TechSpot - PC Technology News and Analysis

jmolina · #1 10-13-2008

i keep getting this pop up after I RAN MALWARE BYTES AND ADWARE AND MCAFEE VIRUS PROTECTION i have included my HIJACK LOG. Any help would be greatly appreciated...THANKS

Insecure Internet Activity” popup!!!!!HELP

BillAllen55 · #2 10-13-2008

If you will go to this techspot guide and perform the 8-step Spyware/virus removal guide, this should assist you with all insidious virus/spyware/malware related issues. http://www.techspot.com/vb/topic58138.html
One may be tempted to bypass a process or two. I would recommend you resist that temptation.

Regards.

Bobbye · #3 10-14-2008

It would have been better if you had attached the Malwarebytes log. You should also run SuperAntispyware and attach log. But there some things we can work on in the current HijackThis log:

Please re-open HiJackThis and scan.*Check* the boxes next to all the entries listed below:
NOTE:

Quote:

O1 - Hosts: 216.19.0.250 idenupdate.motorola.com: Please note: this updates your phone operating system to the latest version and re-download the Download Apps Application for Over-The-Air . But it is can be a Hostsfile redirection to IP 216.19.0.250, which belongs to CommSpeed Arizona, LLC If this is NOT where the phone update come from, remove this entry. If it is correct, leave it.

Quote:

O2 - BHO: Killak - {1F88A6F5-908C-4C28-9A81-829953C5F5C5} - C:\WINDOWS\system32\MSYSAM~1.DLL> from Trojan Fake Alert
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O10 - Unknown file in Winsock LSP: bmnet.dll> Bytemobile Optimization Client related
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll

The Adobe Reader is out of date You have v7, the latest is v9. Remove the following entries, install the latest version, v9.

Quote:

C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

Your Java is out of date. You need to install v6u7. Remove the following:

Quote:

9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

I am unable to verify this domain: Do you have any information on it? Is it your ISP. Do you have a link for it? IF it is NOT your ISP, remove the following:

Quote:

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = chi.crainit.com
O17 - HKLM\Software\..\Telephony: DomainName = chi.crainit.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = chi.crainit.com

Now close all windows other than HiJackThis, then click *Fix Checked.*Close HiJackThis and reboot into Safe Mode:
Start> Run> type in 'msconfig' without quotes> enter> Selective startup> Startup tab> UNCHECK every thing except the Network Associates (McAfee) antivirus and firewall> Apply> OK
Control Panel> Add/Remove Programs> UNINSTALL Adobe v7 and Java.
Start> Run> type in services.msc> find the following, right click on each> Properties> change the Startup type to Manual:

Quote:

Lavasoft Ad-Aware Service (aawservice)
Adobe LM Service
Adobe Version Cue CS2
InstallDriver Table Manager
OracleMTSRecoveryService
OracleOraHome92ClientCache

After that, Reboot, and post a new HijackThis log here in a reply
NOTE: you will get a nag message when you reboot. You can ignore it, check 'don't show this message again'> Close. stay in Selective startup.

Adobe download: http://www.adobe.com/products/reader/
A suggestion. With the reader on board, if you click on a PDF document, it will automatically open on the Adobe Program. If you need to use any of it's other features, manually open the program from All Programs. You don't need all those extra Toolbars, buttons and right click options. They cost you time and space.

Java update: http://www.java.com/en/download/manual.jsp
Take care to note any 'extras' on either of the above. Uncheck them is any.

Similar Topics
Thread	Thread Starter	Forum	Replies	Last Post
"CID" Popup windows in Internet Explorer 6	mrkrandall	Security and the Web	6	05-01-2008 01:44 PM
Internet activity monitoring in terminal services	k.jacko	Misc. Software & Utilities	4	01-25-2008 10:35 PM
System affected by "System Alert Popup" and then "Internet Explorer Security Plugin"	sandeep.jgupta	Security and the Web	22	01-08-2007 07:25 PM
Suspicious Internet & CPU activity	ScottDogs	Windows OS	2	01-27-2006 01:22 AM
Strange activity when I log onto the internet	curiousguy44	Windows OS	5	09-10-2005 04:23 PM