After installing a program I immediately began receiving nuisance pop-ups. I looked in add/remove programs and saw some other things had been installed with the original application I was installing. Even after I removed those 2 programs I still get these pop-ups. Here is my hijack this log:
Logfile of HijackThis v1.99.1
Scan saved at 2:17:24 PM, on 5/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4A45BDE2-1569-48D1-A3BE-CAC59FF04090} - C:\Program Files\Windows Media Player\hoken.dll
O2 - BHO: 0 - {F7626865-A165-4C18-C3B0-20E5447A509D} - C:\Program Files\Messenger\lavuhax.dll
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
I also found a similar thread on this forum but didn't have any of the same items the other user was instructed to remove. The main pop-up seems to be exciteexchange and revenueloop if that is helpful.
I was using ad-aware for awhile, but it didn't help this situation. I installed AVG and did a scan which found a few things ad-aware missed and restarted like you said. However, there are still these pop-ups.
As far as how my computer is acting, if I do stuff besides looking around on the internet (watching movies for instance) it performs fine like it always has. But, when I look at websites, every time I come to a new page, I get a pop-up and occasionally a window will fade in over the page I'm looking at and bring up things like eBay search results for something I recently searched for, or results on "toseeka".
My new HJT log is:
Logfile of HijackThis v1.99.1
Scan saved at 4:14:18 PM, on 5/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab. Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders." Clear "Hide protected operating system files."
Click Apply, and then click OK.
Please do not delete anything unless instructed to.
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:
O2 - BHO: (no name) - {4A45BDE2-1569-48D1-A3BE-CAC59FF04090} - C:\Program Files\Windows Media Player\hoken.dll
O2 - BHO: 0 - {F7626865-A165-4C18-C3B0-20E5447A509D} - C:\Program Files\Messenger\lavuhax.dll (file missing)
Close ALL windows and browsers except HijackThis and click "Fix checked"
Delete this File if listed:
C:\Program Files\Windows Media Player\hoken.dll
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)
It's normal after running ATF cleaner that the PC will be slower to boot the first time.
Next:
Download AVG Anti-Spyware from HERE and save that file to your
desktop. This is a 30 day trial of the program
Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run ewido and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
Next select the "Start Update" button, the update will start and a
progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select ""Quarantine" .".
Under "Reports"
Select "Automatically generate report after every scan"
Un-Select "Only if threats were found"
Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter. IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
ewido will now begin the scanning process, be patient this may take a little
time. Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
results of the AVG Anti-Spyware report scan along with a new HijackThis log.
Logfile of HijackThis v1.99.1
Scan saved at 6:58:08 PM, on 5/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
