What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Working backwards NOT working!

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I have been fighting popups on my PC for over a week with no success. To make troubleshooting worse, I have been adding firewalls and and other anti-spyware applications mentioned from your website haphazardly. I would like to post a HijackThis! trace log and either combofix or ewido as well, but I have installed a number of other features to make your efforts less-than-appealing. I currently have: McAfree Personal Firewall Plus MacAfree Security Center AVG 7.1 Professional ewido anti-spyware 4.0 Ad-Aware SE Personal ewido combofix HijackThis Of course the above were installed AFTER pop-ups started, and I still get 'em. Let me know what steps I can follow to the letter and give you a clean look at the desired logs. Thanks, SM! :)
Post #2
Hi, I haven't received any recommendations, so here is my ewido log thru Safe Mode: ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 9:30:07 PM 9/17/2006 + Scan result: C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@nbcuniversal.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@com[1].txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@commission-junction[2].txt -> TrackingCookie.Commission-junction : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][2].txt -> TrackingCookie.Enhance : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][2].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Goclick : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\[removed][2].txt -> TrackingCookie.Webtrendslive : Cleaned. C:\Documents and Settings\smcelhiney\Cookies\smcelhiney@zedo[2].txt -> TrackingCookie.Zedo : Cleaned. ::Report end
Post #3
And here is the Hijack This log following:

Logfile of HijackThis v1.99.1
Scan saved at 9:49:29 PM, on 9/17/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\hidserv.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Documents and Settings\smcelhiney\Desktop\HJT\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (file missing)
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINNT\system32\nsjF.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,23/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…846/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = trais.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = trais.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = trais.com
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI