TechSpot

ie popups - HTJ attached

By mr_newbie
Apr 13, 2007
  1. help!
    i keep getting these random popups in internet explorer. Privacy is set to "accept all cookies" but if i put it to medium, it changes back to "accept all" automatically.
    ive removed all sorts of viruses and spyware with AVG, spybot, and adware but the popups still keep coming.

    heres some of the hijackthis log:
     
  2. kitty500cat

    kitty500cat TS Evangelist Posts: 2,154   +6

    Hello and welcome to TechSpot.

    Very important: Before deciding whether to clean or reformat your system, read this thread and decide what you want to do.

    If, after reading the above thread, you decide to clean your system, do the following.

    Go and read the Viruses/spyware/malware, preliminary removal instructions. Follow all the instructions exactly, then post fresh ComboFix and AVG Antispyware logs as attachments into this thread. Also post here the results of the AVG Antirootkit scan.

    Also post here a fresh HijackThis log that doesn't have any parts missing. Don't delete certain parts of it like the one you just posted. Otherwise we can't see whether or not it's truly clean.

    Regards :)

    This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
     
  3. mr_newbie

    mr_newbie TS Rookie Topic Starter Posts: 16

    ok, heres the full log
     
  4. kitty500cat

    kitty500cat TS Evangelist Posts: 2,154   +6

    Have HijackThis fix these entries (if there) by putting a check in the little box next to them:

    O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\tmp60.tmp.dll

    O2 - BHO: (no name) - {6B3BA220-9EB5-483F-91C5-2B22806FCF64} - C:\WINDOWS\System32\iflj.dll

    O2 - BHO: (no name) - {79b037f4-2713-4ff6-a980-f58e63b9973b} - C:\WINDOWS\system32\COMPDF.dll

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O4 - HKLM\..\Run: [BootService] rundll32.exe "C:\WINDOWS\jkjkij.dll",realset

    O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab

    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe

    O20 - Winlogon Notify: COMPDF - C:\WINDOWS\SYSTEM32\COMPDF.dll

    Click the Fix Checked button.

    Download Vundofix from HERE.

    Double click the Vundofix.exe to run it.

    Right click in the vundofix window and click add files.

    Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

    This is the filepath you need to enter into Vundofix.

    C:\WINDOWS\System32\iflj.dll
    C:\WINDOWS\jkjkij.dll

    Download the Pocket Killbox programme from HERE. Extract it.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    This is the filepath your need to enter into killbox.

    C:\WINDOWS\system32\tmp60.tmp.dll
    C:\WINDOWS\system32\COMPDF.dll

    Now post a fresh HijackThis log, along with AVG Antispyware and ComboFix logs, and the results of the AVG Antirootkit scan.

    Regards :)

    This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
     
    1 person likes this.
  5. mr_newbie

    mr_newbie TS Rookie Topic Starter Posts: 16

    Ok i fixed what you said in HijackThis.
    VundoFix didnt find any infected files (i think adware removed jkjkij.dll cos it says "cannot find file" on startup)
    That Pocket Killbox doesnt work - it says its not a Win32 Application

    Heres the latest log though:
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Download Vundofix from HERE.

    Double click the Vundofix.exe to run it.

    Right click in the vundofix window and click add files.

    Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

    This is the filepath you need to enter into vundofix.

    C:\WINDOWS\system32\COMPDF.dll

    Post a fresh HJT log after doing the above.

    Regards Howard :)
     
  7. mr_newbie

    mr_newbie TS Rookie Topic Starter Posts: 16

    VundoFix didnt find any infected files.
    Does this mean its clean? or should i try fixing the two COMPDF entries in HijackThis again?

    heres latest log:
     
  8. kitty500cat

    kitty500cat TS Evangelist Posts: 2,154   +6

    VundoFix doesn't find files, as it is just meant to remove infected files, the paths of which the user specifies.

    Download Vundofix from HERE.

    Double click the Vundofix.exe to run it.

    Right click in the vundofix window and click add files.

    Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

    This is the filepath you need to enter into vundofix.

    C:\WINDOWS\system32\COMPDF.dll

    Now have HijackThis fix these entries (if there):

    O2 - BHO: (no name) - {79b037f4-2713-4ff6-a980-f58e63b9973b} - C:\WINDOWS\system32\COMPDF.dll

    20 - Winlogon Notify: COMPDF - C:\WINDOWS\SYSTEM32\COMPDF.dll

    If they're not there after doing the stuff with VundoFix, that's cool.

    Now post fresh HijackThis, AVG Antispyware, and ComboFix logs as attachments into this thread. If you're not sure how to do this, read this for instructions.

    Also post here the results of the AVG Antirootkit scan.

    Regards :)

    This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
     
  9. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

    Regards Howard :)
     
  10. mr_newbie

    mr_newbie TS Rookie Topic Starter Posts: 16

    ok heres the logs
     
  11. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Have HJT fix these two inactive entries.

    O2 - BHO: (no name) - {79b037f4-2713-4ff6-a980-f58e63b9973b} - C:\WINDOWS\system32\COMPDF.dll (file missing)

    O20 - Winlogon Notify: COMPDF - COMPDF.dll (file missing)

    Other than that, your HJT log is clean.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...