new annoying pop up [Archive] - StatCounter User Forum

gavinmullins

10-16-2006, 05:08 PM

StevenofNine

10-16-2006, 05:22 PM

Could you tell us what browser you're using, and your script settings, and any pop-ups blockers you may be using?

Thanks.

gavinmullins

10-16-2006, 05:48 PM

I am using IE6 and i have norton, adware and i used a few others to try and find the spyware, but they were no good.

regards
gavin

Brisguy52

10-16-2006, 05:52 PM

Gavin, give us some details please

faze3

10-16-2006, 08:06 PM

Oh dear - I remember posting the exact same problem concerning a Win Cleaner about a year ago. I too had Norton, Ad Aware, Spybot plus various others. Not only did I never manage to clear it the popups got worse and worse until the computer become unusable and I had to get a "whiz-kid" in to format the hard disk and start all over again.
Sorry :-(
Alan.

Edit: Here's one of various forums where the problem was sorted:
http://www.bullguard.com/forum/5/Annoying-WinFix-2006-problem_29008.html
You'll need to have HijackThis and follow their instructions carefully. Good luck - it's a nasty one !!!!!!!!!!

trackerm

10-16-2006, 11:16 PM

I am using IE6 and i have norton, adware and i used a few others
gavin

Hi Gavin,

Like Ken says: Give us more details! We are super star brainy buggers of the highest degree but we haven't learned to mind read over 1,000 miles. Less than 1,000 is no problem. :)

Write down the EXACT wording the pop up pops up and stick it into Google and you will find some other non-mind reading geek has a solution :)

Spybot is good on some things too, but the best I find is google and the file search on your own computer. I find tracking them and killing them great fun! :)

Mark

Brisguy52

10-17-2006, 03:50 AM

Gavin, try these 2 and see if you can make any progress -

http://www.auditmypc.com/

http://www.sysinternals.com/Utilities/ProcessExplorer.html

wisdaj

10-17-2006, 04:27 AM

Does anyone know how to keep Avenue A from coming in with statcounter? My Spybot/Adaware detects it piggybacking on everything I do with statcounter.

webado

10-17-2006, 05:52 AM

It's an ad provider. Have pop-up killer on. You won't get it again.

gavinmullins

10-17-2006, 10:47 AM

hi guys,

this is the log file i got using Hijack this

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = local
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {955253BC-B155-47FB-BC40-2FF9B7DBB2A5} - C:\WINDOWS\system32\mlanemx.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.d ll (file missing)
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Tair] "C:\PROGRA~1\CROSOF~1.NET\iexplore.exe" -vt yax
O4 - HKCU\..\Run: [Jdocxtko] C:\Documents and Settings\Gavin\My Documents\?racle\n?tepad.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.711.1664\Go ogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://uploads.cadansolutions.com/ImageUploader3.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - http://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: mlanemx - C:\WINDOWS\SYSTEM32\mlanemx.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: wincqt32 - wincqt32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Is the little bugger in there? i see afew no name files, but can you spot anything?

gavin

trackerm

10-17-2006, 11:35 AM

Hey Gav:
Write down the EXACT wording the pop up pops up

now please: Write down the EXACT wording the pop up pops up and then tell us!

Thanks mate :)

Mark

PS PartyPoker.com and prosearching.com search for them in registry and delete all keys but please first tell us what it says in the pop up

webado

10-17-2006, 01:28 PM

Gavin, you're best to post this in the forum that deals with Hijackthis!. They have the experts for this stuff.

gavinmullins

10-18-2006, 08:04 AM

thanks Christina, i will try them.

Mark, there are several pop ups, from search pop ups relating to the page content i am viewing....there are pop ups for the winfix drive cleaner...there are warning pop ups...to many to try and list out.
I think the Hijack this forum has the answers, but thanks for looking at it.

be good

gavin

geordie joe

10-18-2006, 01:12 PM

hello all,

i got this new annoying pop up and i can't get rid of it.

it asks me if i want to download an win cleaner, i tried using everything from adware, norton and a few others..but it just wont go away

the pop ups appear about the disk cleaner and another one about earning £3000 a week is appearing too.

i also get a page that appears with the header 404 and i have to use Task manager to get rid of it......

how....where....why cant this just go away.......hhheeellllllppppp

gavin

Hi Gavin

I'm pretty sure I had win cleaner a year or so ago. The only thing that got rid of it was a file called Vundofix.exe

Can't remember where I got it from, only that it worked when nothing else did. A google search should find it.

gavinmullins

10-18-2006, 01:59 PM

no, it did not work, but thanks anyway

gavin

geordie joe

10-18-2006, 02:16 PM

Hi Gavin

I'm pretty sure I had win cleaner a year or so ago. The only thing that got rid of it was a file called Vundofix.exe

Can't remember where I got it from, only that it worked when nothing else did. A google search should find it.

Statcounter is used on the site. Ok, not all the pages have the code yet, but I'm getting there

robinev

10-18-2006, 07:14 PM

Based on a quick look at the posted processes, the most suspicious item is probably msmsgs.exe

Check out this page -- especially the comments:

http://www.neuber.com/taskmanager/process/msmsgs.exe.html

Although there is some disagreement there, that file appears to be something other than MSN Messenger and is probably not something that you'd want.

---
Although it's not related to this file, you should also make sure that the network service called "Messenger" is disabled. That's a service necessary only for machines on a corporate LAN.

Disable it by launching Start\All Programs\Administrative Tools\Component Services.

Click "Services (Local)" in the left window. Double-click "Messenger" in the right window. Change "Startup type" to "Disabled".