Virus Pop-ups!!!

[slgrieb]

I can't be sure why you have the problems with the online scan and download Spybot, but I really have to suspect an active infection. Try downloading Spybot on another computer, then go to Safer-Networking and download the detection updates file. Copy the installer and the update file to a pendrive, burn a CD, or whatever, then install Spybot on your computer, and after it is installed, run the update and scan. If you haven't been able to download a trial of NOD32, you should be able to install it the same way.

[CCT]

Personally, I vote for posts 18 and 21!

[classyfashh]

Wow. I got caught up in all this downloading crap that I just realized my computer isn't even being slow anymore at all and the billion pop-ups I usually get are gone.
Hmm. Woohoo! Thanks guys.

[PBase001]

I would delete these entries in HijackThis.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
O21 - SSODL: bmlvqkn - {F473A312-06C5-46BA-88FE-0AAA0D2409DB} - C:\WINDOWS\bmlvqkn.dll (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Unknown owner - C:\Program Files\Canon\CAL\CALMAIN.exe (file missing)

And if you're not running Netware I would also get right of this...
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

If the following entry comes back after a reboot than you probably still have some kind of infection.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2

[classyfashh]

Oh thanks. Ohkay I deleted R0 and 021. But I actually have that camera so I don't know if I should delete the other one. And I tried deleting 010 but for some reason it won't let me and it keeps showing up in the scan. Hmm.

[CCT]

You probably will NOT get rid of nwprovau.dll unless you use LSPFix ; even then, that dll will be on your comp since it is legitimate BUT LSPFix gets it out of that 'alert' condition (as said above, if not using NetBios you don't need it in your LSP thingie).

http://www.majorgeeks.com/download4180.html

It will list some stuff in the left panel - click on the nwprovau.dll and then on the >> and when it appears in the right hand panel, make it so!


edit: small correction exe to dll and this added note:

While doing this for my comp, I found that running WinsockFix restored the nwprovau.dll to my LSP thingie.

[classyfashh]

Alrighty. Done!
Do I have to use WinsockFix to restore it or no?

[loraandbush]

Try latest antivirus.

[Niclo Iste]

Try latest antivirus.

Not sure that's totally a productive yet obvious answer. It would amount to suggesting to a drowning victim "just swim". One could go further and say don't get online and don't use any disks. Try suggesting a good virus scan or a solution that would be detailed in the removal of such infections. It's a lot more helpful to the users.

[JudaZ]

try smitfraudfix and run it from safe mode, fixes almost all of the "you have a virus fakr popups"