pop up problems

[MixtriX]

hey guys,

just recently, i've started getting this pop up:



and this one:




Just wondering is anyone knows a way to get rid of it.
i've tryed ad-aware and search & destroy, but no luck


thanks

[ruuman]

hum if the usual scanners don't work I suggest you have a look here and get a program called HiJack this

http://computercops.biz/

It bassically shows you all the stuff that autoloads on your PC, be carefull though as you can screw stuff up easily, if you read the intructions your be fine.

I suggest you install spywareblaster as well, that stops these problems at the source. Give me a shout if you need more help

Ruu

[MixtriX]

ive got hijack this.. no idea how to use it... help

[ruuman]

hehe, houston we have a problem

Could you run the hijack this and post the log and I'll have quick look.

[jasonchiu]

go to control panel and delete advance system optimizer, and all other random things that u never installed. they normally have no icon when u click on them

[Overheat]

and also, use firefox

[Dark_Templer_102]

I second that!

[MixtriX]

Originally Posted by jasonchiu

go to control panel and delete advance system optimizer, and all other random things that u never installed. they normally have no icon when u click on them

if u mean the add/remove programs, it aint there

Originally Posted by ruuman

hehe, houston we have a problem

Could you run the hijack this and post the log and I'll have quick look.

Logfile of HijackThis v1.99.0
Scan saved at 9:09:03 AM, on 19/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\WINDOWS\System32\ljwpyr.exe
C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Documents and Settings\USER\Application Data\ubss.exe
C:\WINDOWS\System32\wclf.exe
C:\Program Files\Nokia\PC Suite for Nokia N-Gage\connmngmntbox.exe
C:\Program Files\Nokia\PC Suite for Nokia N-Gage\ectaskscheduler.exe
C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntim e.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\USER\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://secure.izone.net.au/infinity/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Infinity Internet IE
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3CF0392A-9249-7CB0-D352-10557CAE2F14} - C:\WINDOWS\System32\ffscc.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [scvhost.exe] scvhost.exe
O4 - HKLM\..\Run: [ServiceLayer] C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [yrqlxvpa] C:\WINDOWS\System32\ljwpyr.exe
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [winupdt] RUNDLL32.EXE c:\windows\ftmupdate.dll,_mainRD
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [scvhost.exe] scvhost.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Oaes] C:\Documents and Settings\USER\Application Data\ubss.exe
O4 - HKCU\..\Run: [Lbpa] C:\WINDOWS\System32\wclf.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: PCSuiteForNokiaN-Gage Detect.lnk = ?
O4 - Global Startup: PCSuiteForNokiaN-Gage TS.lnk = ?
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://secure.izone.net.au/infinity/
O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/game...s/y/grt5_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt0_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0B8006DB-38CD-4DAB-9593-5379A446A00F} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com...ineSweeper.cab
O16 - DPF: {111940D9-35B7-4DF4-82C3-BBF7581464AF} (Solitaire Showdown Class) - http://messenger.zonenxt.msn-int.com...reShowdown.cab
O16 - DPF: {1EA1F119-9BCB-4B95-84BB-2B49D00CE9DE} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com...tatsClient.cab
O16 - DPF: {2674BBB6-E0A1-4CF4-A1DA-43CB20B2797E} (Solitaire Showdown Class) - http://messenger.zonenxt.msn-int.com...reShowdown.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com...ineSweeper.cab
O16 - DPF: {2BF8AE8A-46D8-4212-A6CC-210ED5BD4ABB} (s45@atlas.cz S45 XML Address book) - http://s45.aspweb.cz/dnload/s45xml.cab
O16 - DPF: {41546094-533A-4D77-8EA9-C5578DA9ACD6} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com...tatsClient.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab
O16 - DPF: {5EEB1D35-A210-4085-9908-DAF0FE3757F1} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com...tatsClient.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/0...ll/xscan53.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8D14E093-4894-4592-A2A6-A62B7D95D225} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com...ineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zonenxt.msn-int.com...tatsClient.cab
O16 - DPF: {91A8CEE5-B417-4AEB-B200-608486E48AD1} (Solitaire Showdown Class) - http://messenger.zonenxt.msn-int.com...reShowdown.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {BEC31341-BE4C-4358-B79B-B89A5FCF8885} (Minesweeper Flags Class) - http://messenger.zonenxt.msn-int.com...ineSweeper.cab
O16 - DPF: {E3CE3CB2-A027-469F-9073-B9440036174F} (Checkers Class) - http://messenger.zonenxt.msn-int.com...y/Checkers.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zonenxt.msn-int.com...reShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB2692BD-3A0C-40AD-A09D-2849A9E7C162}: NameServer = 203.0.178.191
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: StyleXPService - Unknown - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

Originally Posted by Overheat

and also, use firefox

i think i will


many thanks by the way guys, ur help is much appreciated

[bigfoot1942]

files that i would define as suspicious:

C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\ljwpyr.exe
C:\Documents and Settings\USER\Application Data\ubss.exe
C:\WINDOWS\System32\wclf.exe

and anything related.

[bahnstormer]

firefox is for newbs that don't know how to use the internet

[ESPNSTI]

Originally Posted by bahnstormer

firefox is for newbs that don't know how to use the internet

I think someone just called me a newb!
So what do you use then, mr. internet experience?

[Overheat]

Firefox is for pros, who actually know something about computers and the internet!

[Cruzz563]

Yeah, and you can get this nifty extension that tells you your current weather (ForecastFox)

[MixtriX]

Originally Posted by bigfoot1942

files that i would define as suspicious:

C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\ljwpyr.exe
C:\Documents and Settings\USER\Application Data\ubss.exe
C:\WINDOWS\System32\wclf.exe

and anything related.

i've just fixed these files, and so far no pop up

thanks bigfoot, and the rest, for all your help


edit: damn, i guess i spoke too soon