[hawthorn]

Hi

While looking up lyrics of a song through google here's what happened (which is typical of what happens fairly regularly)

Clicked on one of the search results.
Page opens. Then another link / page appears to open , but all I can see is its minimised button at the bottom of the screen, and just this much:

[ Micros....] I click on it and nothing happens. Right click, cannot restore, or close it.

Then the following appears:
Security Warning
"Do you want to install and run Precision Time/Date manager free 10-second GAIN ad-supported download..." etc etc

I say no, naturally, and this,another pop-up window, perhaps unrelated, opens

Match.com --Microsoft Internet Explorer (across the top)
Picture of a nice normal looking girl (just head and shoulders) Angel 01, apparently a dating link. The girl is always from Dublin, Ireland. Is this cos I'm in Ireland?

This returns 3 or 4 times in the next few minutes.

The above happpens fairly regularly, and this is on a new PC just 5 days old!
The 'do you want to install' thing is regular, but usually a bit different each time, and sometimes containing the word Gator.
Also one of the song lyric pages opens another page, an Ebay listing advertising the particular artist of the song words I'm looking for. The whole thing is unbelievable!!!

Gator seems to pop up all the time. How can they (whoever they are ) get away with it?

You're description of Gator gives the impression that it is a service. It doesnt appear that way to me!! It looks like something that wants to get money out of me, as sometime one of the offers is something charded at 1.90 a minute. It is all very confusing!

i have History Kill from my old pc ready to install. Should I? Or what would you suggest?

Many thanks

K Carroll

[Advertisements]

Your computer has a number of spyware programs that we need to remove. For more info on spyware see the Spyware Info link in my signature.

Let's start with a couple free programs. If you're on dial-up, just download and install Spybot Search & Destroy. If you're using broadband also download and install Ad-aware. Using two programs increases the likelihood of eliminating these spyware pests automatically.

Using Spybot: Start Spybot S&D using the "Spybot-S&D (easy mode)" link from your Start menu . Click the Search for updates button, if any are found then click the Download Updates button. After all updates are downloaded, click the Check for problems button. When the scan is complete, place a check next to anything marked in red, then click the Fix selected problems button.

Using Ad-aware: Open Ad-Aware and use the Check for updates now link. Download and accept the latest reference file. When finished click the Start button. When done scanning, the Abort button will change to Next. Click the Next button. Right-click in the Scanning Results window and click "Select all objects". Then click the "Next" button and confirm that you want to delete the selected entries.

When finished, Reboot your computer. Finally, reply to this post with a new HiJackThis log so we can look for any nasties that may have been missed.

CLICK HERE to download Spybot S&D
CLICK HERE to download Ad-aware

[Smokey]

Your computer has a number of spyware programs that we need to remove. For more info on spyware see the Spyware Info link in my signature.

Let's start with a couple free programs. If you're on dial-up, just download and install Spybot Search & Destroy. If you're using broadband also download and install Ad-aware. Using two programs increases the likelihood of eliminating these spyware pests automatically.

Using Spybot: Start Spybot S&D using the "Spybot-S&D (easy mode)" link from your Start menu . Click the Search for updates button, if any are found then click the Download Updates button. After all updates are downloaded, click the Check for problems button. When the scan is complete, place a check next to anything marked in red, then click the Fix selected problems button.

Using Ad-aware: Open Ad-Aware and use the Check for updates now link. Download and accept the latest reference file. When finished click the Start button. When done scanning, the Abort button will change to Next. Click the Next button. Right-click in the Scanning Results window and click "Select all objects". Then click the "Next" button and confirm that you want to delete the selected entries.

When finished, Reboot your computer. Finally, reply to this post with a new HiJackThis log so we can look for any nasties that may have been missed.

CLICK HERE to download Spybot S&D
CLICK HERE to download Ad-aware

[hawthorn]

Hi!

I did a scan with spybot, fixed and rebooted, and here is the Hijack This scan (btw spyhunter wont fix anything for me, it tells me to register??):

Logfile of HijackThis v1.97.7
Scan saved at 00:14:03, on 11/03/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\kevin carroll\Desktop\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.iol.ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell...gen/default.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell...gen/default.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell...gen/default.htm
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\SpyHunter\SpyHunter.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BB0D5EE-9E16-43C9-A5BC-365C7268C40C}: NameServer = 194.145.128.1 194.125.2.206



Thanks!

KC

[Smokey]

Your spyware seems to be gone, I don't see anything unusual

Try downloading Pop This. It is a little free program that is loaded into Internet Explorer to block pop-ups. You won't see any extra toolbars or system tray icons with this program. It is only a DLL that is loaded with Internet Explorer. To see/change the Pop This options in Internet Explorer, go to to "Tools", then "PopThis! Options...". It not only prevents pop-ups, but it prevents your Internet Explorer windows from being resized or moved as well.

[admin]

A couple extra notes:

1. We don't recommend SpyHunter, from all indications they just "borrowed" Spybot's code.

2. To avoid these "nasties" in the future, I strongly recommend installing SpywareBlaster and IE/Spyad.

Both are free programs. SpywareBlaster will prevent spyware from being installed and consumes no system resources.

IE/Spyad places over 4000 websites and domains in the IE Restricted list which will several impair attempts to infect your system.

More info and download is available at:
SpywareBlaster: http://www.javacools...areblaster.html
IE/Spyad: http://www.staff.uiu...es/resource.htm

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.