Cid:explorer unwanted ads still can't rid them

By acenthehole
Mar 5, 2008
  1. Hello, trying to get rid of a CiD: ad that keeps popping up. I tried to post my report but it says I can't because of links on the report i can't find these links so full stop here,any help would be appreciated thanks
  2. kritius

    kritius TS Guru Posts: 2,084

    Follow all the steps in the thread HERE and post back the three requested logs as attachments(see how here)

    For now try this,

    1)Uninstall any of the following program(s) using Add/Remove Programs if they are present. To do this, go to Start > Settings > Control Panel and

    double-click on Add/Remove Programs. From within Add/Remove Programs

    highlight each one and select Remove.

    Browser Enhancer
    CiD Help
    CiD Manager
    Download Plugin for Internet Explorer
    Messenger Plus
    Ultimate Browser Enhance
    Window Search
    Window Searching
    Zone Media

    2)Setup" is now displayed. Click on the Uninstall button. Note: options

    displayed on the first screen are not related to the sponsor program.

    3)The sponsor screen is now displayed (if you don't see it, search for it

    in your Task Bar). To prove that someone is currently reading the screen,

    you have to type the code that is displayed
    . Once you enter the code,

    press Uninstall.

    4)If you entered the code properly, the program will ask you to confirm that

    you want to uninstall. You must answer "Yes" to this question,

    else, you won't have another chance of uninstalling.

    5)Reboot your computer

    6)Run another scan with Hijackthis and attach a new log
  3. acenthehole

    acenthehole TS Rookie Topic Starter

  4. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Run Smitfraudfix
    • You should have downloaded this program from Step 10 Tool 1
    • Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
    • Double-click SmitfraudFix.exe
    • Select 2 and hit Enter to delete infected files.
    • You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
    • The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.
    • A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt

    please attach C:\rapport.txt here
  5. acenthehole

    acenthehole TS Rookie Topic Starter

    My rapport txt

    I did the previous suggestion to a T. side note i haven't seen the pop-up ad mind you i've only been on comp 5 mins maybe too early to get excited, thanks for help wasn't sure if i needed to add the hijack report again.

    View attachment 29394
  6. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    need to see a fresh Hijackthis log
  7. acenthehole

    acenthehole TS Rookie Topic Starter

  8. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Your doing good. Any more pop ups? You still have a few more things to clean up.

    1)Open Notepad and paste the contents of the below quote box:
    Save this to your desktop as Gokarfix.reg

    Double-click it to run the reg file. Then click Ok when it ask if you are sure.

    2) Restart your system and scan your hard drive with your F-Secure Anti-Virus. When it detects Gokar infection in KAREN.EXE located in Windows directory, select 'Delete' disinfection action.

    3) Run Hijackthis and post fresh log

    These instructions are for the use of acenthehole only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  9. acenthehole

    acenthehole TS Rookie Topic Starter

    New Hijack log

    Hi there, i did what was suggested, but when i ran Fsecure I never got prompted Gokar infection in KAREN.EXE located in Windows directory, select 'Delete' disinfection action. I am assuming that either Fsecure didn't find it or it dealt with it on its own. I wasn't here for entire scan I came back and it was done. Sending latest Hijack report.
    Side note I haven't seen any pop-ups thank the lord! (thanks techspot) One thing now with all these new programs I ', concerned i have to many and I was told all i need is FSECURE to be running continuously. Also, my comp has slowed right down to a crawl it was slow before but getting worse any advice would be welcomed. This place was a great find I will be spreading the word, thanks.

    View attachment 29419
  10. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    we will be removing most of these programs after you are clean

    you do want 1 firewall, 1 antivirus(fsecure), spybot, and adaware, or whatever your choice of anit-spyware program may be.

    I will look through the log now
  11. kritius

    kritius TS Guru Posts: 2,084

    Did you pay for the shaw secure software?

    I havnt heard great things about it, crappy detection rates etc.

    Just wondering.
  12. acenthehole

    acenthehole TS Rookie Topic Starter


    I do pay for it because its my Internet Provider i just installed it within the last 10 days mainly because I wanted to rid these pop-ups but obviously it wasn't helping, but maybe i should have removed all or any other virus software first then installed the FSecure. Its new here so haven't heard anything bad yet, but I'm not that well informed.
  13. kritius

    kritius TS Guru Posts: 2,084

    I was reading a few sites reviewing it, HERE is one, was just thinking that if you really needed anti virus and firewall then I would have gone for the individual free ones, ive used AVG on one computer and Avast! on another and have yet to be troubled by a virus.

    If I was to pay for one then it probably would have been Kaspersky.
  14. acenthehole

    acenthehole TS Rookie Topic Starter

    Wow, thats very interesting i liked the last post where the guy is a Technician and loves the biz generated from Shaw Secure, so i think i will deep sea this program, thanks for that link.
  15. kritius

    kritius TS Guru Posts: 2,084

    No problem whatsoever, I dont like to see people get ripped off when it comes to Antivirus software.

    Hope everything works out for you now.
  16. acenthehole

    acenthehole TS Rookie Topic Starter


    Thanks for help with this problem. Have a good day
  17. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

    Run Hijackthis and Select Do A System Scan Only
    Put a check mark next to the following entries:
    O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\web.exe

    Select Fix Checked

    Close Hijackthis

    Show hidden files through windows explorer
    • Access Windows Explorer by clicking Start, point to All Programs, Accesories, and then click Windows Explorer. Or hold the windows key and press E
    • On the Tools menu in Windows Explorer, click Folder Options.
    • Click the View tab.
    • Under Hidden files and folders, click Show hidden files and folders and Turn Hide protected operating system files off.

    Use Windows Explorer to navigate to and delete the following files:

    C:\WINDOWS\System32\web.exe <-This file only

    Restart your computer into normal mode

    Run a new scan with Hijackthis and attach the log
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...