ad.firstadsolution.com problem

[souton]

i get an ad.firstadsolution.com pop up(IE) everytime i open up firefox. i've tried all i know and i have deleted as much as i know, any help would be appreciated

 

[howard_hopkinso]

Go HERE and follow the instructions exactly.

Post a fresh HJT log as an attachment into this thread, only after doing the above.

Regards Howard

 

[souton]

here it is in .txt attachment, thanks

 

[howard_hopkinso]

There doesn`t seem to be very much wrong in your HJT log.

However, there are a couple of entries that look suspicious.

MySpaceIM.exe and especially type mp3.exe.

Go and follow all the instructions in the link I gave you, then post a fresh HJT log.

Regards Howard

 

[souton]

yea i tried deleting type mp3.exe but it keeps coming back, ill see what else i can do thanks

 

[howard_hopkinso]

Ok, try this.

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

type mp3.exe or mp3.exe

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKCU\..\Run: [comp eggs] C:\DOCUME~1\matt\APPLIC~1\BALLAB~1\type mp3.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files(if there).

C:\DOCUME~1\matt\APPLIC~1\BALLAB~1\type mp3.exe

Reboot into normal mode and turn system restore back on.


Regards Howard

 

[souton]

hey howard i just came back to let everyone know i got it, it was..

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

and i ended up getting rid of type mp3.exe i dunno what it was but thanks anyways :-D

i am now pop-up/spyware free

 

[howard_hopkinso]

Thats good news.

The entry O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll is the Adobe Internet Explorer Plugin and is safe.

Regards Howard

 

[souton]

it might be safe but i was visiting a certain website and it downloaded itself infected so i had to get rid of it