Internet explorer opening pop ups

Browntoa

aliEnRIK wrote: »

that NOLOP links not the right one Browntoa

old canned text...

combofix will remove any lingering bits

N9eav

Browntoa wrote: »

old canned text...

combofix will remove any lingering bits

Thanks, I will try that as there is still something trying to open the adverts

aliEnRIK

id run SAS first as you still have adware ~


Download SUPERANTISPYWARE (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_superantispyware/
UPDATE and PERFORM COMPLETE SCAN

N9eav

Still getting pop ups. I will try combofix, but all the links you gave me have failed.

aliEnRIK

So you mean you ARE going to try combofix? or you cant because your computer wont let you?

N9eav

Well I got rid of messenger plus and the ad program that came with it.

Ran Combofix, Malwarebytes and Superantispyware, uploaded XP service pack 3, running Zone alram and AVG and I am still getting web pages opening with adverts on them.

Any suggestions other than torch it?

Thanks for the help so far.

aliEnRIK

If you can post the combofix log I can maybe pinpoint exactly where the problem lies

N9eav

ComboFix 09-04-01.01 - Steve 2009-04-03 6:05:29.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.383.186 [GMT 1:00]
Running from: c:\documents and settings\Steve\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *enabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-03-03 to 2009-04-03 )))))))))))))))))))))))))))))))
.
2009-04-02 17:15 . 2009-04-02 17:15 <DIR> d

---

c:\documents and settings\Steve\Application Data\muvee Technologies
2009-04-02 16:49 . 2009-04-02 16:49 <DIR> d

---

c:\documents and settings\All Users\Application Data\TEMP
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\program files\SUPERAntiSpyware
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\program files\Common Files\Wise Installation Wizard
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\documents and settings\Steve\Application Data\SUPERAntiSpyware.com
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-03-25 06:42 . 2009-03-25 06:42 <DIR> d

---

c:\program files\Malwarebytes' Anti-Malware
2009-03-25 06:42 . 2009-03-25 06:42 <DIR> d

---

c:\documents and settings\Steve\Application Data\Malwarebytes
2009-03-25 06:42 . 2009-03-25 06:42 <DIR> d

---

c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-25 06:42 . 2009-02-11 10:19 38,496 --a

---

c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-25 06:42 . 2009-02-11 10:19 15,504 --a

---

c:\windows\system32\drivers\mbam.sys
2009-03-24 19:16 . 2009-03-24 19:16 <DIR> d

---

c:\program files\iTunes
2009-03-24 19:16 . 2009-03-24 19:16 <DIR> d

---

c:\program files\iPod
2009-03-24 19:16 . 2009-03-24 19:16 <DIR> d

---

c:\documents and settings\All Users\Application Data\!!00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-24 19:14 . 2009-03-24 19:14 <DIR> d

---

c:\program files\Bonjour
2009-03-24 19:13 . 2009-03-24 19:13 <DIR> d

---

c:\program files\QuickTime
2009-03-24 19:11 . 2009-03-05 23:59 1,900,544 --a

---

c:\windows\system32\usbaaplrc.dll
2009-03-23 18:59 . 2009-03-23 18:59 <DIR> d

---

c:\program files\Common Files\Windows Live
2009-03-21 20:09 . 2009-03-21 20:09 <DIR> d

---

c:\documents and settings\All Users\Application Data\Comp Jugs Ball That
2009-03-21 20:08 . 2009-03-21 20:09 <DIR> d

---

c:\program files\curb wait hold
2009-03-21 20:08 . 2009-03-21 20:08 <DIR> d

---

c:\documents and settings\Steve\Application Data\curb wait hold
2009-03-21 06:11 . 2009-03-21 06:11 <DIR> d--hs---- C:\FOUND.007
2009-03-10 14:43 . 2006-10-04 14:06 1,197,294

---

c:\windows\system32\dllcache\sysmain.sdb
2009-03-10 14:43 . 2006-10-04 14:06 764,868

---

c:\windows\system32\dllcache\apph_sp.sdb
2009-03-10 14:43 . 2006-10-04 14:06 217,118

---

c:\windows\system32\dllcache\apphelp.sdb
2009-03-10 14:42 . 2009-03-10 14:42 <DIR> d

---

c:\program files\Windows Media Connect 2
2009-03-10 14:38 . 2009-03-10 14:38 <DIR> d

---

c:\windows\system32\LogFiles
2009-03-10 14:38 . 2009-03-10 14:38 <DIR> d

---

c:\windows\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 20:53 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-02 20:53 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-30 09:13 2,588,672

---

w c:\windows\Internet Logs\xDBB.tmp
2009-03-30 09:13 1,389,056

---

w c:\windows\Internet Logs\xDBC.tmp
2009-03-05 22:59 36,864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-04 16:08 2,922,948

---

w c:\windows\Internet Logs\tvDebug.zip
2009-02-28 22:06 678,912

---

w c:\windows\Internet Logs\xDBA.tmp
2009-02-28 21:23 90,112 ----a-w c:\windows\DUMP762a.tmp

aliEnRIK

that logs missing quite a bit out

Open C drive and the FULL log should be in there (C:/COMBOFIX.TXT)

N9eav

Is this it?

ComboFix 09-04-01.01 - Steve 2009-04-03 6:05:29.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.383.186 [GMT 1:00]
Running from: c:\documents and settings\Steve\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *enabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-03-03 to 2009-04-03 )))))))))))))))))))))))))))))))
.
2009-04-02 17:15 . 2009-04-02 17:15 <DIR> d

---

c:\documents and settings\Steve\Application Data\muvee Technologies
2009-04-02 16:49 . 2009-04-02 16:49 <DIR> d

---

c:\documents and settings\All Users\Application Data\TEMP
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\program files\SUPERAntiSpyware
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\program files\Common Files\Wise Installation Wizard
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\documents and settings\Steve\Application Data\SUPERAntiSpyware.com
2009-03-27 06:30 . 2009-03-27 06:30 <DIR> d

---

c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-03-25 06:42 . 2009-03-25 06:42 <DIR> d

---

c:\program files\Malwarebytes' Anti-Malware
2009-03-25 06:42 . 2009-03-25 06:42 <DIR> d

---

c:\documents and settings\Steve\Application Data\Malwarebytes
2009-03-25 06:42 . 2009-03-25 06:42 <DIR> d

---

c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-25 06:42 . 2009-02-11 10:19 38,496 --a

---

c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-25 06:42 . 2009-02-11 10:19 15,504 --a

---

c:\windows\system32\drivers\mbam.sys
2009-03-24 19:16 . 2009-03-24 19:16 <DIR> d

---

c:\program files\iTunes
2009-03-24 19:16 . 2009-03-24 19:16 <DIR> d

---

c:\program files\iPod
2009-03-24 19:16 . 2009-03-24 19:16 <DIR> d

---

c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-24 19:14 . 2009-03-24 19:14 <DIR> d

---

c:\program files\Bonjour
2009-03-24 19:13 . 2009-03-24 19:13 <DIR> d

---

c:\program files\QuickTime
2009-03-24 19:11 . 2009-03-05 23:59 1,900,544 --a

---

c:\windows\system32\usbaaplrc.dll
2009-03-23 18:59 . 2009-03-23 18:59 <DIR> d

---

c:\program files\Common Files\Windows Live
2009-03-21 20:09 . 2009-03-21 20:09 <DIR> d

---

c:\documents and settings\All Users\Application Data\Comp Jugs Ball That
2009-03-21 20:08 . 2009-03-21 20:09 <DIR> d

---

c:\program files\curb wait hold
2009-03-21 20:08 . 2009-03-21 20:08 <DIR> d

---

c:\documents and settings\Steve\Application Data\curb wait hold
2009-03-21 06:11 . 2009-03-21 06:11 <DIR> d--hs---- C:\FOUND.007
2009-03-10 14:43 . 2006-10-04 14:06 1,197,294

---

c:\windows\system32\dllcache\sysmain.sdb
2009-03-10 14:43 . 2006-10-04 14:06 764,868

---

c:\windows\system32\dllcache\apph_sp.sdb
2009-03-10 14:43 . 2006-10-04 14:06 217,118

---

c:\windows\system32\dllcache\apphelp.sdb
2009-03-10 14:42 . 2009-03-10 14:42 <DIR> d

---

c:\program files\Windows Media Connect 2
2009-03-10 14:38 . 2009-03-10 14:38 <DIR> d

---

c:\windows\system32\LogFiles
2009-03-10 14:38 . 2009-03-10 14:38 <DIR> d

---

c:\windows\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 20:53 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-02 20:53 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-30 09:13 2,588,672

---

w c:\windows\Internet Logs\xDBB.tmp
2009-03-30 09:13 1,389,056

---

w c:\windows\Internet Logs\xDBC.tmp
2009-03-05 22:59 36,864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-04 16:08 2,922,948

---

w c:\windows\Internet Logs\tvDebug.zip
2009-02-28 22:06 678,912

---

w c:\windows\Internet Logs\xDBA.tmp
2009-02-28 21:23 90,112 ----a-w c:\windows\DUMP762a.tmp
2009-02-20 23:55 698,880

---

w c:\windows\Internet Logs\xDB9.tmp
2009-02-15 14:31 2,457,600

---

w c:\windows\Internet Logs\xDB7.tmp
2009-02-15 14:31 1,673,728

---

w c:\windows\Internet Logs\xDB8.tmp
2009-02-15 12:27 90,112 ----a-w c:\windows\DUMPee24.tmp
2009-02-09 10:19 1,846,272 ----a-w c:\windows\system32\win32k.sys
2009-02-09 10:19 1,846,272

---

w c:\windows\system32\dllcache\win32k.sys
2009-02-05 04:57

---

d

---

w c:\documents and settings\Steve\Application Data\Panasonic
2009-02-05 04:55

---

d

---

w c:\program files\Panasonic
2009-02-02 14:09 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-01-22 17:18 90,112 ----a-w c:\windows\DUMP5cd5.tmp
2009-01-22 17:18 1,633,792

---

w c:\windows\Internet Logs\xDB6.tmp
2009-01-22 17:18 1,497,600

---

w c:\windows\Internet Logs\xDB5.tmp
2009-01-22 15:35 90,112 ----a-w c:\windows\DUMP882b.tmp
2009-01-16 20:35 3,594,752

---

w c:\windows\system32\dllcache\mshtml.dll
.
((((((((((((((((((((((((((((( [EMAIL="SnapShot&#64;2009-04-01"]SnapShot@2009-04-01[/EMAIL]_ 7.00.10.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-03 04:10:32 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_18c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2002-12-27 49152]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-28 68856]
"EPSON Stylus SX200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE" [2007-12-13 188928]
"EPSON Stylus SX200 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE" [2007-12-13 188928]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"HeavyWeatherPublisher"="c:\heavyweather upload\HeavyWeatherPublisher.exe" [2004-02-23 1302528]
"Aim6"="c:\program files\AIM6\aim6.exe" [2007-05-09 50736]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2002-12-27 4263936]
"IW ControlCenter"="c:\program files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2003-03-12 836096]
"PinnacleDriverCheck"="c:\windows\System32\PSDrvCheck.exe" [2003-05-05 393728]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-02 1601304]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-22 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 50688]
"V0410Mon.exe"="c:\windows\V0410Mon.exe" [2007-06-07 32768]
"Ball that ford software"="c:\documents and settings\All Users\Application Data\Comp Jugs Ball That\Dumb Clock.exe" [2009-04-03 812032]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"nwiz"="nwiz.exe" [2002-12-27 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-02 15:09 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPASTATUS]

---

2003-02-26 14:18 620032 c:\program files\Internet Explorer\Connection Wizard\status.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-18 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-18 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]
R1 vobcom;vobcom;c:\windows\system32\drivers\vobcom.sys [2001-10-04 9728]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [2003-04-10 187392]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-22 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-22 298264]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [2002-12-13 64000]
R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\drivers\livecamv.sys [2009-01-27 31616]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S3 V0410Afx;Creative Camera VF0410 Audio Effects Driver;c:\windows\system32\drivers\V0410AFX.sys [2009-01-27 142656]
S3 V0410Aud;Creative Camera VF0410 Noise Cancellation APO;c:\windows\system32\drivers\V0410Aud.sys [2009-01-27 94720]
S3 V0410Dev;Creative Camera VF0410 Driver;c:\windows\system32\drivers\V0410Dev.sys [2009-01-27 244672]
S3 V0410Vfx;Creative Camera VF0410 Video VFX Driver;c:\windows\system32\drivers\V0410Vfx.sys [2009-01-27 7168]
.
Contents of the 'Scheduled Tasks' folder
2009-02-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-04-03 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-07-07 17:26]
2009-01-16 c:\windows\Tasks\DriverRobot.job
- c:\program files\Driver Robot\DriverRobot.exe []
2009-04-03 c:\windows\Tasks\AF6AD04F91854217.job
- c:\docume~1\steve\applic~1\curbwa~1\AimHeckFile.exe [2009-03-21 20:10]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.bbc.co.uk/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - [URL]file://c:\windows\Java\classes\dajava.cab[/URL]
DPF: Microsoft XML Parser for Java - [URL]file:///C:/WINDOWS/Java/classes/xmldso.cab[/URL]
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-03 06:07:49
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'winlogon.exe'(636)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-04-03 6:09:13
ComboFix-quarantined-files.txt 2009-04-03 05:09:12
ComboFix2.txt 2009-04-01 06:01:26
Pre-Run: 81,545,953,280 bytes free
Post-Run: 81,887,625,216 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
189 --- E O F --- 2009-03-30 09:13:17