Pop-ups

[ashi76]

Hebben jullie ook ineens last van pop-ups.

Ik wordt er helemaal debiel van.

Het zijn van die anti-spyware pop-ups oid.

Enig idee hoe ik deze shit weg krijg ?

Ik heb uiteraard al een google toolbar incl pop-up stopper, maar daar komt ie vrolijk doorheen.

[Dennuz]

download adaware en laat die draaien
En download hijack this en post the log file hier ff dan zal ik er wel naar kijken..

[ashi76]

Hieronder een screenie:

http://img17.exs.cx/img17/448/popup3.jpg

[Dennuz]

ja, is gewoon spyware..

ff hijack this downloaden en de log file hier posten, dan zal ik ff kijken wat je weg moet halen

[ashi76]

Hier de logfile van Hijack this:

Logfile of HijackThis v1.98.2
Scan saved at 14:08:02, on 18-9-2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\vrjawi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Michael\LOCALS~1\Temp\Rar$EX00.744\Hij ackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startkabel.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\RunOnce: [Ad-aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-aware.exe" "+b1"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=77443ac5da96f89e5d08ba4608f7c4c53bb5cc26920dae43 dbde433474f5523575911e061c10952786793d88cfdd992ec7 3e7e9dad171af0cc174c:5e6ae3f8fe977347df35a291e5ba0 160
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab
O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://64.7.220.98/downloads/e2g27.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{94126201-3FA5-4506-9CA7-D9BC7C205D89}: NameServer = 195.121.1.34 195.121.1.66

[Dennuz]

Ziet er wel goed uit, weet alleen niet zeker of dit er hoort, kan er niks over vinden:

C:\WINDOWS\System32\vrjawi.exe

O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://64.7.220.98/downloads/e2g27.exe


Download adaware eens en laat die scannen..

[ashi76]

Gedaan.

Maar het blijft.

[Dennuz]

heb je ook met adaware alles verwijderd wat hij gevonden heeft? en heb je adaware wel geupdate?

Zo ja, probeer spybot eens..

[ashi76]

Gedaan.

Spybot maar even downloaden dan......

[Justinian]

Dennuz = one of Planet internet's finest :lol:

[Dennuz]

haha, krijg dagelijks mensen met dit soort problemen aan de lijn, en altijd geven ze iemand anders de schuld dat er ineens allerlei porno op staat..

[Justinian]

haha, krijg dagelijks mensen met dit soort problemen aan de lijn, en altijd geven ze iemand anders de schuld dat er ineens allerlei porno op staat..

LMAO! Dennuz = correct. Ik heb ook vaak van die figuren aan de lijn gehad :lol:

[Dennuz]

Klant: Ik krijg ineens allemaal ranzige dingen op mijn scherm die ik niet wil.
Helpdesk: Dat gebeurt als u op bepaalde sites komt..
Klant: Dat zullen de kinderen wel gedaan hebben..
Helpdesk: Zuch.... tuurlijk meneer..

[ashi76]

Het is niet eens porno.

Het zijn gewoon irritante pop-ups.

Hierop staat vervolgens reclame voor een of ander pop-up killer programma wat je dan vervolgens bij hun mag kopen. :twak:

[Dennuz]

Probeer deze adaware eens, dit is de pro versie..

http://download.9down.com/retail/Ad-Aware.SE.Professional.v1.04.Build.2.Retail.rar

[ashi76]

tnx.

Spybot draait nu trouwens.....

[ashi76]

gvd nog steeds last van die irritante pop-ups. :evil:

[Dennuz]

hmm vaag..

Druk eens op ctrl-alt-delete en maak ff een screenshot bij alle draaiende processen..

[Biiyen]

Als je xp hebt dan download service pack2 van de Microsoft update , hij is 256 MB en haalt een hoop ellende weg.

[Daniel]

en anders moet je even spy sweeper proberen

[harry]

Als je xp hebt dan download service pack2 van de Microsoft update , hij is 256 MB en haalt een hoop ellende weg.

Beetje link als je niet een originele versie hebt, zoals mijn broer dus...
Da's trouwens ook die gast die iedere keer op die porno site's zit...


(ps ik heb geen broer)

[H POWER]

Heb Zonealarm (www.zonealarm.com) tijd gebruikt,ben je er van af.
Werkt trouwens niet goed samen met norton.

[Dennuz]

Hier kun je spysweeper downloaden:

http://sales.webroot.com/downloads/registered/links/sspsetup1_80164.exe

En je kunt hem registreren met 1 van de volgende serials:

SSDA-ONLN-AAAA-CHYZ-LEOU
SSDA-ONLN-AAAA-MZWY-HQKR
SSJQ-ONLN-VCFU-DKYH-YVEZ
SSDA-ONLN-AAAA-CKQV-QINC


Dit stond er trouwens nog als extra info bij:

Description:
Spy Sweeper is award-winning software that effectively and safely detects and removes spyware from your PC to protect you from identity theft, browser hijackers, hackers, keyloggers and Trojans. Powerful Detection, Quarantine and Deletion. Spy Sweeper protects you with a sophisticated and regularly updated database of spyware definitions, the power to disable spyware, and the knowledge you need to analyze risks to your privacy. You can manage spyware without harming other programs on your computer using the quarantine feature. This unique disable-and-store capability places spyware in a safe place on your system until you decide whether or not to remove them permanently. Simple and Easy-to-use. A single click kicks off an in-depth sweep for covert spyware on your system, providing powerful spyware protection to novice and power users alike. Premier Customer Support. Spyware is incredibly invasive and can easily disrupt essential system functionality. Spy Sweeper is backed by expert technicians who will support you through any spyware problems you encounter. Spyware Management Tools. Spy Sweeper eliminates the need to research a spy more than once. Any time a piece of spyware is found on your system, you can add it to the 'Always Keep' or 'Always Remove' list. Spy Sweeper Knowledge Base. Right-click on a specific spy in the Quarantined, Always Keep, or Always Remove screens for instant access to the Spy Sweeper knowledge base. This database provides information about what Spy Sweeper

What's New in Spy Sweeper v3.2?

- Proactive protection shields stop spyware and adware before it finds its way onto your PC.
- Deeper scans root out and quarantine even the trickiest programs.
- Refined spyware scan options and improved user interface.


INSTALL INSTRUCTIONS:

1. Uninstall Your Current SpySweeper:

if you ever made the install.dat file "READ-ONLY" Before, You MUST Uncheck that and the Hidden settings BEFORE UNINSTALLING. So, just Open Windows Explorer, Go to Program Files > Webroot > SpySweeper, right-click on Install.dat and UNCHECK "read-only" and "hidden" then press APPLY AND OK. Then Uninstall By Going to the unins000.exe And CLicking on It Twice. Press OK To Uninstall it And YES or whatever. Reboot ur pc.

2. Install from link above:

when u double click on the link, it will FIRST ASK YOU FOR A SERIAL.
Just Highlight the ENTIRE SERIAL, Copy, Put cursor in First Box and Paste, and the entire serial will be filled in. Then Press OK.

When All of those Options come up, I Only Check Off The LAST ONE Which Is The Windows Messenger Service. That is the ONLY One I check off because SpySweeper has Had Bugs with the Context Menu Option - and plus there's not much need for it.

Then Press Ok, BUT UNCHECK "Run Spysweeper"! DO NOT RUN IT! THIS IS VERY IMPORTANT. Make Sure SpySweeper is not running, go back to the SpySweeper Folder and right-click on INSTALL.dat and hit Open With and Find NOTEPAD and press OK, so now notepad is opened with a few numbers. Just put a ZERO To This Line:

dl=365

which now will look like:

dl=3650

then SAVE IT and Exit Notepad. Then right-click on install.dat and check the "Read-Only" setting.

Thats it, open the program and YES Now you can update.

[Hollandpride]

Thanks Dennis