I have been messing with this pain for almost 5 hours. I have used
AVG,
SpyHunter
SpySweeper
Nortons
I have removed everything that I could find that did not belong.
I have been reading on manual removal of DriveCleaner and the msot common products that display the popups.
I am going out of my mind. I STILL have popups after 5 hours of tracking, reading, removing, and cursing!
Here is the most recent HJT log (In safe mode). As you can see there is not much at all running on my machine.
I will reboot and post a HJT log NOT in safe mode.
Logfile of HijackThis v1.97.7
Scan saved at 1:03:59 AM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Logfile of HijackThis v1.97.7
Scan saved at 1:16:49 AM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Here you go. Sorry about that. here is the new log not in safe mode.
Logfile of HijackThis v1.99.1
Scan saved at 9:24:18 PM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at
reboot.
——————-
Reboot and post a fresh HJT log and the logs from ComboFix and VundoFix, MrC
I soooo wish I could tell where they were coming from. Then I wouldn't be here and you could be helping people that need it more. (Althought I do truely appreciate your help)
Did what you said. Still have a ton of popups when I start up.
Logfile of HijackThis v1.99.1
Scan saved at 11:27:48 PM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
I soooo wish I could tell where they were coming from. Then I wouldn't be here and you could be helping people that need it more. (Althought I do truely appreciate your help)
Sometimes it will say in the ad where they are from or provided by.
————————————
Nothing major showing yet.
I do see one thing:
C:\\Program Files\\Windows NT\\rtesejifsi.html <— do you recognize this file?
If not copy and paste the text below into notepad and save it as fix.reg
save it as type "all files"
Double click on it and allow it to merge into the registry.
———————
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
Delete this file:
C:\\Program Files\\Windows NT\\rtesejifsi.html
———————————-
Do you have the log from AVG Anti-Spyware 7.5?
——————–
Clean out temp files:
Download and run ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then click "empty selected" That will clear out all the temp files on the system.
Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click "Yes",
Let it through your firewall!
Under "Configuration and Preferences", click the "Preferences" button.
Click the "Scanning Control" tab.
Under "Scanner Options" make sure the following are checked:
1>> Close browsers before scanning
2>> Scan for tracking cookies
3>> Terminate memory threats before quarantining.
4>> Ignore System Restore/Volume Information on ME and XP
5>> Please leave the others unchecked.
6>> Click the Close button to leave the control center screen.
On the main screen, under "Scan for Harmful Software" click "Scan your
computer".
On the left check "C:\Fixed Drive".
On the right, under "Complete Scan", choose "Perform Complete Scan".
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click "OK".
Make sure everything in the white box has a check next to it, then click "Next".
It will quarantine what it found and if it asks if you want to reboot, click
"Yes".
To retrieve the removal information - please do the following:
1>> After reboot, double-click the "SUPERAntispyware icon" on your desktop.
2>> Click "Preferences". Click the "Statistics/Logs tab".
3>> Under "Scanner Logs", double-click "SUPERAntiSpyware Scan Log".
4>> It will open in your default text editor (such as Notepad/Wordpad).
5>> Please highlight everything , then right-click and choose copy.
6>> Click close and close again to exit the program.
Now please paste the "removal information" along with a fresh "HijackThis log" in your reply. If it's a large log, you may need several replies to post it.
Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\owner@cpvfeed[2].txt
C:\Documents and Settings\Owner\Cookies\owner@adbrite[2].txt
C:\Documents and Settings\Owner\Cookies\owner@mb[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.k8l[1].txt
Here is the AVG Log
+ Created at: 10:51:45 PM 1/4/2007
+ Scan result:
Nothing found.
::Report end
Here is the new HJT log.
Logfile of HijackThis v1.99.1
Scan saved at 10:53:04 PM, on 1/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Xoft won't let me collect a log because I only have the trial. It is finding Viewsoft in a few registry keys that I could not find when I looked for them. This is the only program that is finding anything right now, but I can't buy ANOTHER program.
I have a person on another forum with basically the same problem as you, haven't found the solution yet.
——————-
Open up HJT and click on "Open the misc tools section"
Scroll down to "Open uninstall manager"
Double click on it and save the log - post it back here.
———————–
Download FindAWF.exe from the link below to your desktop:
http://noahdfear.geekstogo.com/FindAWF.exe
Double click on it to run it.
It will create a log called awf.txt
Please copy and post it back here.
Please note:
If a DOS window does not stay open throughout the search (approx a minute) you need to change how the program runs. Heres how:
1. Locate the file
2. Right-click and select Properties
3. Select Compatibility and select Run this program in compatibility mode for: Windows 98/Windows ME and click OK.
4. The tool should now work.
———————-
Here's three free online scans - see if they find anything.
Run Panda's ActiveScan from here and perform a full system scan.
- Once you are on the Panda site click the "Scan your PC" button
- A new window will open…click the big "Check Now" button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on "Local Disks" to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Looks like deleting that file and editing the registry was the fix. No more popups.
I didn't get a chance to complete the other requests. i went to do it and noticed no popups so I didn't bother.
THANK YOU SOOO MUCH! I appreciate your help.
Visit Windows Update and install all the lastest critical updates.
Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked.
IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
or try the new ZonedOut
Keep those temp files off your system use CCleaner
Uncheck "Cookies" under "Internet Explorer".
or ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then "empty selected" That will clear out all the temp files on the system.
IMPORTANT!!
Keep your Sun Java up-to-date JRE 6 <–newest version
Download page JRE 6 Java Tutorial
Delete ALL old versions from add/remove programs if listed first!
Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
