xxxsmittyxxx
Topic Starter
Okay hi my name is bryan and i have a pop up problem thats annoying but not unmanageable.
A few days ago i downloaded a program called "limewire"; most of you know what this is,
and then from limewire i downloaded (Friend Blaster Pro 8.8), and (friend blaster Pro 8.8 crack)
Its basically a myspace related program for adding friends at a rapid pace but aside from the point,
I used the program for awhile, yeah fun stuff enjoyed, until i started getting pop ups in internet explorer.
The thing is i dont even use internet explorer nor is it even my default web browser and yes the pop up
setting are set to highest possible. I also have my mozillas pop up blocker set correctly.
Okay so i deleted the friend blaster program, and the crack only to find i was still getting popups.
If i stay on a certain web page after the pop up has opened, then no more will open and i can freely
view that page with no pop ups / annoyance.
It seems as though everytime i view a new page on firefox, it registers the cookie and ie opens.
My pc has never been sick before downloading friend blaster so im sure thats where the problem
stems from. I have ran adaware/spybot s&d/hijack this and adaware and spybot did find infections.
Adaware found malware and tracking cookies so i cleared the cookies and quarantined the infected files.
Didnt help.
Spybot found 27 files, which were apparently all healed but i remain getting pop ups.
heard about hijack this from a friend today so i downloaded and tried the scan. I have not
deleted anything yet and i do indeed know the importance of seeking professional help which
is why i came to this forum.
might as well post this since its important
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:19:31 AM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Scan.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
–
End of file - 2061 bytes
In my honest opinion i cant seem to find any reason any of these files are infected but im probably wrong.
Ill be around all night so any help will be greatly appreciated.
EDIT:
Okay another question add to my problem. Can javascript cause pop ups to display, or trigger when you visit a new web page?
I took "jason levine's" computer test and failed the javascript/pop-up test so i thought i would add that in.
