TechSpot

Inundated with pop ups. HJT log attached. Please, please help

By erichswanson
Nov 12, 2005
  1. Hi all,

    I'm at my wits end. I'm a fairly experienced user, but after Adaware, Spybot S&D and Spyware Doctor have run updated full scans, I'm still getting hit with pop up after pop up. Spyware Doctor finds and fixes the same problems everytime it runs (after a restart, anyway). Can someone please take a look at my logs and let me know what I can do to get this to stop? I REALLY don't want to have to wipe the drive and start over...

    Thanks!
    ...erich
     
  2. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Do this first:
    See Broken Internet access with xxx.dll.
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

    Then Read: Only use these HJT-instructions when asked!
    No /P//S/R/U/ ACTIONS FOR YOU.
    Transfer the text from between these dotted lines underneath to between the dotted lines of that post.
    Make sure to follow ALL instructions in SEQUENCE, and in HiJackThis tick/fix ALL lines indicated here!
    ...................................................................................................
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
    O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.3.1.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    If Colorado SuperNet is your ISP, they are OK, otherwise FIX these O17s.
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1866DC28-818A-4894-891D-02B90B57350E}: NameServer = 205.171.3.65,205.171.2.65
    O17 - HKLM\System\CCS\Services\Tcpip\..\{79ED89BB-4725-49DD-9D68-30EA975EA09D}: NameServer = 205.171.3.65,205.171.2.65
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D18E0E97-FC91-41AE-862A-D87496010B55}: NameServer = 205.171.2.65,205.171.3.65
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1866DC28-818A-4894-891D-02B90B57350E}: NameServer = 205.171.3.65,205.171.2.65
    ...................................................................................................

    STOP using that crappy IE (other than for Windows-updates) and install Firefox from www.getfirefox.com
     
  3. erichswanson

    erichswanson TS Rookie Topic Starter

    Still getting pop-up ads

    Hi, and thanks so much for your help.

    Unfortuantely, I'm still getting pop up windows. Can you take another look at my HJT log (attached).

    Thanks again.

    Oh, and the O17 entry is a custom DNS setting for my Qwest DSL service; can't surf without it...
     
  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...