[Closed] Getting Pop-ups that computer is infected with virus/mal

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location.
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Post that log back here.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Thanks.

[attachment removed]hi, I appreciate your assistance. below is the DDS.txt report and the attachments. DDS (Version 1.0) - NTFSx86 Run by [removed] at 21:22:01.50 on Mon 11/24/2008 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255.75 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Linksys\WUSB300N\WLService.exe C:\Program Files\Linksys\WUSB300N\WUSB300N.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\AOL\1130894636\ee\AOLSoftware.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE F:\Virus Treatment Programs\dds.scr ============== Psuedo HJT Report =============== uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html mStart Page = hxxp://www.yahoo.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = hxxp://localhost uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: {52706EF7-D7A2-49AD-A615-E903858CF284} - c:\program files\netzero\qsacc\X1IEBHO.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [BCMSMMSG] BCMSMMSG.exe mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [AdaptecDirectCD] "c:\program files\roxio\easy cd creator 5\directcd\DirectCD.exe" mRun: [Lexmark X74-X75] "c:\program files\lexmark x74-x75\lxbbbmgr.exe" mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe mRun: [Bart Station] c:\program files\isp50\bin\PPCOLink -STATION mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [HostManager] c:\program files\common files\aol\1130894636\ee\AOLSoftware.exe mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [nwiz] nwiz.exe /install mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [JeticoPFStartup] "c:\program files\jetico\jetico personal firewall\fwsrv.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\minima~1.lnk - c:\program files\broderbund\mavis beacon teaches typing 12 deluxe\MiniMavis.exe IE: c:\progra~1\common~1\btlink\btlink.dll//iemenu IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML IE: Display All Images with Full Quality - c:\program files\netzero\qsacc\appres.dll/228 IE: Display Image with Full Quality - c:\program files\netzero\qsacc\appres.dll/227 IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe ============= SERVICES / DRIVERS =============== R2 WUSB300NSvc;WUSB300NSvc;"c:\program files\linksys\wusb300n\WLService.exe" "WUSB300N.exe" [2006-11-23 53307] R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;c:\windows\system32\drivers\AN983.sys [2008-11-23 36224] =============== Created Last 30 ================ 2008-11-24 12:00 410,976 a——- c:\windows\system32\deploytk.dll 2008-11-24 12:00 73,728 a——- c:\windows\system32\javacpl.cpl 2008-11-24 09:53 a-dshr– C:\cmdcons 2008-11-24 07:46 577,024 a——- c:\windows\system32\dllcache\user32.dll 2008-11-24 07:35 –d—– C:\SDFix 2008-11-24 06:31 –d—– c:\windows\system32\CatRoot_bak 2008-11-24 02:17 –d—– c:\windows\peernet 2008-11-24 02:17 –d—– c:\windows\provisioning 2008-11-24 02:13 –d—– c:\windows\ServicePackFiles 2008-11-24 01:33 –d—– c:\windows\EHome 2008-11-23 20:22 16,896 a–sh— c:\windows\Thumbs.db 2008-11-23 20:22 9,216 a–sh— c:\windows\system32\Thumbs.db 2008-11-23 20:17 –d—– c:\docume~1\mesi\applic~1\Jetico Personal Firewall 2008-11-23 20:04 –d—– c:\program files\Jetico 2008-11-23 19:55 –d—– c:\program files\SpywareBlaster 2008-11-23 19:51 36,224 a——- c:\windows\system32\drivers\an983.sys 2008-11-23 19:51 36,224 a——- c:\windows\system32\dllcache\an983.sys 2008-11-23 16:18 161,792 a——- c:\windows\SWREG.exe 2008-11-23 16:18 98,816 a——- c:\windows\sed.exe 2008-11-23 14:36 –d—– c:\docume~1\mesi\applic~1\Malwarebytes 2008-11-23 14:36 15,504 a——- c:\windows\system32\drivers\mbam.sys 2008-11-23 14:36 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-23 14:36 –d—– c:\program files\Malwarebytes' Anti-Malware 2008-11-23 14:36 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2008-11-23 12:02 –d—– c:\windows\ERUNT 2008-11-23 09:53 –d—– c:\program files\Trend Micro 2008-11-23 09:12 19,456 a——- c:\docume~1\mesi\applic~1\ufmohb.exe 2008-11-23 08:54 19,456 a——- c:\docume~1\mesi\applic~1\ajvlwgxy.exe 2008-11-23 08:45 19,456 a——- c:\docume~1\mesi\applic~1\iput.exe 2008-11-22 12:15 19,456 a——- c:\docume~1\mesi\applic~1\fjyetgpifwld.exe ==================== Find3M ==================== 2008-11-24 20:53 –d—– c:\program files\Executive Software 2008-11-24 02:46 79,787 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-11-24 02:17 –d—– c:\program files\Messenger 2008-11-24 02:13 –d—– c:\program files\Windows NT 2008-11-23 18:28 –d—– c:\program files\MUSICMATCH 2008-11-23 16:20 –d—– c:\program files\Advanced IP Address Calculator 2008-10-16 14:13 1,809,944 a——- c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 14:09 92,696 a——- c:\windows\system32\dllcache\cdm.dll 2008-10-16 14:09 51,224 a——- c:\windows\system32\dllcache\wuauclt.exe 2008-03-02 01:06 –d—– c:\docume~1\mesi\applic~1\AOL 2008-02-18 17:17 –d—– c:\docume~1\mesi\applic~1\NCH Swift Sound 2008-01-28 16:58 –d—– c:\docume~1\alluse~1\applic~1\NCH Swift Sound 2008-01-28 16:58 –d—– c:\docume~1\mesi\applic~1\Recordpad 2007-12-08 16:23 –d—– c:\docume~1\mesi\applic~1\SBTT 2007-12-07 19:08 –d—– c:\docume~1\alluse~1\applic~1\Kodak 2007-03-10 19:35 –d—– c:\docume~1\alluse~1\applic~1\STOPzilla! 2007-03-10 19:32 –d—– c:\docume~1\alluse~1\applic~1\ZILLAbar 2007-03-03 19:39 –d—– c:\docume~1\mesi\applic~1\Viewpoint 2007-03-03 19:39 –d—– c:\docume~1\alluse~1\applic~1\Viewpoint 2007-02-26 20:02 –d—– c:\docume~1\mesi\applic~1\Jasc Software Inc 2005-06-20 13:57 –d—– c:\docume~1\alluse~1\applic~1\Dell 2005-05-31 11:43 –d—– c:\docume~1\mesi\applic~1\You've Got Pictures Screensaver 2005-05-31 11:41 –d—– c:\docume~1\alluse~1\applic~1\Pure Networks 2005-03-04 20:49 –d—– c:\docume~1\mesi\applic~1\MSNInstaller 2003-03-24 21:52 –d—– c:\docume~1\mesi\applic~1\MSN6 2003-02-07 14:37 –d—– c:\docume~1\alluse~1\applic~1\MSN6 2003-02-04 00:22 –d—– c:\docume~1\alluse~1\applic~1\BVRP Software 2003-02-04 00:20 –d—– c:\docume~1\alluse~1\applic~1\SBSI ============= FINISH: 21:22:40.35 ===============

Hi

Do you have a MalwareBytes' AntiMalware log for me?

I notice that you have recently run ComboFix, this tool should not be run without supervision. Are you receiving help from anywhere else?


Viewpoint Media Player is often installed without the users permission. If you didn't install it, or if you did but you no longer use it, I recommend you get rid of it.

Please click Start >> Control Panel >> Add or Remove Programs.
Find the item below on the list and click Remove.
Viewpoint Media Player
Let me know how it goes.

Please download OTMoveIt3 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :files
  c:\Documents and Settings\mesi\Application Data\ufmohb.exe
  c:\Documents and Settings\mesi\Application Data\ajvlwgxy.exe
  c:\Documents and Settings\mesi\Application Data\iput.exe
  c:\Documents and Settings\mesi\Application Data\fjyetgpifwld.exe
  
  :Reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52706EF7-D7A2-49AD-A615-E903858CF284}]
  [-HKEY_CLASSES_ROOT\CLSID\{52706EF7-D7A2-49AD-A615-E903858CF284}]
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
  [-HKEY_CLASSES_ROOT\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
  
  :Commands
  [emptytemp]
  [Reboot]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


Run Eset NOD32 Online AntiVirus
http://www.eset.eu/online-scanner
Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
• Click Start
• Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checked
• Click Scan
• Wait for the scan to finish
• Re-enable your Anvirisus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

Also, please give a detailed description of how your computer is running and behaving at the moment, listing any remaining problems.

Thanks.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log