Hello, trying to get rid of a CiD: ad that keeps popping up. I tried to post my report but it says I can't because of links on the report i can't find these links so full stop here,any help would be appreciated thanks

Follow all the steps in the thread HERE and post back the three requested logs as attachments(see how here)

For now try this,

1)Uninstall any of the following program(s) using Add/Remove Programs if they are present. To do this, go to Start > Settings > Control Panel and

double-click on Add/Remove Programs. From within Add/Remove Programs

highlight each one and select Remove.

Netpumper
BitRoll
Browser Enhancer
CiD Help
CiD Manager
Download Plugin for Internet Explorer
Lop.com
LOP SEARCH
Messenger Plus
Ultimate Browser Enhance
Window Search
Window Searching
Zone Media

2)Setup" is now displayed. Click on the Uninstall button. Note: options

displayed on the first screen are not related to the sponsor program.

3)The sponsor screen is now displayed (if you don't see it, search for it

in your Task Bar). To prove that someone is currently reading the screen,

you have to type the code that is displayed. Once you enter the code,

press Uninstall.

4)If you entered the code properly, the program will ask you to confirm that

you want to uninstall. You must answer "Yes" to this question,

else, you won't have another chance of uninstalling.

5)Reboot your computer

6)Run another scan with Hijackthis and attach a new log

New Hijack report

View attachment 29373

View attachment 29374

View attachment 29375

Run Smitfraudfix

• You should have downloaded this program from Step 10 Tool 1
• Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
• Double-click SmitfraudFix.exe
• Select 2 and hit Enter to delete infected files.
• You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
• The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.
• A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt

please attach C:\rapport.txt here

My rapport txt

I did the previous suggestion to a T. side note i haven't seen the pop-up ad mind you i've only been on comp 5 mins maybe too early to get excited, thanks for help wasn't sure if i needed to add the hijack report again.


View attachment 29394

need to see a fresh Hijackthis log

New Hijack log

Here is the latest Hijack log thanks for any advice


View attachment 29398

Your doing good. Any more pop ups? You still have a few more things to clean up.

1)Open Notepad and paste the contents of the below quote box:

Save this to your desktop as Gokarfix.reg

Double-click it to run the reg file. Then click Ok when it ask if you are sure.

2) Restart your system and scan your hard drive with your F-Secure Anti-Virus. When it detects Gokar infection in KAREN.EXE located in Windows directory, select 'Delete' disinfection action.

3) Run Hijackthis and post fresh log

These instructions are for the use of acenthehole only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

New Hijack log

Hi there, i did what was suggested, but when i ran Fsecure I never got prompted Gokar infection in KAREN.EXE located in Windows directory, select 'Delete' disinfection action. I am assuming that either Fsecure didn't find it or it dealt with it on its own. I wasn't here for entire scan I came back and it was done. Sending latest Hijack report.
Side note I haven't seen any pop-ups thank the lord! (thanks techspot) One thing now with all these new programs I ', concerned i have to many and I was told all i need is FSECURE to be running continuously. Also, my comp has slowed right down to a crawl it was slow before but getting worse any advice would be welcomed. This place was a great find I will be spreading the word, thanks.




View attachment 29419

we will be removing most of these programs after you are clean

you do want 1 firewall, 1 antivirus(fsecure), spybot, and adaware, or whatever your choice of anit-spyware program may be.

I will look through the log now

Did you pay for the shaw secure software?

I havnt heard great things about it, crappy detection rates etc.

Just wondering.

FSecure

I do pay for it because its my Internet Provider i just installed it within the last 10 days mainly because I wanted to rid these pop-ups but obviously it wasn't helping, but maybe i should have removed all or any other virus software first then installed the FSecure. Its new here so haven't heard anything bad yet, but I'm not that well informed.

I was reading a few sites reviewing it, HERE is one, was just thinking that if you really needed anti virus and firewall then I would have gone for the individual free ones, ive used AVG on one computer and Avast! on another and have yet to be troubled by a virus.

If I was to pay for one then it probably would have been Kaspersky.

Wow, thats very interesting i liked the last post where the guy is a Technician and loves the biz generated from Shaw Secure, so i think i will deep sea this program, thanks for that link.

No problem whatsoever, I dont like to see people get ripped off when it comes to Antivirus software.

Hope everything works out for you now.

FSecure

Thanks for help with this problem. Have a good day

Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

Run Hijackthis and Select Do A System Scan Only
Put a check mark next to the following entries:
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\web.exe

Select Fix Checked

Close Hijackthis

Show hidden files through windows explorer

• Access Windows Explorer by clicking Start, point to All Programs, Accesories, and then click Windows Explorer. Or hold the windows key and press E
• On the Tools menu in Windows Explorer, click Folder Options.
• Click the View tab.
• Under Hidden files and folders, click Show hidden files and folders and Turn Hide protected operating system files off.

Use Windows Explorer to navigate to and delete the following files:

Files:
C:\WINDOWS\System32\web.exe <-This file only

Restart your computer into normal mode

Run a new scan with Hijackthis and attach the log