[sue318]

Hi,

I have done all the things listed in You Must Read This Before Posting a HijackThis Log. In addition, I have installed AMUST 1-Defender and use avast! on-access antivirus protection; and I installed and ran Spybot, SpywareBlaster, and Rogue Remover (the last didn't detect any items).

The popups were originally ads and download suggestions, especially when I ran malware detection programs; now they read Internet Explorer cannot display the webpage, so something's working but not eliminating the popup window itself.

My HJT log is as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:36, on 2008-02-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Amust\1-Defender\1-Defender.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {29C8C3F2-3D48-4D0F-8729-8F342BAFAAEA} - C:\Program Files\WindowsUpdate\hokeqoC:\WINDOWS\system32\gis6\lenamd83122.exe.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {CE9956C2-4D68-4292-A03A-7FE36FFEDCD8} - C:\Program Files\WindowsUpdate\hokeqoC:\WINDOWS\system32\wnis6\enamd83122.exe.dll (file missing)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6332 bytes

The HJT uninstall list is:
Adobe Flash Player ActiveX
Advanced WindowsCare 2.57 Personal
AMUST 1-Defender
Apple Mobile Device Support
Apple Software Update
avast! Antivirus
BCM V.92 56K Modem
Bonjour
CleanUp!
Dell ResourceCD
Easy CD Creator 5 Basic
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Updater
HijackThis 2.0.2
Hotfix for Windows XP (KB915865)
hp instant support
HP Photo and Imaging 1.0 - PSC 2000 Series
HP Photo and Imaging 1.0 - PSC 2000 Series
HP Photo and Imaging 1.0 - PSC 2000 Series Drivers
hp psc 2100 series
Intel® PRO Ethernet Adapter and Software
iTunes
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
NVIDIA Display Driver
NVIDIA Windows 2000/XP Display Drivers
Panda ActiveScan
Personal Ancestral File 5
QuickTime
Readiris 7.5
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Sound Blaster Live!
SpywareBlaster v3.5.1
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WordPerfect Office 2002
WordPerfect Office 2002

The Activescan log is:

Incident Status Location

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Sue\Cookies\sue@doubleclick[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Sue\Cookies\sue@zedo[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\Process.exe
Spyware:Spyware/Virtumonde Not disinfected C:\QooBox\Quarantine\catchme2008-01-30_224613.18.zip[pmnlkll.dll]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\Nircmd.exe
Spyware:Cookie/Ccbill Not disinfected F:\Documents and Settings\Robert\Cookies\robert@ccbill[1].txt
Spyware:Cookie/64.62.232 Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][6].txt
Spyware:Cookie/360i Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][1].txt
Spyware:Cookie/Kazaa Networks Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][1].txt
Spyware:Cookie/did-it Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@did-it[1].txt
Spyware:Cookie/elmer Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@elmer[1].txt
Spyware:Cookie/empnads Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@empnads[2].txt
Spyware:Cookie/ErrorSafe Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@errorsafe[2].txt
Spyware:Cookie/Go Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@go[1].txt
Spyware:Cookie/Lop Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@mp3search[2].txt
Spyware:Cookie/Pollstar Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@pollstar[1].txt
Spyware:Cookie/Mircx Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][2].txt
Spyware:Cookie/Santa Monica networks inc Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@smni[1].txt
Spyware:Cookie/Target Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@target[2].txt
Spyware:Cookie/nCase Not disinfected F:\Documents and Settings\Sarah\Cookies\sarah@wizzle[1].txt
Spyware:Cookie/Affiliate fuel Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][2].txt
Spyware:Cookie/ErrorSafe Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][1].txt
Spyware:Cookie/myaffiliateprogram Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][1].txt
Spyware:Cookie/web-stat Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][1].txt
Spyware:Cookie/MyWay Not disinfected F:\Documents and Settings\Sarah\Cookies\[email protected][2].txt
Adware:Adware/IPInsight Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\alchem.cab
Adware:Adware/IPInsight Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\alchem.inf
Adware:Adware/IPInsight Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\alchem.ini
Potentially unwanted tool:Application/Altnet Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\asmfiles.cab
Spyware:Cookie/64.62.232 Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\Cookies\[email protected][2].txt
Adware:Adware/Qdown Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\Temporary Internet Files\Content.IE5\GHIF4XAJ\QDow_AS2[1].cab[QDow_AS2.dll]
Adware:Adware/Twain-Tech Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\THI1E85.tmp\twaintec.cab
Adware:Adware/Twain-Tech Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\THI45CF.tmp\twaintec.cab[twaintec.dll]
Adware:Adware/Twain-Tech Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\THI45CF.tmp\twaintec.cab[preInsTT.exe]
Spyware:Spyware/Virtumonde Not disinfected F:\Documents and Settings\Sarah\Local Settings\Temp\wincore.dll
Potentially unwanted tool:Application/Processor Not disinfected F:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\l2mfix\Process.exe
Virus:Trj/Rebooter.J Disinfected F:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\l2mfix\Reboot.exe
Virus:Trj/Rebooter.J Disinfected F:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\l2mfix.exe
Potentially unwanted tool:Application/Processor Not disinfected F:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\Process.exe
Virus:Trj/Rebooter.J Disinfected F:\Documents and Settings\Sue\My Documents\Computer-related\l2mfix\Reboot.exe
Possible Virus. Not disinfected F:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\Setup.exe
Adware:Adware/InternetSpeedMonitor Not disinfected F:\QooBox\Quarantine\C\Program Files\ISM\Uninstall.exe.vir
Possible Virus. Not disinfected F:\QooBox\Quarantine\C\Program Files\QdrDrive\qdrloader.exe.vir
Adware:Adware/InternetSpeedMonitor Not disinfected F:\QooBox\Quarantine\C\Program Files\QdrModule\QdrModule11.exe.vir
Adware:Adware/Adband Not disinfected F:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\000080.exe.vir
Potentially unwanted tool:Application/NirCmd.A Not disinfected F:\WINDOWS\NirCmd.exe
Potentially unwanted tool:Application/Processor Not disinfected F:\WINDOWS\SYSTEM32\Process.exe
Virus:Trj/Rebooter.J Disinfected F:\WINDOWS\SYSTEM32\Reboot.exe
Can't think of anything more to tell you.
Thanks in advance!

[Advertisements]

Hello

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[Rorschach112]

Hello

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[Rorschach112]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.