Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

please help ( Anti- Popup Blocker )


  • Please log in to reply

#1
Gregec

Gregec

    Member

  • Member
  • PipPip
  • 87 posts
please help me

On my computer is automatic installed this popup blocker. That's not normal popub blocker. Is a porn. I won't delete him. I delete him, but after the day is again installed. There is writing : Anti-popup blocker setup finished

then i click ok

i can delete him, but it's installed again..... please help me <_< :D :D
  • 0

Advertisements


#2
ditto

ditto

    - i pwn n00bs -

  • Member
  • PipPipPipPip
  • 1,260 posts
Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.
  • 0

#3
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
too late

i can deleted all of icons, and internet don't working. I can repair it. But the icons are don't deleted. Just some one.

I will write a list.
  • 0

#4
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
Posted Image

on this photo you can see what problems are hijackThis found
  • 0

#5
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts

Posted Image

on this photo you can see what problems are hijackThis found

View Post


i think

on this photo you can see what problems do HijackThis found

pls help me
  • 0

#6
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Please repost with a new hijack this log. When you scan with hijack this click the "save log" button. It will then create a notepad file of your log. save it. come back here open the file and copy and paste everything from the txt file and paste it here.

-=jonnyrotten=- <_<
  • 0

#7
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
Logfile of HijackThis v1.98.2
Scan saved at 12:56:57, on 27.10.2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\inetg\winlogon.exe
C:\QL HIJACK REMOVER\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchportal.info/10013/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.v73.us/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.v73.us
R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inetg\winlogon.exe
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll (file missing)
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {815A82AE-CDEF-11D8-BA48-A6D245798277} - (no file)
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{43691CA2-FB24-4451-B915-0502466EA560}: NameServer = 193.189.160.11,193.189.160.12
  • 0

#8
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
this porn anti-popup blocker is installed again. How does i can deleted him????

please help me!!!!!!!!!

i hate porn!
  • 0

#9
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchportal.info/10013/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.v73.us/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.v73.us
R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inetg\winlogon.exe
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll (file missing)
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll (file missing)
O3 - Toolbar: (no name) - {815A82AE-CDEF-11D8-BA48-A6D245798277} - (no file)
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE (file missing)

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):

C:\Program Files\ISTsvc
C:\WINDOWS\inetg

Reboot normally and post frest log and any further details related to the problem

-=jonnyrotten=- <_<
  • 0

#10
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
new log

Logfile of HijackThis v1.98.2
Scan saved at 20:05:42, on 28.10.2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\SpyCatcher\Scheduler daemon.exe
C:\Program Files\SpyCatcher\Protector.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

F3 - REG:win.ini: run=C:\WINDOWS\inetg\winlogon.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe"
O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe" nowait
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - Startup: Protector.lnk = C:\Program Files\SpyCatcher\Protector.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{43691CA2-FB24-4451-B915-0502466EA560}: NameServer = 193.189.160.11,193.189.160.12
  • 0

Advertisements


#11
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Please turn off system restore. Go to control panel, performance and maintenance, system. click the system restore tab at the top and put a check in the box next to "turn off system restore". If there is no tab then you need to log on with an administrator account. Reboot your computer into safe mode as you did earlier. Run Hijack This and remove the following entry:

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe

Navigate to C:\WINDOWS find the inetg folder and delete it.

Reboot normally and rescan with hijack this. If this entry and folder are gone then you can turn system restore back on.

-=jonnyrotten=- <_<
  • 0

#12
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
i'm sorry, but i don't understand you

wich icon i must click ????

Posted Image
  • 0

#13
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Double click "system" and then click the "System Restore" tab at the top and check the box that says "turn off system restore" click "ok". Reboot into safe mode and find c:\windows and scroll down until you see the inetg folder, right click it and delete it.
Reboot normally and run a hijack this scan and see if it is gone. If it is then you can enable system restore again.

-=jonnyrotten=- <_<
  • 0

#14
Gregec

Gregec

    Member

  • Topic Starter
  • Member
  • PipPip
  • 87 posts
it's again this list

F3 - REG:win.ini: run=C:\WINDOWS\inetg\winlogon.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe"
O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe" nowait
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetg\winlogon.exe
O4 - Startup: Protector.lnk = C:\Program Files\SpyCatcher\Protector.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{43691CA2-FB24-4451-B915-0502466EA560}: NameServer = 193.189.160.11,193.189.160.12
  • 0

#15
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Please use Internet Explorer and go to these links:

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

Reboot. Next go to this link:

http://security.nort...id=ie&venid=sym

Do the online Virus Scan. This scan does not fix any problems, but it will tell us what you have. After it is done scanning it will tell you on the bottom left side of the screen what viruses you have. Please copy and paste the results back here so we can remove this virus.

After you're all done, reboot again and post new hijack this log.

-=jonnyrotten=- <_<
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP