Popups are driving me mad - Help! - Free Antivirus Forum

Popups are driving me mad - Help!

BullGuard Antivirus Forum > General Security > Spyware > Popups are driving me mad - Help!

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Diego
New Member

Date Joined Apr 2005
Total Posts : 4

Posted 4-8-2005 2:14 (GMT +1)

I have so many popups I spent half my computer time closing them Have tried several spyware programs with no success. I think this is ceres.dll. Anybody has instructions for the removal? Please help. Here is my log from hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 7:49:23 AM, on 04/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\Program Files\MDTVPN\Client\cvpnd.exe
C:\WINNT\Msa\MSAService.exe
C:\Program Files\Reflection\rtsserv.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\System32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\System32\CCM\CcmExec.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINNT\System32\nsvsvc\nsvsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\PROGRA~1\Dell\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Google\deskbar-0.5.95.0\ggviewer.exe
C:\Program Files\Diamond Computer Systems\TDS-3\tds-3.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\TEMP\HijackThis.exe
C:\Program Files\OfficeScan NT\tmlisten.exe
C:\Program Files\OfficeScan NT\ntrtscan.exe
C:\Program Files\OfficeScan NT\PCCNTMON.EXE

O2 - BHO: (no name) - {00000049-8F91-4D9C-9573-F016E7626484} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SetCNameUSR] REGEDIT /S c:\winnt\setcnameusr.reg
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINNT\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINNT\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINNT\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINNT\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINNT\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [180ax] c:\winnt\180ax.exe
O4 - HKLM\..\Run: [popuppers] C:\WINNT\newpop63.exe
O4 - HKLM\..\Run: [SpySpotter] C:\PROGRA~1\SPYSPO~1\SpySpotter.exe -onreboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Nsv] C:\WINNT\System32\nsvsvc\nsvsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Medtronic, Inc. VPN Client.lnk = C:\Program Files\MDTVPN\Client\ipsecdialer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: Acme - not available
O16 - DPF: Jacob - not available
O16 - DPF: NinjaRMI - not available
O16 - DPF: RMI - not available
O16 - DPF: Swing - not available
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/diamond.cab
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.40opt/SpySpotterCabInstall.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\MDTVPN\Client\cvpnd.exe
O23 - Service: MSAService - Unknown owner - C:\WINNT\Msa\MSAService.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\RapApp.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe

Rich-LB
New Member

Date Joined Apr 2005
Total Posts : 3

Posted 4-8-2005 6:01 (GMT +1)

Have you tried the microsoft spyware remover? just an idea.. i will look at your hijackthis log somemore (i am new to this so i dont think i will be able to help too much).

Diego
New Member

Date Joined Apr 2005
Total Posts : 4

Posted 4-8-2005 6:15 (GMT +1)

Didn't even know it existed. I downloaded and am running right now. I will keep you posted of the result.

Hritik
New Member

Date Joined Apr 2005
Total Posts : 11

Posted 4-8-2005 6:53 (GMT +1)

Hi,

I'll help you but first I would be requiring the few following informations :-

1) You operating systems (95,98,ME,2K,XP,ect.)

2) The antivirus used by you and the updation date.

3) Spyware cleaner programs installed on your systems.

4) What are the main usage of your computer.(like net surfing,email,accounting,disigning,Ect)

Waiting for your responce,

Hritik

Diego
New Member

Date Joined Apr 2005
Total Posts : 4

Posted 4-9-2005 12:11 (GMT +1)

Thanks for the offer, but amazingly enough, the Microsoft any spyware program did it. It seems I am clean again. Thanks again.

Andrei M
Senior Member

Date Joined Jan 2005
Total Posts : 570

Posted 4-9-2005 12:42 (GMT +1)

>>To Hritik

Hello Hritik,

Hritik said...

I'll help you but first I would be requiring the few following informations :-
1) You operating systems (95,98,ME,2K,XP,ect.)
2) The antivirus used by you and the updation date.
3) Spyware cleaner programs installed on your systems.

Just a tip for you:

1) You can view in the HIJACKTHIS log the Operating System used by Diego:

Logfile of HijackThis v1.99.1
Scan saved at 7:49:23 AM, on 04/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

2), 3) Other programs can also be read in the log.

These being said, keep up the good work.

Best regards,

Andrei Marius Cristof
BullGuard Support Team | support@bullguard.com
>BullGuard Website<

Suspect any spyware/adware? Download >hijackthis< and post the log file it creates.
Also don't forget to test >the free 60days Bullguard trial<.

Dan_from_Ontario
New Member

Date Joined Apr 2005
Total Posts : 18

Posted 4-15-2005 5:20 (GMT +1)

Nothing is better than SPYWAREBLASTER (spelled in 1 word) for protecing your INTERNET EXPLORER.
Spybot recognizes it as being better at its immunizer. It will not only make sure you wont get pop up from bad site...it will block those sites from even surfing at. and if there will be pop ups will be not harmful due their blank animation....meaning it will be blocked.

dont download pop up blockers ...dont waste your time. you want to be protected from the inside. a pop up blocker will block pop ups but not the activex objects. if its a java object you are screwed u will get pop ups that will work in the background and will install spywares on your pc.

im not bulling you.

but now...because I told you what to do, dont missunderstand something. SPYWAREBLASTER will block any bad site that contains spywares or any activex that is created in your Temp folder while surfing the net.
But....that is the future not the present. You are already infected. You need first to remove and then to be protected from not being infected again. SPYWAREBLASTER will only protect not remove.
To remove you must use 1. CWSHREDDER (free) 2. SWYSWEEPER (free trial) 3. SPY CATCHER (free trial)

Why use more than 1 ? Simply. Every 1 detects something that another might not. We are living in 2005 where competition is high and the need to sell is high in demand. Company will sell more than quality assuring. Thats the fact.

hope that helped

ps: to download those go to www.download.com and do a search for them and get em. Download.com is a site where users like you and me can vote and post reviews of any software out there. Meaning...you can talk but you cant BULL the people.

d@n

Diego
New Member

Date Joined Apr 2005
Total Posts : 4

Posted 4-15-2005 7:10 (GMT +1)

It does help. Thanks for the tip. I am familiar with download.com and has served me well in the past. I will take good note of the programs you mention.

Forum Information

Currently it is Saturday, November 21, 2009 12:56 AM (GMT +1)
There are a total of 73.021 posts in 17.116 threads.
In the last 3 days there were 15 new threads and 72 reply posts. View Active Threads