ie popups - HTJ attached

[mr_newbie]

help!
i keep getting these random popups in internet explorer. Privacy is set to "accept all cookies" but if i put it to medium, it changes back to "accept all" automatically.
ive removed all sorts of viruses and spyware with AVG, spybot, and adware but the popups still keep coming.

heres some of the hijackthis log:

 

[kitty500cat]

Hello and welcome to TechSpot.

Very important: Before deciding whether to clean or reformat your system, read this thread and decide what you want to do.

If, after reading the above thread, you decide to clean your system, do the following.

Go and read the Viruses/spyware/malware, preliminary removal instructions. Follow all the instructions exactly, then post fresh ComboFix and AVG Antispyware logs as attachments into this thread. Also post here the results of the AVG Antirootkit scan.

Also post here a fresh HijackThis log that doesn't have any parts missing. Don't delete certain parts of it like the one you just posted. Otherwise we can't see whether or not it's truly clean.

Regards

This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.

 

[mr_newbie]

ok, heres the full log

 

[kitty500cat]

Have HijackThis fix these entries (if there) by putting a check in the little box next to them:

O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\tmp60.tmp.dll

O2 - BHO: (no name) - {6B3BA220-9EB5-483F-91C5-2B22806FCF64} - C:\WINDOWS\System32\iflj.dll

O2 - BHO: (no name) - {79b037f4-2713-4ff6-a980-f58e63b9973b} - C:\WINDOWS\system32\COMPDF.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [BootService] rundll32.exe "C:\WINDOWS\jkjkij.dll",realset

O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab

O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe

O20 - Winlogon Notify: COMPDF - C:\WINDOWS\SYSTEM32\COMPDF.dll

Click the Fix Checked button.

Download Vundofix from HERE.

Double click the Vundofix.exe to run it.

Right click in the vundofix window and click add files.

Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

This is the filepath you need to enter into Vundofix.

C:\WINDOWS\System32\iflj.dll
C:\WINDOWS\jkjkij.dll

Download the Pocket Killbox programme from HERE. Extract it.

Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

This is the filepath your need to enter into killbox.

C:\WINDOWS\system32\tmp60.tmp.dll
C:\WINDOWS\system32\COMPDF.dll

Now post a fresh HijackThis log, along with AVG Antispyware and ComboFix logs, and the results of the AVG Antirootkit scan.

Regards

This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.

 

[mr_newbie]

Ok i fixed what you said in HijackThis.
VundoFix didnt find any infected files (i think adware removed jkjkij.dll cos it says "cannot find file" on startup)
That Pocket Killbox doesnt work - it says its not a Win32 Application

Heres the latest log though:

 

[howard_hopkinso]

Download Vundofix from HERE.

Double click the Vundofix.exe to run it.

Right click in the vundofix window and click add files.

Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

This is the filepath you need to enter into vundofix.

C:\WINDOWS\system32\COMPDF.dll

Post a fresh HJT log after doing the above.

Regards Howard

 

[mr_newbie]

VundoFix didnt find any infected files.
Does this mean its clean? or should i try fixing the two COMPDF entries in HijackThis again?

heres latest log:

 

[kitty500cat]

VundoFix doesn't find files, as it is just meant to remove infected files, the paths of which the user specifies.

Download Vundofix from HERE.

Double click the Vundofix.exe to run it.

Right click in the vundofix window and click add files.

Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

This is the filepath you need to enter into vundofix.

C:\WINDOWS\system32\COMPDF.dll

Now have HijackThis fix these entries (if there):

O2 - BHO: (no name) - {79b037f4-2713-4ff6-a980-f58e63b9973b} - C:\WINDOWS\system32\COMPDF.dll

20 - Winlogon Notify: COMPDF - C:\WINDOWS\SYSTEM32\COMPDF.dll

If they're not there after doing the stuff with VundoFix, that's cool.

Now post fresh HijackThis, AVG Antispyware, and ComboFix logs as attachments into this thread. If you're not sure how to do this, read this for instructions.

Also post here the results of the AVG Antirootkit scan.

Regards

This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.

 

[howard_hopkinso]

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

Regards Howard

 

[mr_newbie]

ok heres the logs

 

[howard_hopkinso]

Have HJT fix these two inactive entries.

O2 - BHO: (no name) - {79b037f4-2713-4ff6-a980-f58e63b9973b} - C:\WINDOWS\system32\COMPDF.dll (file missing)

O20 - Winlogon Notify: COMPDF - COMPDF.dll (file missing)

Other than that, your HJT log is clean.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of mr_newbie only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.