adware/spyware help

[c note]

I know this has been posted in the past. Does anyone know where I can find a good adware/spyware program that is free? I am gettiing tons of crap pop ups on my computer even though I have a pop up blocker. I also think my computer is runing very slow.

Thanks for your help in adavnce

 

[MadJack]

http://www.lavasoftusa.com/software/adaware/

 

[Beebs]

also try spybot search and destroy. you can find it at download.com
I too have been getting more pop ups lately that my google toolbar seemed to not let through in the past

 

[DR STRANGELOVE]

you may also want to download the following:

http://www.javacoolsoftware.com/spywareblaster.html
click on > Download SpywareBlaster 3.5.1

also, ewido.com

also, do a google search under "atf cleaner" download the program, it will delete stuff that other cleaners won't find

also google "ccleaner"
also google "crap cleaner"

 

[c note]

thanks gentleman!!

 

[danmurphy jr]

What operating system are you using. MS has adequate system tools to free up space and lose popups

 

[dirty ernie]

you may also want to download the following:

http://www.javacoolsoftware.com/spywareblaster.html
click on > Download SpywareBlaster 3.5

Thanks for that link DR. This Spywareblaster is a very good cleaner.

 

[DR STRANGELOVE]

it is more of a blocker than a cleaner. THe other programs are good cleaners.

 

[Padre]

Dr Strange

I have noticed that in most of my free porn sites , i have been getting alot of pages that will open some lame ass google search, mainly the BangBros web sites.

U know when u can mouse over a thumbnail and see the address, ex: www.ballhoneys.com/brangbrosnetwork/marie2.index

that site is not valid , its just that on most of them that r like that will open in new window , search for awhile, then just simply redirect to some google search for gay cum or something like that.

is it a virus on my end or maybe someone has sabotaged their server.

 

[DR STRANGELOVE]

go to
http://www.ewido.net/en/

then click on scan now, say yes to install active x, then do a complete scan.
let it do its thing, save a report and post it back on here.

I have a feeling you have a trojan

 

[Padre]

DR strange, i did run it and only had 2 problems , and i have ran all the cc cleaners, spysweeper, avg antivirus, spybot, spyblaster, regcure, ad aware. and have virtually cleaned everything.

Been at it all day.

But i still have that google problem.

Maybe u could try this site and tell me if it happens to u as well, please.

www.blackbarbara.com

there are others that it does to me as well, but this 1 is the most.

not the usual pop ups or redirects. u kniow to other sites that r partners. but does certain thumbs that take u to some useless spyware site, or to a google search for some crap.

please give it a try. and moderaters please let this one site go through, so that he may help me.

I am not advertising for this site, hell i dont really like it that much, i just like to get my latina fix thas all. :142smilie

 

[DR STRANGELOVE]

DR strange, i did run it and only had 2 problems , and i have ran all the cc cleaners, spysweeper, avg antivirus, spybot, spyblaster, regcure, ad aware. and have virtually cleaned everything.

Been at it all day.

But i still have that google problem.

Maybe u could try this site and tell me if it happens to u as well, please.

www.blackbarbara.com

there are others that it does to me as well, but this 1 is the most.

not the usual pop ups or redirects. u kniow to other sites that r partners. but does certain thumbs that take u to some useless spyware site, or to a google search for some crap.

please give it a try. and moderaters please let this one site go through, so that he may help me.

I am not advertising for this site, hell i dont really like it that much, i just like to get my latina fix thas all. :142smilie

no google problem here on my end.

do the following

copy and paste the following into browser:

http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item5

Save HJTsetup.exe to your desktop.

Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required

 

[Padre]

Here ya go

Logfile of HijackThis v1.99.1
Scan saved at 2:18:40 AM, on 7/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\mcafee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB002" /M "Stylus CX3800"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Start McAfee.com Personal Firewall.lnk = C:\Program Files\mcafee.com\Personal Firewall\MpfTray.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136332581813
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137545754943
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0843D975-93E2-43CB-AFD3-24626036198A}: NameServer = 85.255.115.27 85.255.112.181
O17 - HKLM\System\CCS\Services\Tcpip\..\{85F3E72E-CCCC-4EC8-B47C-E9E96B17489B}: NameServer = 85.255.115.27,85.255.112.181
O17 - HKLM\System\CCS\Services\Tcpip\..\{A52D0962-1544-482C-A907-34DF4ACCFE59}: NameServer = 85.255.115.27,85.255.112.181
O17 - HKLM\System\CS1\Services\Tcpip\..\{0843D975-93E2-43CB-AFD3-24626036198A}: NameServer = 85.255.115.27 85.255.112.181
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ILT - Unknown owner - C:\WINDOWS\ilt.exe (file missing)
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com - C:\PROGRA~1\mcafee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

 

[KMA]

Spybot S&D - http://www.spybot.info/en/mirrors/index.html
and
LavaSoft Ad-Aware SE - http://www.lavasoft.de/support/download/

The two together serve yah well. What one doesn't catch, the other will., and yah should be running them at least once a week to stay clean. Also, remember to UPDATE UPDATE UPDATE!!!


You can also use:

Microsoft Windows Defender.



STAY AWAY from Google, it is FULL of spyware!!!


It's really not cool for people to suggest others go into their registry, UNLESS the first person knows well what they are doing. To repost the problems of others to a third party or a third website is asking for problems!!! It's not really a good way of clearing things up.


With all due respect, some people would do better sticking to what they seem to know about, like posting pics of chicks!!! *L*

 

[bsucards]

Limewire probably has some backdoor stuff installed on your system, that is about the only thing that I saw that looked real bad besides Wincap


Here is the link for Defender:
http://www.microsoft.com/athome/security/spyware/software/default.mspx

Google, does a lot of data tracking, and reports info back home to google, I guess that does make it spyware, but I don';t think it is that bad really.

 

[DR STRANGELOVE]

Spybot S&D - http://www.spybot.info/en/mirrors/index.html
and
LavaSoft Ad-Aware SE - http://www.lavasoft.de/support/download/

The two together serve yah well. What one doesn't catch, the other will., and yah should be running them at least once a week to stay clean. Also, remember to UPDATE UPDATE UPDATE!!!


You can also use:

Microsoft Windows Defender.



STAY AWAY from Google, it is FULL of spyware!!!


It's really not cool for people to suggest others go into their registry, UNLESS the first person knows well what they are doing. To repost the problems of others to a third party or a third website is asking for problems!!! It's not really a good way of clearing things up.


With all due respect, some people would do better sticking to what they seem to know about, like posting pics of chicks!!! *L*

KMA<

thanks for your constructive criticism. Do you think I would be the one looking at his reigistry??? It will be reviewed by an expert at the following forum
forums.techguy.org (security section)


Padre, here is the link to your log.

Here ya go

http://forums.techguy.org/security/481730-friends-hjt-log-please-help.html#post3768162


I highly recommend that everyone do a HJT scan and post their log at that forum to get some feedback by experts. As you can see there are many posts on a daily basis and these guys are very helpful.

http://forums.techguy.org/54-security/

 

[DR STRANGELOVE]

I forgot to mention they are quick...

Hi, fliime

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download FixWareout from one of these sites:

http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/file...Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.

The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

Once the desktop loads a text file will open (report.txt), you can close it - the file has already been saved.

Run HijackThis. Click "Do a System Scan Only", and place a check next to the following items (if found):

O17 - HKLM\System\CCS\Services\Tcpip\..\{0843D975-93E2-43CB-AFD3-24626036198A}: NameServer = 85.255.115.27 85.255.112.181
O17 - HKLM\System\CCS\Services\Tcpip\..\{85F3E72E-CCCC-4EC8-B47C-E9E96B17489B}: NameServer = 85.255.115.27,85.255.112.181
O17 - HKLM\System\CCS\Services\Tcpip\..\{A52D0962-1544-482C-A907-34DF4ACCFE59}: NameServer = 85.255.115.27,85.255.112.181
O17 - HKLM\System\CS1\Services\Tcpip\..\{0843D975-93E2-43CB-AFD3-24626036198A}: NameServer = 85.255.115.27 85.255.112.181


Click FIX CHECKED. Close HijackThis.

Finally, please post the contents of the text file that opened earlier (you can find it at C:\fixwareout\report.txt ), along with a new HijackThis log into this topic.

 

[Padre]

Thanks boys,

but i think i have narrowed down my problem.

I have ran nearly all the free anti-virus stuff i could get my hands on.

AVG 7.1 antivirus
SpyBot
Spysweeper
Ewido Anti spyware
Karperisky Anti-virus 6.0
Ad Aware.

I even did at the Dr.'s request the Karperisky online scan. and cc cleaner.

Thus i am back at the same problem.
I have noticed that these viruses attack many things . I was unable to view my MLB.TV due to some virus in my Media player. I simply downloaded it again and reinstalled it. It now works good.

So i have noticed that maybe my problem maybe in my browser and not the harddrive.

Reasoning is that when i first open IE 6.0 it takes nearly 1 to 2 mins to open. Only to research why?

I have nearly 18 add-ons that i think near to load first. WAY to many. After checking my add-ons, mostly antivirus stuff that has tagged along after my exhaustive virus hunt.

So i have now downloaded the new 7.0 beta 3 version and will install it over the 6.0 to see if that helps. If not then i will proceed to uninstall 6.0 and reinstall 7.0 to see if this clears things up.

suggestions?

 

[DR STRANGELOVE]

Padre, stay away from IE, you are better off with Mozilla.

Also, there has been a response to you HJT log from one of the experts at the security forum.

You may want to register at that site and post in the above thread that I created for you.

The people there are better suited to help with your needs than anyone here.

 

[Padre]

THX DR

i did see that u and i posted nearly the same time.

i have followed their instructions. The problem has been minimized considerably.

Before i did what they needed , i would get that insurance/google search crap about 50 to 60% of teh time. Now it is about 5 to 10%. although it didnt take care of it totally, it was been an improvement, and the speed at which i surf has increased.


BTW i am routing for ya all the way on the boys from the boot country.

Although i think France maybe better suited to win.