Seemingly unremovable adware. How to get rid of them?

Also very good reading:

How to block Pop-ups?
http://windowsxp.mvps.org/Popups.htm

Zee

First use Windows Update ( http://v4.windowsupdate.microsoft.com ) to make sure that all security patches are installed.  Then use the following web site to analyze your HJT log file and post a link here.

http://www.hijackthis.de/index.php?langselect=english

Hi, caza13,

I think you mean this: http://www.hijackthis.de/logfiles/d9e9d8be7dd63769a878eab4e9bc87fe.html, right?

The site didn't show anything except that I don't have a firewall neither an antivirus (which I do - Avast)...

I couldn't see anything in that saved log.  I was expecting something like the following:

http://www.hijackthis.de/logfiles/19b1bfff8d6a8d06b7674e3d2c52cb2f.html

Or this:

http://www.hijackthis.de/logfiles/67d96e31bc513ace42bca1152528a5ed.html

In HijackThis, I clicked Registry tool, and then File>Save list as... and saved it as txt. Have I missed something?

Yours appeared like the first one that I posted.  It was an old log, and was created with an old version of HJT.  The second one is a new log created with the latest version of HJT.

Hi!

If you get a popup, out of nowhere; that warns you about your security settings -
and tells you to go to some site to download or scan your computer - don't!

Here's some info on what may be generating these popups:
MSN messenger -
http://www.answersthatwork.com/Tasklist_pages/tasklist_m.htm

Messenger service -
http://www.blackviper.com/WinXP/service411.htm#Messenger
http://www.grc.com/stm/shootthemessenger.htm

Note: Messenger (the "Service") and MSN messenger (msmsgs.exe) are 2 different things.

RF

Curious if when you ran Spybot S&D (all updates) you also used the Immunize function.  It also helps to know which version of OS and IE you're using.  Also if/when you ran updated version of AdAware, did you configure to do deep scanning and check the HOSTS file?

Try this too:

http://housecall-beta.trendmicro.com/en/start_corp.asp

Regards,
David McGraw

caza13 and all you other fellows,

I had confused Hijack with JV16 PowerTools. Now the weird part: I can analyse log files from two of my computers through www.Hijackthis.de, but *always* get "this page could not be found" from IE when I try to analyze the PC with the pop-ups. It's as if virus/spyware is hindering one specific log file from being analyzed.

I have even tried to analyze the log file from different computers and got the same result: blank page.

I have found a lot of sexthis and sexthat in some Host folders after succesfully running HijackThis (the latest version). Deleted them and thought I was finally rid of these bastards. I turned my PC on this morning and no pop-ups. At least until the middle of the afternoon, when they once again appeared.

I am running Win XP SP1 in this computer and IE6. Updating to SP2 would not be my firts choice as its processor is a somewaht slow P3 1GHz processor and I think this might make it a little lazier. Besides this is a real challange and I`d love to defeat the bug.

Hi!

Try renaming HijackThis to something (random).exe -
then try running it.

RF

It may not be possible to keep from getting reinfected if the latest security patches aren't installed.  If you can't get a log file analyzed automatically, copy and paste it here and we'll analyze it for you.

Hi,

Here's the HijackThis log file:

Logfile of HijackThis v1.99.1
Scan saved at 06:28:37, on 10/03/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program files\Ahead\InCD\InCDsrv.exe
C:\Program files\Common files\Symantec Shared\ccSetMgr.exe
C:\Program files\Common files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program files\UOL\Acelerador UOL\vcn.exe
C:\Program files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program files\OLYMPUS\DeviceDetector\DM1Service.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program files\Borland\InterBase\bin\ibguard.exe
C:\Program files\Common files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\Explorer.EXE
C:\ARQUIV~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\PGPsdkServ.exe
C:\ARQUIV~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\Fast.exe
C:\Program files\ScanSoft\OmniPagePro11.0\opware32.exe
C:\Program files\Babylon\Babylon.exe
C:\Program files\4th Software\Checklist\Checklist.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program files\Common files\Symantec Shared\ccApp.exe
C:\Program files\Microsoft AntiSpyware\gcasServ.exe
C:\Program files\UOL\Acelerador UOL\AcUOLClt.exe
C:\Program files\Plaxo\2.2.0.81\InstallStub.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program files\OLYMPUS\DeviceDetector\DevDtct2.exe
C:\Program files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\ARQUIV~1\MICROS~2\OFFICE11\OUTLOOK.EXE
c:\arquiv~1\intern~1\iexplore.exe
C:\Program files\Microsoft Office\Office10\msoffice.exe
C:\Program files\Internet Explorer\iexplore.exe
C:\Program files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program files\Alwil Software\Avast4\ashWebSv.exe
C:\Program files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program files\Common files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program files\Borland\InterBase\bin\ibserver.exe
C:\Program files\Internet Explorer\iexplore.exe
G:\___SOFTWARES PARA INSTALAR\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://m.busca.uol.com.br/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://m.busca.uol.com.br/ie/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9877
R3 - URLSearchHook: CUOLSearchHook Object - {1FE8243E-0A3A-41B9-B9CE-EFFEE51974D3} - C:\Program files\Common files\uol\urlsearch\UOLSearchHook.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [InCD] C:\Program files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program files\ScanSoft\OmniPagePro11.0\opware32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Babylon Client] C:\Program files\Babylon\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [Checklist] "C:\Program files\4th Software\Checklist\Checklist.exe" -min
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program files\Common files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AceleradorUOL] "C:\Program files\UOL\Acelerador UOL\AcUOLClt.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program files\Plaxo\2.2.0.81\InstallStub.exe -a
O4 - HKCU\..\Run: [ANONYMIZER_SPYWAREKILLER] C:\Program files\Anonymizer\Anti-Spyware\AnonAntiSpyware.exe /BOOT
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [hole flag] C:\DOCUME~1\Lincoln\DADOSD~1\THATBIN\Load cast.exe
O4 - Startup: MemTurbo.lnk = C:\Program files\Silicon Prairie Software\MemTurbo\memturbo.exe
O4 - Startup: Microsoft Outlook.lnk = ?
O4 - Global Startup: Device Detector 2.lnk = C:\Program files\OLYMPUS\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Inicialização Rápida do Microsoft Office OneNote 2003.lnk = C:\Program files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program files\Messenger\MSMSGS.EXE (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2E3C3651-B19C-4DD9-A979-901EC3E930AF} (ssh2 Class) - https://wwwss.bradesco.com.br/ib2k1/scpsssh2.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D1DD51D9-C35E-4050-8660-49D9FC0A0547} (PbaUpdate Control) - http://www.priberam.pt/update/patches/PbaUpdate.cab
O16 - DPF: {D9CE2963-8547-4C18-A4CE-DA27278310D8} (Instalador Remoto UOL) - http://download.uol.com.br/discadorUOL/light/UOLActiveInstall.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancobrasil.com.br/plugin/GbPluginBb.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program files\AutoCAD 2002\AcPreview.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA193429-682E-4A7A-81F6-D594C5A39121}: NameServer = 200.255.54.39,200.255.54.40
O23 - Service: Acelerador UOL - Unknown owner - C:\Program files\UOL\Acelerador UOL\vcn.exe" -f "C:\Program files\UOL\Acelerador UOL\acelerador.cfg" -Srun (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program files\Common files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program files\Internet History Eraser\autocomp.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program files\Common files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program files\Common files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program files\Common files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: DM1Service - OLYMPUS OPTICAL CO.,LTD - C:\Program files\OLYMPUS\DeviceDetector\DM1Service.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program files\Ahead\InCD\InCDsrv.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Program files\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Program files\Borland\InterBase\bin\ibserver.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\ARQUIV~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Visibroker Activation Daemon (oad) - Unknown owner - C:\ARQUIV~1\Borland\vbroker\bin\oad.exe
O23 - Service: VisiBroker Smart Agent (osagent) - Unknown owner - C:\ARQUIV~1\Borland\vbroker\bin\osagent.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\System32\PGPsdkServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\ARQUIV~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program files\Common files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program files\Common files\Symantec Shared\Security Center\SymWSC.exe

A few notes:

1. Running 2 AV's in the same system is not good. You should uninstall Avast or Norton, not run both of them.

2. I would start by uninstalling that UOL Accelerator software and test.

Zee

You're making progress here, and excellent information posted by the Experts above.  I agree wholeheartedly with the recommendation to update to SP2 .... here's just a 'tiny' sampling that may play a role here.  I'm one who chooses to upgrade to minimize the 'recreation of wheel' syndrome, trying to fix things inheritently known problems, but then, that's just me.  LOL.

Microsoft Security Bulletin MS04-044
Vulnerabilities in Windows Kernel and LSASS Could Allow Elevation of Privilege (885835)
http://www.microsoft.com/technet/security/Bulletin/MS04-044.mspx

Release notes for Windows XP Service Pack 2 -- this includes system requirement info and other important informational links about the SP2 update.
http://support.microsoft.com/default.aspx?scid=kb;en-us;835935

Asta

c:\arquiv~1\intern~1\iexplore.exe

Here is another thing that I noticed.  The file iexplore.exe is normally the Internet Explorer browser, but the one listed above seems to be running from the wrong folder.  Usually it is listed as C:\Program files\Internet Explorer\iexplore.exe .  Sometimes spyware files are disguised by using the names of system files but they are saved in a different folder.

caza13,

The location is correct.

That is the Portuguese version of Windows.
;-)

Zee

the process running called C:\WINDOWS\System32\Fast.exe pops out at me....

I could be mistaken, but if I recall correctly this is adware..... Find that file and move it to a different directory and reboot. See if that helps.

Second, IE is horrible. You need to be using FireFox, its way more secure and easier to use. Plus, that browser doesn't allow popups.

Hi!

Fast.exe is for "fast user switching" -
not really malware; but, a resource hog.
Can be run manually.

These lines show something problematic:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/

I'm using MVP's Host file and IEspyad and when I try to access the site above I'm blocked (good thing!).
If you have not set these yourself - I would have HijackThis fix these entries.

Good advice to update XP to SP 2.
However, make very sure that you have NO malware on your computer!
Do online scans from various vendors.
As zee says above - bad idea to have 2 active anti-virus programs running at the same time!
It's OK to have more than one installed -
only one should be in active scan mode.

Try this scanner - I've had very good success with it: often, it shows things others miss
(free version shows things, but will not fix them - pay ver. will fix them)
EScan-mwav from:
http://www.mwti.net/antivirus/free_utilities.asp

Good luck!

RF

Hi, every1,

I decided to update my PC to XP SP2, even running the risk of it getting slower. It didn't and I finally had one day without those ##$$%#@ pop-ups. Even ran Norton AV from another computer from my small network. It eliminated everything it found.

Today, I turned on my computer, and after sometime (1-2 hours), pop-ups. The same emoticons, casino, etc ads.

I will try some of the other suggestions I haven't yet and will let you guys know.

Thanks!

I sure hope you're making progress here.  Remember things like "system restore" and check the trusted zone to ensure that problem URLs aren't there, and if you can trap the URLs to the problem sites, add them to your Restricted zone, check startup and so on, as noted earlier.  Sometimes running the viruscan routines and spyware tools in Safe Mode works best, when system files aren't in use.

In fact I tried almost all the suggestions, but caza13 was the person who helped me the most, so the points go to him.

Thanks!