IE popups in Firefox

[ThatClownKid]

I know that they're have been numerous threads on this, but every time something is different.... so here goes....

I use Firefox, and I have been getting pop ups with IE, even though I never use it. I'm pretty sure it's a trojan or malware. So I downloaded Hijackthis and did a system scan (see attached file). Please help, it is really annoying!

I tried Norton.... bleh! All it did was slow my computer down more!

Any help would be greatly appreciated, and take it easy on me, this is my first thread!

Thanks and Peace

 

[Blind Dragon]

Norton - known for slowing down systems

Did you already try fixing this yourself - it appears you may have removed some items already with Hijackthis?

Follow these Viruses/Spyware/Malware, preliminary removal instructions and post back in this thread with the requested logs. There should be at least 3.

1)MBAM log
2)SAS log
3)Hijackthis log (last step)

 

[raybay]

Most likely, it is because you use Windows Messenger.
Uninstall Firefox. Reboot. Defrag. Then reinstall Firefox. Firefox 2.0.0.16 is more bulletproof for this problem than is Firefox 3.0, as well.
Then remove Windows Messenger with Add and Remove. Reboot and defrag, then reinstall Windows Messenger.

 

[ThatClownKid]

What is SAS? And I ran the MBAM and found 10 problems (which I deleted). Then the pop ups reduced a lot but I still got the odd one. I'll attach the MBAM log.

Thanks, and please keep replying! You guys on these (and other) boards seem really helpful!

 

[ThatClownKid]

Oops SAS, is SuperAntiSpyware, my bad. I'll post the logs shortly.

 

[ThatClownKid]

Okay, sorry for the delay... here are the logs.

 

[ThatClownKid]

Ok, I know that I have been replying a lot, but they have been brief. SO I'll give a more detailed explanation of what's going on...

I ran the two programs. The first one ,MBAM, said I had 10 errors and cleared them. After about an hour, popups came back, but not in full force.

I ran the second one, SAS, and it said I had 120! It cleared them out too. Now the pop ups have dramatically decreased, but I'm still getting them. I read another thread on these forums from a little while ago (called IE popups from Firefox!), and the guy sounded like he had the same problems as me (except his sounded worse, for instance, my computer still runs fairly well).

So finally, I uploaded the SAS and latest Hijackthis text files (it wouldn't let me upload the MBAM one again). Any help would be appreciated.

Thanks

 

[SpiritWind]

antiVIRUS program !?

Hi :

Your Logs indicates you do NOT have ANY antiVIRUS program on your computer;
not a very wise decision . I feel the Best Overall FREE antiVIRUS would be
Avast Home Edition ( www.avast.com ) ; to read about this program, read the Info
at www.avast.com/eng/avast_4_home.html and its "FAQs" at
www.avast.com/eng/faq-avast-4-home-professional.html .
Until you install an antiVIRUS program you will continually get re-infected and no
use wasting our time until you do so .

 

[ThatClownKid]

I see you posted a couple of minutes ago, and I just logged on to check, so I'll try to catch you while your still online!...

I will download Avast, but as I posted earlier, Norton only made my computer WORSE. I'll try Avast though.....

 

[ThatClownKid]

I ran avast and sygate, but now Avast gives me pop ups saying "A virus has been found". I delete it, and they keep coming back! They download to WINDOWS or Temp or sytem32. Is anyone out there still?

 

[Bobbye]

It is interesting to see that the list of Tracking Cookies is several times longer that our entire HijackThis log!

Are you posting the entire log?
Have SuperAntiSpyware remove ALL of those Tracking cookies.

Please explain or attach image of just what this is:

I use Firefox, and I have been getting pop ups with IE

Run all the program again according to Blind Dragon's directions:

Follow these Viruses/Spyware/Malware, preliminary removal instructions and post back in this thread with the requested logs. There should be at least 3.
1)MBAM log
2)SAS log
3)Hijackthis log (last step)

 

[raybay]

I would change to avir Antivir...
As soon as you run the scan and delete, press the off button.
Then restart in SAFE MODE (pressing <F8 repeatedly as soon as you press the on button> and run again. While in SAFE MODE, run SuperAntiSpyware as well as MBAM.
You likely have an infestation that hides in memory or an image file or a animation.
Then run the logs.

 

[ThatClownKid]

Thanks for replying back guys, I thought I was all alone out here!

Anyways, I did all the scans again, in safe mode, here they are....

So far my computer has been good, but I am not celebrating yet! Do you see anything out of place?

Thanks

 

[ThatClownKid]

Oh and Bobbye, I don't get pop ups anymore, I think sygate stuffs those attempts. Then I just got all these different .exe files downloaded to my temp, Windows, and system32 folders, where they were immediately picked up by avast. They always had different names, and no matter how many I deleted a new one would show up.

That was before the logs I ran a few hours ago though, and I am crossing my fingers hoping that everything is still okay in the morning.

Thanks.

 

[Bobbye]

Additional information on the Windows Messenger: This is a legitimate process to be used by the Administrator of a network to communicate with the other systems on the network. However, it's format is used unethically, employing social networking, to 'fool' a user into doing something.

To shut this down: Control Panel> Administrative Tools> Services> scroll down to Messenger Service> right click> Properties> change Start mode to Disabled> Stop the Service> Apply> OK.

The follow with this: Right click on Start> Explore> Programs> Right click on Messenger> Rename> add 'old' to the end, like this messengerold.

mbam cleaned the infected Registry entry. SuperAntispyware is clean and the HijackThis log looks good and clean an nice and lean!

Blind Dragon will let you know if there is anymore to be done.

Let us know if the problem recurs.

 

[ThatClownKid]

Bobbye thanks so much, computer is running like a charm!

Everyone else who posted, thank you too!

:wave:

 

[Bobbye]

Since Blind Dragon hasn't reviewed your logs, technically, you're not in the clear, If the problem appears again, you should run the programs, post the new logs and have them checked. All I did was give you another path to turn off the Messenger which will prevent it from displaying in the future. That did not remove anything on your system.

Your HijackThis log looked more like an abbreviated version than a full one. I don't usually get a chance to tell someone they don't look like they have enough running, but if I did, you would be one of them!