Pop up problem

[staabie66]

So I downloaded a program and It didn't work right so I just deleted it. So now I keep getting pop ups which I never get, I wont even be surfing the web and all of a sudden I get like 2 to 5 pop ups every 2 minutes. I download Ad-Ware thinking that might help and it says theres this mycoolweb or somthing that keeps getting reinstalled after I delete it. How can I get rid of all these pop ups its really annoying? Thanks in advance

 

[yankeesfan]

http://www.intermute.com/spysubtract/cwshredder_download.html

 

[Captante]

Spybot Search & destroy is free & very effective at removing "cool web search", after running the scan & removing it, make sure you also go to the "immunize"
step & it should be prevented from re-installing itself.

 

[staabie66]

Thanks for the help, the cwshredder didnt work I think because there was no mycoolweb stuff. I used spybot and checked it and found some problems, I tried to immunize them but it said there was no problem or somthing like 0 bad checks, the problems it found are:

Advertising.com
Alexa related
avenue A, Inc.
Double Click
FastClick
MediaPlex
Targersaver
ValueClick

and there is still pop up ads going on please help they are really annoying

 

[simms]

Aurora?? It probably is Aurora. Do you have a program called Nail.exe running? Aurora is worse than CWS to get rid of..

Here: http://www.geekstogo.com/forum/Aurora_spyware_Nailexe-t24344.html

Welcome to GTG.

Download Ewido Security Suite at http://www.ewido.net/en/download/

Update its database at http://www.ewido.net/en/download/updates/

Run a scan and let it clean the computer.

**Note** DO NOT REBOOT the computer during the removal process. If you do the filenames will change. If you can't leave the computer on now, I suggest not running the logs below yet. Wait until you can leave it on.

Download FindIt's.zip to your desktop: http://forums.net-integration.net/index.ph...=post&id=142443

1. Unzip/extract the files inside to a folder on your desktop.
2. Open the folder. Double click on FindIt's.bat and wait for Notepad to open a text file. It will take a while so please be patient ...
3. Then post the results here along with the new HijackThis log.

 

[staabie66]

Where can I find this FindIt's.zip program the link doesnt work and I tried googling it and nothing. Plus I already ran the first part, i mean i dont have to reboot my computer or anything but where can i get the program?

 

[Sphexi]

HijackThis is also a good program, but a little more advanced. I'd say run it, post the results here, and we can help you with the rest.

 

[staabie66]

I think I did this right if I didnt post the right thing tell me what to put please. Also is it safe to restart my computer or what? Thanks again

Logfile of HijackThis v1.99.1
Scan saved at 10:28:13 PM, on 11/6/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Wireless-G Portable USB Adapter\WLService.exe
C:\Program Files\Wireless-G Portable USB Adapter\WUSB54GP.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Logan\Desktop\HijackThis.exe

O1 - Hosts: re.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AnyDVD] "C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\mxr2cenu.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: WUSB54GPSVC - Unknown owner - C:\Program Files\Wireless-G Portable USB Adapter\WLService.exe" "WUSB54GP.exe (file missing)

 

[Captante]

HijackThis is a good program too... sorry Spybot didn't help, its decent considering its free but doesn't get everything.
I've had the best luck running a combination of anti-spyware programs, so the best advice I can give you is listen to other folks suggestions & keep trying different programs until one works for you... once your clean, you might consider snagging the paid version of Spysweeper which is currently the highest rated & Counterspy is also very effective.

 

[Iron Woode]

You may be a victim of Windows Messenger Service.

Either terminate the service or download Shoot the Messenger from http://www.grc.com

If you are doing any serious adware cleaning, turn off System Restore before hand. Then turn it back on when system is clean.

 

[staabie66]

Thanks to everyone for the help, also I have never used windows messaging or AOL. The problem all started when I was downloading a patch from a crack, keygen website so if that matters thats where it all started. Please help, thanks again.

 

[Iron Woode]

Originally posted by: staabie66
Thanks to everyone for the help, also I have never used windows messaging or AOL. The problem all started when I was downloading a patch from a crack, keygen website so if that matters thats where it all started. Please help, thanks again.

Windows Messenger Service is an winXP only thing.

Sort of like a built in IM client, only it can be used to spam people with pop ups.

Download the Shoot The Messenger to make sure the Service is killed.