TechSpot

Pop ups that just wont go away

By Haunted
Jan 21, 2006
  1. can anybody please help me with my spyware problem?

    The blasted pop ups have been making my life a living hell..
    I visited the threads made by RealBlackStuff and I tried to follow the steps the best way that I can but I think Ive missed something for the pop ups still keep on appearing..

    Attached is my hijackthis log, anybody with a kind heart please go and check it out and help me.. Im really very ignorant about this stuff, I need all the help that i can get..

    oh, and if i didnt follow the steps in posting problems like this i am sorry, this ignorant girl really tried her best heheh

    Thanks a lot in advance for any help that you can give me..
    Good day to you all
     
  2. Peddant

    Peddant TS Rookie Posts: 1,446

    That`s no excuse.Some of Microsofts best programmers are goyils :) Here are the most obvious BADthings

    O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd.exe
    O4 - HKLM\..\Run: [winsysban] c:\windows\winsysban.exe

    O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\m682lglo16qc.dll

    O4 - HKLM\..\Run: [Network] C:\Program Files\Network\network.exe

    O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

    O4 - HKLM\..\Run: [winupdate] C:\Program Files\winupdate\winupdate.exe /auto Get HJT to fix them.

    Here`s info on HJT http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

    Also use this http://www.mozilla.com/firefox/ instead of IE, BTW what firewall and antivirus are you using ?
     
  3. swker98

    swker98 TechSpot Paladin Posts: 1,077

    hi
    go here then go here

    then post a fresh hjt log from safe mode
     
  4. Haunted

    Haunted TS Rookie Topic Starter

    i already downloaded the different spyware removal tools that were mentioned in the two threads..
    but i still have pop ups.. here is my new HJT log.. thanks again guys..
     
  5. Peddant

    Peddant TS Rookie Posts: 1,446

    Did you run the scans in safe mode ? That`s important.What Firewall are you using ?
    Do the popups occur just when browsing or at anytime.This only thing in your new log that I`m not sure about is-
    O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\l8n4li5q18.dll -Perhaps somebody else could confirm what it is.
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Boot into safe mode, and turn system restore off.

    Go to add remove programmes in your control panel, and uninstall anything to do with(if there)

    C:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe

    Close control panel.

    Open your task manager. Click on the processes tab, and end process for(if there)

    FFIMC.exe

    Close task manager.

    Run HJT with no other programmes open, and let HJT fix the following(if there)

    O4 - Startup: FriendFinder Messenger.lnk = C:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe

    O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/SimCityX.cab
    O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

    O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\l8n4li5q18.dll

    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

    Close HJT.

    Click start/run, and type services.msc into the run box, and press enter.

    When the window appears maximise it. Look for the 023 service above. Double click on it, and if it`s running click stop. Set the startup type to disabled. Click apply/ok.

    Locate the following bold files, and delete them(if there)

    C:\WINDOWS\system32\l8n4li5q18.dll
    C:\Program Files\FriendFinder Messenger\FriendFinder Messenger\FFIMC.exe


    Reboot into normal mode, and turn system restore back on.

    Now get yourself some antivirus protection, and a good firewall.

    Avg free, and Zonealarm free.

    Regards Howard :)
     
  7. Shadowrunner

    Shadowrunner TS Rookie Posts: 106

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...