Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Infuriating Spontaneous IE Popups [resolved]

Started by kk7tz , Mar 05 2005 06:00 PM

  • This topic is locked This topic is locked

#16
Michelle
Posted 22 March 2005 - 12:06 AM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Again, I need you to move HiJackThis.exe into a permanent folder. It is currently in a temporary file and that's definitely not where you want it should you need a backup! It needs to be like this C:\HJT\HiJackThis.exe PLEASE do this before continuing. Here are the instructions:
1.) Locate your HJT folder in C:\Temp
2.) Click the HJT folder and drag it to C:

If you have any problems doing it this way, please refer to my previous post on making a permanent folder for HiJackThis.

Next, download CWShredder and save it to your desktop. After downloading it, extract it and run it. Click on the ‘Fix’ button. Follow the prompts, and press OK. Make sure you let it fix all CWS Remnants.

Make sure you are disconnected from the Internet and all programs and Windows are closed. Run HiJackThis. Please place a checkmark next to the entries listed below (make sure these are the only things checked!), if they are found. These are MANDATORY. After these entries have a checkmark next to them, click "FIX CHECKED".

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)

O15 - Trusted Zone: *.searchmeup.cc (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 195.190.118.157 (HKLM)

Close HiJackThis.

Be sure you're able to VIEW HIDDEN FILES

Reboot your computer into Safe Mode. You can do this by restarting your computer and continuously tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.

Use Windows Explorer and delete the following folder, in bold (if found).

FOLDERS to delete:
C:\WINDOWS\isrvs

Reboot your computer in normal mode and post a new HiJackThis log.

Michelle :tazz:
  • 0

Advertisements

#17
kk7tz
Posted 22 March 2005 - 08:37 PM

kk7tz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Michelle,

this is the logfile from HijackThis residing in the c:\HJT directory.

-Chris

Logfile of HijackThis v1.99.1
Scan saved at 6:35:43 PM, on 3/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\Temp\HJT\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
  • 0

#18
shadowwar
Posted 25 March 2005 - 12:12 PM

shadowwar

    Malware Expert

  • Retired Staff
  • 26 posts
l2mfix also has a menu option to repair the autoexec.nt errors.

Cheers
  • 0

#19
Michelle
Posted 25 March 2005 - 06:05 PM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Make sure you are disconnected from the Internet and all programs and Windows are closed. Run HiJackThis. Please place a checkmark next to the entry listed below then, click "FIX CHECKED".

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)

Close HiJackThis.

Reboot your computer into Safe Mode. You can do this by restarting your computer and continuously tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.

Important!
Be sure you're able to VIEW HIDDEN FILES

Use Windows Explorer and delete the following folder, in bold.

FOLDER to delete:
C:\WINDOWS\isrvs

Reboot your computer in normal mode and post a new HiJackThis log.

Michelle :tazz:
  • 0

#20
kk7tz
Posted 26 March 2005 - 01:17 AM

kk7tz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Michelle,

I followed your directions. As you will see the item you asked me to remove with HijackThis is still there after i rebooted.

There was no directory C:\WINDOWS\isrvs. That was deleted the last time.

Here's the HijackThis logfile (once again from directory c:\HJT)

-Chris

Logfile of HijackThis v1.99.1
Scan saved at 11:11:58 PM, on 3/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
  • 0

#21
Michelle
Posted 26 March 2005 - 02:15 AM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
I just had to double check to make sure before moving onto the next step. No worries! I will be right back :tazz:

Michelle
  • 0

#22
Michelle
Posted 26 March 2005 - 02:54 AM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Click Here to download Killbox.

*Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
*In the killbox program, select the Delete on Reboot option.
*In the field labeled Full Path of File to Delete enter the item listed below (EXACTLY as it appears, please double check to make sure!):

C:\WINDOWS\isrvs\sysupd.dll

Press the button that looks like a red circle with a white X in it after each one. You will be prompted 2 times. Click "yes" to delete on reboot, click "yes" to reboot now.

Once you have rebooted run HiJackThis and put check next to the below item and click "FIX CHECKED".

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)

Then, Please run this online virus scan:
ActiveScan

Copy the results of ActiveScan and paste them into this thread along with a new HiJackThis log.

Michelle :tazz:
  • 0

#23
kk7tz
Posted 26 March 2005 - 03:20 PM

kk7tz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Michelle,

the results of using KillBox is a popup message "PendingFileRenameOperations Registry Datahas been Removed by External Process!" and the system did not reboot automatically.

I rebooted manualy any way.

I ran HijackThis and performed the FIX CHECKED operation, but it is still there on subsequent scans.

I tried to run PandaScan. I get to the point of "Click on the item to scan" and when i click nothing happens. I even went so far as to go into IE security and make it as permissable as possible. Still no go.

So at this point the HijackThis logfile hasn't changed.

-Chris
  • 0

#24
Michelle
Posted 26 March 2005 - 05:00 PM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Ok let's try this:

Disable AVG and Disable McAfee's Internet Security, then try fixing that item with HiJackThis. Make sure they are both disabled otherwise it won't work. Let me know if it allows you to. Make sure to re-enable them after doing this!

Michelle :tazz:

Edited by bananafanafo, 26 March 2005 - 05:01 PM.

  • 0

#25
kk7tz
Posted 26 March 2005 - 07:40 PM

kk7tz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Michelle,

That didn't work. Sorry.

-Chris
  • 0

Advertisements

#26
Michelle
Posted 26 March 2005 - 08:49 PM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
I will be right back!

Michelle :tazz:

Edited by bananafanafo, 26 March 2005 - 09:22 PM.

  • 0

#27
Michelle
Posted 27 March 2005 - 11:01 AM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Start Notepad.
Copy everything in the code box below and paste into Notepad.
Go to File > Save As..
Change the "Save as type" to "All Files" (there is a pulldown box that says "Text Documents - this is what you change to "All Files")
Save this file on your desktop as fix.reg 

REGEDIT4 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993}] 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993}]


Double-click on the fix.reg file, and when it prompts to merge say Yes.

Then post a new hijackthis log.

**NOTE** Make sure it is copied exactly as in the code box above and that there is no blank line above REGEDIT4

Michelle :tazz:
  • 0

#28
kk7tz
Posted 27 March 2005 - 02:48 PM

kk7tz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Michelle,

Here is the HijackThis logfile ran from c:/HJT directory.

-Chris

Logfile of HijackThis v1.99.1
Scan saved at 12:46:58 PM, on 3/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wisptis.exe
C:\WINDOWS\System32\dllhost.exe
\?\C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
  • 0

#29
Michelle
Posted 27 March 2005 - 05:13 PM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Have you tried "fixing" that entry with HiJackThis now that the code was merged with the registry?

If this doesn't work, I'm going to ask you to download a program to try to get rid of it.

Ugh! This thing is a pain!

Michelle :tazz:
  • 0

#30
kk7tz
Posted 27 March 2005 - 05:26 PM

kk7tz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
I did run the fix.reg like you asked. Its still in the logfile.

Sorry i wasn't more specific on the last post.

What's this program i need to download?

-Chris
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP