Program Files\Google 2006-08-23 19:53 ——– d——– C:\Program Files\BitComet 2006-08-23 05:53 ——– d——– C:\Program Files\Windows Media Player 2006-08-23 05:47 ——– d——– C:\Program Files\Outlook Express 2006-08-23 05:47 ——– d——– C:\Program Files\Common Files\System 2006-08-22 17:31 ——– d—s—- C:\Documents and Settings\Application Data\Microsoft 2006-08-22 16:22 ——– d——– C:\Program Files\Alwil Software 2006-08-16 23:10 ——– d——– C:\Program Files\Ahead 2006-08-16 21:19 ——– d——– C:\Documents and Settings\Application Data\Ahead 2006-08-16 20:38 ——– d——– C:\Program Files\Common Files\Nero 2006-08-16 20:01 ——– d——– C:\Program Files\Common Files\Ahead 2006-08-16 16:34 ——– d——– C:\Documents and Settings\Application Data\Nero 2006-08-16 15:13 ——– d——– C:\Documents and Settings\Application Data\Lavasoft 2006-08-16 15:12 ——– d——– C:\Program Files\Lavasoft 2006-08-15 22:27 ——– d——– C:\Program Files\Fichiers communs 2006-08-13 00:49 81920 –a—— C:\Documents and Settings\Application Data\ezpinst.exe 2006-08-13 00:49 7176 –a—— C:\Documents and Settings\Application Data\pcouffin.cat 2006-08-13 00:49 47360 –a—— C:\Documents and Settings\Application Data\pcouffin.sys 2006-08-13 00:49 33 –a—— C:\Documents and Settings\Application Data\pcouffin.log 2006-08-13 00:49 1144 –a—— C:\Documents and Settings\Application Data\pcouffin.inf 2006-08-13 00:49 ——– d——– C:\Program Files\vso 2006-08-13 00:49 ——– d——– C:\Documents and Settings\Application Data\Vso 2006-08-10 13:42 ——– d——– C:\Documents and Settings\Application Data\vlc 2006-08-09 15:42 47360 –a—— C:\WINDOWS\system32\drivers\pcouffin.sys 2006-08-07 20:00 ——– d——– C:\Program Files\BitTorrent 2006-08-06 22:43 ——– d——– C:\Program Files\InterActual 2006-08-06 00:23 ——– d——– C:\Documents and Settings\Application Data\BitTorrent 2006-08-05 22:15 ——– d——– C:\Program Files\DivX 2006-08-04 10:37 73728 –a—— C:\WINDOWS\system32\dpl100.dll 2006-08-02 22:21 ——– d——– C:\Documents and Settings\Application Data\Real 2006-08-02 22:18 ——– d——– C:\Program Files\Real 2006-08-02 22:18 ——– d——– C:\Program Files\Common Files\xing shared 2006-08-02 22:18 ——– d——– C:\Program Files\Common Files\Real 2006-08-02 22:12 ——– d——– C:\Documents and Settings\Application Data\Ulead Systems 2006-08-02 20:39 ——– d——– C:\Program Files\GrabIt 2006-08-01 16:35 ——– d——– C:\Program Files\SlySoft 2006-08-01 16:35 ——– d——– C:\Documents and Settings\Application Data\SlySoft 2006-08-01 16:34 40 —hs—- C:\Documents and Settings\Application Data\.zreglib 2006-07-27 08:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-07-26 21:05 3596288 –a—— C:\WINDOWS\system32\qt-dx331.dll 2006-07-23 10:46 ——– d——– C:\Program Files\ftapirate.tv 2006-07-21 13:55 ——– d——– C:\Documents and Settings\Application Data\Motive 2006-07-21 03:24 72704 –a—— C:\WINDOWS\system32\hlink.dll 2006-07-18 18:13 20640 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys 2006-07-16 11:53 ——– d——– C:\Program Files\BroadJump 2006-07-09 17:19 ——– d——– C:\Documents and Settings\Application Data\Digital Album Organizer 2006-07-09 17:14 ——– d——– C:\Program Files\Microsoft Picture It! 7 2006-07-03 16:40 778240 –a—— C:\WINDOWS\system32\divx_xx0c.dll 2006-07-03 16:40 778240 –a—— C:\WINDOWS\system32\divx_xx07.dll 2006-07-03 16:40 761856 –a—— C:\WINDOWS\system32\divx_xx11.dll 2006-07-03 16:40 620180 –a—— C:\WINDOWS\system32\DivX.dll 2006-06-21 05:49 53248 –a—— C:\WINDOWS\system32\dpuGUI10.dll 2006-06-21 05:43 520192 –a—— C:\WINDOWS\system32\DivXsm.exe 2006-06-21 05:42 200704 –a—— C:\WINDOWS\system32\ssldivx.dll 2006-06-21 05:42 1044480 –a—— C:\WINDOWS\system32\libdivx.dll 2006-06-21 05:34 593920 –a—— C:\WINDOWS\system32\dpuGUI11.dll 2006-06-21 05:34 57344 –a—— C:\WINDOWS\system32\dpv11.dll 2006-06-21 05:34 344064 –a—— C:\WINDOWS\system32\dpus11.dll 2006-06-21 05:34 294912 –a—— C:\WINDOWS\system32\dpu11.dll 2006-06-21 05:34 294912 –a—— C:\WINDOWS\system32\dpu10.dll 2006-06-21 05:33 12288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll 2006-06-21 05:33 118784 –a—— C:\WINDOWS\system32\DivXCodecUpdateChecker.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\"" "APVXDWIN"="\"C:\\Program Files\\Panda Software\\Panda Platinum 2006 Internet Security\\APVXDWIN.EXE\" /s" "SCANINICIO"="\"C:\\Program Files\\Panda Software\\Panda Platinum 2006 Internet Security\\Inicio.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1" "Yahoo! Pager"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,42,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr Completion time: 06-08-29 20:12:37.45 ComboFix.txt ComboFix2.txt ComboFix3.txt

Hi lowkey,

Please do the following:

STEP 1.
======
DelDomains

Download this file to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

Note, if you use SpywareBlaster and/or IE/Spyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE/Spyads, run the batch file and reinstall the protection



STEP 2.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.


STEP 3.
======
The Ewido program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded ewido anti-spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while ewido is scanning, it may interfere with the scanning proccess:
• Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close ewido and reboot your system back into Normal Mode and post the
  results of the ewido report scan.

Please post the results from SpySweeper, ewido and a new hijackthis log.

You fixed my problem. Thankyou so very much!

Please post (reply) with a hijackthis log. Do you really know for sure that I fixed all your problems?

Hi lowkey,

I see just a few things that need to be fixed.

I am curious. Did you run SpySweeper and Ewido? I see no indications of it in your log. Did you uninstall them after everything was cleared up?

Also I want to warn you about Warez. I noticed that you had C:\Program Files\Warez show up in the Combofix log. Warez applications may be bundled with malware, pirated and cracked software programs. I would delete anything I obtained from Warez and stay away from it.

Scan with HijackThis. Place a check against each of the following:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Yes i did delete those programs after i used them. They worked great. Thankyou.

Hi lowkey,

Glad your problem has cleared up! Your hijackthis log appears to be clean. You did not let me see the results of ewido and SpySweeper. I am assuming that everything was cleaned there too since you did not tell me otherwise.

Stay away from Warez.

Please do the following to help prevent infections.

STEP 1.
======
Cleanmgr
To clean temporary files:

• Go > start > run and type cleanmgr and click OK
• Scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
• Click OK to remove those files.
• Click Yes to confirm deletion.

STEP 2.( Windows XP only)
======
Prefetch Folder
Open C:\Windows\Prefetch\
Delete All files in this folder but not the Prefetch folder

STEP 3.
======
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

• Turn off System Restore.
• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

STEP 4.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  A tutorial on installing & using this product can be found here:
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  A tutorial on installing & using this product can be found here:
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  
• More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php