winfixer, winantispyware

bremsech,

Try remove winfixer and winatnispyware with Control Panel > Add/Remove Programs.  Delete all temporary internet files.  I will look at your HijackThis log next.

bremsech,

Here is a link to the analyzed log

http://hijackthis.de/logfiles/3b82cfd0c02106799c5147f20b09e0b7.html

You have an older version of HijackThis.  Download the latest version and run HJT to get the log.  Use http://hijackthis.de to analyze the log.  Save the analysis and post link here.

Have HJT remove all items marked "Nasty" and "Unnecessarily".

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

Look at the items marked "Possibly Nasty" and "Unknown".  If you do not recognized them, have HJT delete them.

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll            

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$N7AD2~1\runwin.dll

O9 - Extra button: Start EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\PROGRA~1\EASYWE~1\easywebcam.exe            

O9 - Extra 'Tools' menuitem: &EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\PROGRA~1\EASYWE~1\easywebcam.exe

I downloaded the eidow and ran the scan:

---------------------------------------------------------
 ewido security suite - Scan report
---------------------------------------------------------

 + Created on:                  6:08:28 PM, 9/17/2005
 + Report-Checksum:            EBB92C55

 + Scan result:

      C:\Documents and Settings\David\Cookies\david@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
      C:\Documents and Settings\David\Cookies\david@edge.ru4[2].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
      C:\Documents and Settings\David\Cookies\david@tribalfusion[2].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
      C:\Documents and Settings\David\Cookies\david@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
      C:\Documents and Settings\David\My Documents\Weekly Computer Maintenance\backups\backup-20050917-132158-985.dll -> Spyware.Virtumonde : Cleaned with backup
      C:\Documents and Settings\David\My Documents\Weekly Computer Maintenance\backups\backup-20050917-132218-527.dll -> Spyware.Virtumonde : Cleaned with backup
      C:\Documents and Settings\David\My Documents\Weekly Computer Maintenance\backups\backup-20050917-132311-731.dll -> Spyware.Virtumonde : Cleaned with backup
      C:\Documents and Settings\David\My Documents\Weekly Computer Maintenance\backups\backup-20050917-152712-695.dll -> Spyware.Virtumonde : Cleaned with backup
      C:\WINDOWS\$NtUninstallKB896358$\runwin.dll -> Spyware.Virtumonde : Cleaned with backup
      C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup
      C:\WINDOWS\SYSTEM32\vturr.dll -> TrojanDownloader.ConHook.k : Cleaned with backup


::Report End

I also deleted most of the item you suggested after I updated hijackthis.  I had already deleted all my IE temp files and cookies, but I did it again anyway.  Here is the new hijackthis file after all of the above was done.

<< Hijack This log removed by humeniuk PE >>

Thanks for your help, let me know if you think I need to do anything else.  Otherwise I'll let you know later if the popups have gone away.

Thanks

http://hijackthis.de/logfiles/e5908c02bd1bc63a73e1fdd9e1fdc1f9.html

It is getting cleaner.

Did you try to delete the following?  If you did and they came back, try to delete with HJT in Safe Mode

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll                 

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$N7AD2~1\runwin.dll

O20 - Winlogon Notify: runwin - C:\WINDOWS\$N7AD2~1\runwin.dll

http://www.hijackthis.de/logfiles/6ddeb3e09f0931218d54355fea78721b.html

Here is the link to my most recent hijackthis log.  I wasn't able to delete two of the entries you listed in safe mode either.  

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$N7AD2~1\runwin.dll
 (this one I had tried to delete when I did the vundofix also and it wouldn't go anywhere.)

O20 - Winlogon Notify: runwin - C:\WINDOWS\$N7AD2~1\runwin.dll


Any more advice?

Thanks  

no luck with killbox or unlocker.  My Knowledge of DOS commands are extremely rusty.  When I type in cmd I get C:\Documents and Settings\David> and I cannot for the life of me remember how to back out of this to just the C prompt.  I think I'm getting old and maybe a little frustrated with this one.  

>> When I type in cmd I get C:\Documents and Settings\David> and I cannot for the life of me remember how to back out of this to just the C prompt >>

cd..  a couple of times will back you up to C prompt.  Then cd\WINDOWS\$N7AD2~1 should get you to the correct directory.

I followed r-K's directions and they worked (I do have windows home xp so I needed to do it in safe mode) the security tab didn't show otherwise.  

I could not find the file using explorer or my computer even when I could see hidden files.  I had to use the search to find it.  There were two of them, one in a !submit file and one by itself, I disabled both and was able to have hijackthis delete them.  Thank you both.  Now I hope this solves the popup problem.  

Hey, should I uninstall ewido?  It kept deleting adware in real time and it was almost as annoying as popups.  I did disable the realtime protection, but since it is only a 14 day trial I assume I shoud uninstall?  My daughter would have no clue how to once I am gone.

In addition any advice on how to have her avoid this in the future?  Other than never downloading ANYTHING :)  

Thanks,

Charlotte

Glad the files are disabled.  If you could have found the files, you could have deleted them in command prompt.

>> Hey, should I uninstall ewido?  It kept deleting adware in real time

Yes, go ahead an uninstall it.  But deleting adware in real time is a good thing.

>> In addition any advice on how to have her avoid this in the future?

If you are using Internet Explorer, disable the two Download on Demand options in Options > Advanced tab.  

Be careful what you download.  I know that is difficult with a daughter who likes to download music files.  Scan each file you download with anti-virus and anti-spyware.

Run anti-virus and adware scanners often.

Glad things are better. If you want to uninstall Ewido, I would suggest installing Microsoft anti-spyware in its place. It is a free program you can download and install from:

 http://www.microsoft.com/athome/security/spyware/software/default.mspx

Charlotte,

We have not heard from you. Did any comment help you solve your problem? Do you have any more questions? If an Expert helped you, please accept his/her answer above with an excellent or good grade.

Thanks, war1

Her computer is running fine now, no pop ups.  Thank you both for your commments.

Charlotte, glad the problem is fixed.  Did I not contribute to the solution?

You wrote to me: " I wasn't able to delete two of the entries you listed in safe mode either.  

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$N7AD2~1\runwin.dll
 (this one I had tried to delete when I did the vundofix also and it wouldn't go anywhere.)

O20 - Winlogon Notify: runwin - C:\WINDOWS\$N7AD2~1\runwin.dll"

How did you know to delete this file if I did not analyze the HJT log for you?

you definitely helped me clean up her computer, I just wasn't able to delete the files the way you indicated.  Probably my fault, I'm just not that good with the DOS stuff.  I couldn't find the point list to have them spit the points when I posted earlier today.  Please advise me how to do this.

Thanks,

Charlotte