Windows ME Constant gambling pop-up windows [RESOLVED]

Welcome Guest ( Log In | Join )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

2 Pages

1 2 >

Windows ME Constant gambling pop-up windows [RESOLVED], Can't get rid of pop-up ads

Options

spiritoh View Member Profile	Jul 23 2005, 09:53 AM Post #1
Member Posts: 14 From: OH OS: Windows XP	Hi, can anyone please help me get rid of whatever malware or spyware on this Windows ME system. I keep getting pop-ups and I've tried Adware Se and all the virus software I can find to get rid of these things and they still keep coming back. Here's my HiJack this log: Logfile of HijackThis v1.99.1 Scan saved at 11:40:48 AM, on 7/23/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v5.50 SP1 (5.50.4134.0100) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\EN-US\MSNAPPAU.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\WINDOWS\ARPRBL.EXE C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\COMMON FILES\CHANNEL 3 WEATHER WIZARD\TRUEWEATHER.EXE C:\WINDOWS\WEBSHOTS.SCR C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\LAVASOFT\AD-AWARE SE PERSONAL\AD-AWARE.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL O1 - Hosts: 64.91.255.87 www.dcsresearch.com O1 - Hosts: 64.91.255.87 www.dcsresearch.com O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.2607.0\EN-US\MSNTB.DLL O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [winsync] C:\WINDOWS\arprbl.exe reg_run O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Startup: pkrk.exe O4 - Global Startup: Channel 3 Weather Wizard.lnk = C:\Program Files\Common Files\Channel 3 Weather Wizard\TrueWeather.exe O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL (HKCU) O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr...Transporter.cab? O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

tampabelle View Member Profile	Jul 23 2005, 10:03 AM Post #2
Member 5k Posts: 6,363 OS: Windows XP	Please Download the following tools to assist us in removing this infection! Download WinPFind Right Click the Zip Folder and Select "Extract All" Extract it somewhere you will remember like the Desktop Dont do anything with it yet! Download Track qoo Save it somewhere you will remember like the Desktop Reboot into Safe Mode Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. Doubleclick WinPFind.exe Click "Start Scan" It will scan the entire System, so please be patient! Once the Scan is Complete Go to the WinPFind folder Locate WinPFind.txt Place those results in the next post! Reboot back to Normal Mode! Double Click on "Track qoo.vbs" Note - If you Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless! Wait a few seconds and a notepad page will pop up, Copy & Paste those results and place them in the next post along with the results of WinPFind!

spiritoh View Member Profile	Jul 23 2005, 10:42 AM Post #4
Member Posts: 14 From: OH OS: Windows XP	I meant to say I could NOT find the Track qoo.vbs the link you gave to me to download it, came back saying that it was not found

spiritoh View Member Profile	Jul 23 2005, 11:05 AM Post #5
Member Posts: 14 From: OH OS: Windows XP	found the Track qoo file and downloaded and ran the script here's the results: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s" "SystemTray"="SysTray.Exe" "Logitech Utility"="Logi_MwX.Exe" "LoadQM"="loadqm.exe" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "msnappau"="\"C:\\Program Files\\MSN Apps\\Updater\\01.03.0000.1005\\en-us\\msnappau.exe\"" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "winsync"="C:\\WINDOWS\\arprbl.exe reg_run" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" ----------------- HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers Subkey --- Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} C:\WINDOWS\SYSTEM\SHELL32.DLL Subkey --- BriefcaseMenu {85BBD920-42A0-1069-A2E4-08002B30309D} syncui.dll Subkey --- Kaspersky Anti-Virus {dd230880-495a-11d1-b064-008048ec2fc5} C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\SHELLEX.DLL ===================== HKEY_CLASSES_ROOT\Folder\shellex\ColumnHandlers Subkey --- {24F14F01-7B1C-11d1-838f-0000F80461CF} C:\WINDOWS\SYSTEM\SHELL32.DLL Subkey --- {24F14F02-7B1C-11d1-838f-0000F80461CF} C:\WINDOWS\SYSTEM\SHELL32.DLL Subkey --- {0D2E74C4-3C34-11d2-A27E-00C04FC30871} C:\WINDOWS\SYSTEM\SHELL32.DLL Subkey --- {7ab770c7-0e23-4d7a-8aa2-19bfad479829} C:\WINDOWS\SYSTEM\SHELL32.DLL Subkey --- {884EA37B-37C0-11d2-BE3F-00A0C9A83DA1} C:\WINDOWS\SYSTEM\DOCPROP2.DLL ============================== C:\WINDOWS\All Users\Start Menu\Programs\StartUp Channel 3 Weather Wizard.lnk ============================== C:\WINDOWS\Start Menu\Programs\StartUp Channel 3 Weather Wizard.lnk Webshots.lnk Microsoft Office.lnk ============================== C:\WINDOWS\SYSTEM cpl files INETCPL.CPL Microsoft Corporation INTL.CPL Microsoft Corporation MODEM.CPL Microsoft Corporation ODBCCP32.CPL Microsoft Corporation POWERCFG.CPL Microsoft Corporation APPWIZ.CPL Microsoft Corporation DESK.CPL Microsoft Corporation JOY.CPL Microsoft Corporation MMSYS.CPL Microsoft Corporation NETCPL.CPL Microsoft Corporation PASSWORD.CPL Microsoft Corporation SYSDM.CPL Microsoft Corporation TELEPHON.CPL Microsoft Corporation WUAUCPL.CPL Microsoft Corporation QTW32.CPL Apple Computer, Inc. ACCESS.CPL Microsoft Corporation THEMES.CPL Microsoft Corporation FINDFAST.CPL Microsoft Corporation CtDetect.cpl Creative Technology Ltd. AUDIOHQ.CPL Creative Technology Ltd. MAIN.CPL Microsoft Corporation TIMEDATE.CPL Microsoft Corporation QuickTime.cpl Apple Computer, Inc. plugincpl131_04.cpl Sun Microsystems jpicpl32.cpl Sun Microsystems, Inc.

tampabelle View Member Profile	Jul 23 2005, 11:41 AM Post #6
Member 5k Posts: 6,363 OS: Windows XP	Please download FindQoologic from here: Find_Qoologic2.zip Save it to the desktop and extract files from it. Run Find-Qoologic2.bat. This will generate a log file; please post the entire contents of the log file here for me to see.

spiritoh View Member Profile	Jul 23 2005, 01:33 PM Post #7
Member Posts: 14 From: OH OS: Windows XP	The file isn't found on this site. Please download FindQoologic from here: Find_Qoologic2.zip Save it to the desktop and extract files from it. Run Find-Qoologic2.bat. This will generate a log file; please post the entire contents of the log file here for me to see.

tampabelle View Member Profile	Jul 23 2005, 01:39 PM Post #8
Member 5k Posts: 6,363 OS: Windows XP	Please download the attachment

spiritoh View Member Profile	Jul 23 2005, 04:46 PM Post #9
Member Posts: 14 From: OH OS: Windows XP	Hopefully this is the correct file: "Find activesetup", version1, launched at: 18:45 Operating System: Windows Millennium HKLM\Software\Microsoft\Active Setup\Installed Components\ "PerUser_CVT_Inis\(Default)" = "Windows Setup - FAT32 Converter" \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf" [MS] "{44BBA842-CC51-11CF-AAFA-00AA00B6015C}\(Default)" = "NetMeeting 3.01" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.W95" [MS] "PerUser_DCC_Inis\(Default)" = "Windows Setup - Direct Cable Connection" \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_DCC_Inis_remove 64 C:\WINDOWS\INF\rna.inf" [MS]

tampabelle View Member Profile	Jul 23 2005, 06:36 PM Post #10
Member 5k Posts: 6,363 OS: Windows XP	Hi Spiritoh, The number of files thrown up by these logs are huge and I am trying to check on each and every file. I need some help from you. Download L2mfix from one of these two locations: http://www.atribune.org/downloads/l2mfix.exe http://www.downloads.subratam.org/l2mfix.exe Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread. IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

spiritoh View Member Profile	Jul 23 2005, 07:24 PM Post #11
Member Posts: 14 From: OH OS: Windows XP	when I run the l2mfix.bat I recieve the following error right away, and command window state "syntax error" contents not.txt Not compatible with 9x or windows nt

tampabelle View Member Profile	Jul 23 2005, 07:41 PM Post #12
Member 5k Posts: 6,363 OS: Windows XP	Hi Spiritoh, My bad !!!!! Guess I was looking for an easy solution !!! That tool only works on Windows 2000 and Windows XP. We will need to work out this the hard way Download Findit9xME and save it. Unzip the file and save the files in a new folder - VX2 on your desktop. Amongst the files extracted is a file - Findit9XME.bat. Double click on the file. It will generate a log file. Post this log file back here

spiritoh View Member Profile	Jul 24 2005, 09:44 AM Post #13
Member Posts: 14 From: OH OS: Windows XP	Thanks for helpinh on this...I tried to do it the eas