yyy65 & popups I cant get rid of

By moonshin
Jan 23, 2006
  1. I need some help. I screwed up and downloaded a bad file and now after 3 days of running different spyware programs I am still getting popup windows, even when I do not have any windows open. trend microspyware keeps stopping a site called a-d-w-a-r-e, or ad-w-a-r-e, or adw-a-r-e(get the pic),
    keeps changing.
    HiJack this log is attached.

    Thsnks greatly,

    Attached Files:

  2. pcaceit

    pcaceit TS Rookie Posts: 315


    this log entry seems suspicious to me

    try spybot S&D or Adaware (both free)

    they will deal with this.

    empty your temp internet files, temp files, prefetch, system restore, and check your BHO's. reset your default homepage ect.. form internet options.

    if you dont know what wildtangent is... then i suspect that this is the culprit
    use search and delete the HTML file.

    if you need more instruction get back to me
  3. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Boot into safe mode, and turn off system restore.

    Run HJT with no other programmes opn, and let HJT fix the following.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://armstrongmywire.com/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://armstrongmywire.com/index.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - Default URLSearchHook is missing

    O15 - Trusted Zone: http://*.billingnow.com
    O15 - Trusted Zone: http://*.reliablestats.com
    O15 - Trusted Zone: http://*.winantispyware.com
    O15 - Trusted Zone: http://*.winantivirus.com
    O15 - Trusted Zone: http://*.winantiviruspro.com
    O15 - Trusted Zone: http://*.winfixer.com
    O15 - Trusted Zone: http://*.winnanny.com
    O15 - Trusted Zone: http://*.winsoftware.com

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121116803812
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126326222679
    O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
    O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

    O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\h60qlgd5160.dll

    Close HJT.

    Boot into normal mode, and turn system restore back on.

    Get some antivirus, and firewall software, such as AVG free, and the free Zonealarm.

    Regards Howard :wave: :wave:
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...