Overstock popup

[MacRDM]

I found a link from google about this same overstock popup problem someone else was having and wondered if you could help me as well. I been trying to get rid of it all say today.. heres my HJT Log file, Thx for any help you may can give...Mac

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and follow the instructions.

Then, go and have your computer scanned HERE.

Then, go and read both these threads by RBS. Follow all the instructions exactly.

How to remove Trojans and its ilk! and How to remove Begin2search / coolwebsearch and other nasties.

Then see. How to post your Hijackthis log-file as an ATTACHMENT.

Post a fresh HJT log, only after doing the above.

Regards Howard :wave: :wave:

 

[MacRDM]

Overstock still popping up

Ive ran every program I can at this darn johnny Dep popup and eventhough every program has found cans of worms it hasnt got this one yet. Spybot couldnt delete two files under command service and I tried it several times. I got a prompt after each run with spybot that maybe it could get it on a restart but same thing happens everytime. Party Poker pops up as well!!
Any help would be appreciated ive got a ton of projects on here I hate to lose anything If I can keep from doing a reinstall I would be extremely garateful to ya..

 

[MacRDM]

Heres the log file that I tried to upload this last post

Darn popups happen everytime I click the enter button and caused the log not attaching to the post above!! Mac

 

[MacRDM]

Wont let me upload the hjt text file??

I dont know whats going on but it wont let me upload the text file.. I get a popup in front of it and the attachment wont attach.. My bad I seen that it is a txt file but I guess the word log in there messes it up? I keep getting an upload error and the file is being saved as hijackthis.txt from notepad? I keep getting an upload in prgress error delte here?

 

[howard_hopkinso]

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html


Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O17 - HKLM\System\CCS\Services\Tcpip\..\{7A64218E-63DB-425C-B067-90FFB4E6C803}: NameServer = 85.255.113.114,85.255.112.61
O17 - HKLM\System\CCS\Services\Tcpip\..\{A4689FAB-C9AE-45D5-AAA6-FE5F0F3D5AAB}: NameServer = 85.255.113.114,85.255.112.61
O17 - HKLM\System\CCS\Services\Tcpip\..\{BBE5F2B8-3FC1-48B5-9293-069A8A747AB1}: NameServer = 85.255.113.114,85.255.112.61
O17 - HKLM\System\CCS\Services\Tcpip\..\{CEFBED0C-2307-4730-BEF2-EB2FADF4AD15}: NameServer = 85.255.113.114,85.255.112.61 Only fix these 017 entries, if they don`t belong to your ISP.

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSN Messenger\msgrapp.dll" (file missing)

O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - (no file)

O20 - AppInit_DLLs: oceahccp.dll,EQMini.dll

Click on the fix checked button.

Close HJT.

Reboot into normal mode and turn system restore back on.

Regards Howard

 

[MacRDM]

Thanks a million

Thank you very much for the help. That fixxed it! LOL I was saying to myself that if I see johnny Deps picture when i reboot this time Im gonna go nutzzz.. lol Dang what a pest that thing was.. I guess Overstock.com is gong to be a victem of this hackers prank... cause I know I ll never buy anything off them now and Im sure anyone else who gets that virus wont either.. Do the hackers pick the sites at random or do they have a personal grudge to motivate them to taint a companies image in consumers minds???LOL nevermind... Im just happy ya fixed me up.. Yur a Saint for helping ppl out here.. thx again.. Macdf2