[melmartin]

--------------------------------------------------------------------------------

Hi, I'm new to this board...and I'm not very good with computers

I've never had a virus or anything....then all of a sudden I'm getting like ten popup ads every minute!

I tried Microsoft Antispyware and Adaware they didn't help
If anything.... I think they made it worse!

I can hardly type... I have no idea what to do ...I'm not super-internet savvy
but, I'm willing to follow directions and learn and
I would SOO appreciate any help ANYONE can offer!

I don't know what Hijack This is but....any help is welcome...

I'm completely at your mercy for help

thank you in advance for any replies~
I'll be forever grateful!

[pudlea]

Hi Mel Martin,

Go to the Malware Section of this forum Here and read this post - Pinned: You Must Read This Before Posting A Hijackthis Log
Required steps before posting your log. This should help you out

Pudlea

[melmartin]

Thank you for the reply about the steps to go through....I did everything and followed the directions the best I could
Remarkably, it went well and I can see already a decline in the number of popups! Yay~!

However, I did encounter some problems...

#1) After clicking on the CleanUp the CleanUp website itself would not allow me to view the screen where after clicking to download the program...?

#2) While loading Ewido, I am able to scan about 70% of the files...then a screen shows up that says...Microsoft Error report...click Send Report or click Don't Send....whenever I click Don't Send.....the Ewido scan stops but random Ewido winoows still pop up saying that Ewido found something...? not sure what to do because I already tried reloading Ewido several times! sorry to bother you!

#3) Under “step two: trojans/viruses” it warns not to load more than one anitvirus program.....so if I have loaded Ewido....should I refrain from using AVG or TDS3....?

Everything else pretty much worked I think!

THANK YOU sooooooo much for your help!
I never thought these ads would stop...but with your help...it seems to be working~!

Once these probs are fixed I will post my HJT log

[melmartin]

Any help is appreciated...I'm so grateful for this website!

What follows is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 5:02:46 PM, on 6/15/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\winnn10n.exe
C:\WINDOWS\System32\vssymvea.exe
C:\Program Files\Cas\Client\casclient.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\America Online 7.0\aoltray.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoRT.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoTask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Cas - {B5F3970B-745E-46AC-B890-E08F69777D80} - C:\WINDOWS\System32\ca.dll
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [x32i3qR] winnn10n.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [g0tsRkd6Q] vssymvea.exe
O4 - HKCU\..\Run: [sf] C:\Program Files\sf\sf.exe
O4 - HKCU\..\Run: [sfita] C:\WINDOWS\sfita.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: http://www.neededware.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://softdev.adelp...ad/tgctlins.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1118875347952
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: eTrust EZ Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoRT.exe
O23 - Service: eTrust EZ Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\InoTask.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Winkir - Unknown owner - C:\WINDOWS\System32\Winkir.exe (file missing)

[pudlea]

Hi Melmartin,

I personally use AVG, I have found it to be the best. Post your HJT Log onto the other forum and have the experts look at it, mention there also about the problems you are having and they may be able help out with this too. To do this just post you HJT log into a new post with the other problems and some-one will look at this for you. It may take a few days though so be patient.

Pudlea

[**********]

I suggest not using Internet Explorer, use Mozilla Firefox. This has resolved/prevented many of my security issues especially adware/malware and pop-ups.
I recommend AVG Free edition which I have been using for a couple of years now.
I also recommend using a firewall. I use a free version of Zone Alarm.