Printable View
It's not shared.Quote:
Originally Posted by Prince Abaddon
I downloaded Spybot and got rid of a few things.
The XXX pop ups seem to have stopped, but i am getting normal pop ups from random sites, one being google.
The url to the pop up i got there was
http://ilead.itrack.it/clients/ileve...&scriptid=4179
I'll run that Hijack thing in a sec.
I just got a pop up when i hit reply on that msg too, again from that same site.Quote:
Originally Posted by houllier*
Ok, i just ran that hijack program, here is the log.
Logfile of HijackThis v1.97.7
Scan saved at 19:25:20, on 29/01/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DSLAGENT.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MIRC\MIRC.EXE
C:\PROGRAM FILES\WINAMP\WINAMP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\DAP\DAP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thedugout.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchwww.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com
O2 - BHO: (no name) - {F4A27D22-E603-4B1B-B8D0-1CF7D57E56F2} - C:\PROGRAM FILES\NETLEECH\IEEXT.DLL (file missing)
O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file)
O2 - BHO: (no name) - {83AF6426-DBF4-7081-BB93-1A86DE45FDEB} - C:\windows\system\mlqssgyq.dll
O2 - BHO: (no name) - {EAAD478F-5FD5-A78F-53CC-6B794AB810A5} - C:\windows\system\qzsqdabw.dll
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [bin32hpu] C:\PROGRAM FILES\PPSTUB\PPSTUB.EXE -run
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d...ll/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...999.5325925926
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_44/QDow.cab
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/98ME/bridge.cab
O16 - DPF: {A0F0D762-D1DE-43AF-B70E-D87864743EB3} (NSLiteUpdateCtrl Class) - http://217.145.76.16/nslite/nslite.cab
O16 - DPF: {086A694F-91FB-4068-B44C-124FB69BF05D} - http://www.searchwww.com/search.cab
What's the best way for me to get MORE XXX popups on my computer? :devil:
Send it home with our head finance guy for his teen age son to use. Oh, wait, maybe that's company specific.....Quote:
Originally Posted by meatwad
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thedugout.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchwww.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com
O2 - BHO: (no name) - {F4A27D22-E603-4B1B-B8D0-1CF7D57E56F2} - C:\PROGRAM FILES\NETLEECH\IEEXT.DLL (file missing)
O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file)
O2 - BHO: (no name) - {83AF6426-DBF4-7081-BB93-1A86DE45FDEB} - C:\windows\system\mlqssgyq.dll
O2 - BHO: (no name) - {EAAD478F-5FD5-A78F-53CC-6B794AB810A5} - C:\windows\system\qzsqdabw.dll
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
IE Toolbars and BHO's....
Download and install Spybot. Do an immediate update. It should catch and allow you to remove those.
http://security.kolla.de , downloads to the left.
For 3X popups, I suggest the ILookUp (aka GlobalSearch) toolbar. Also a pain in the butt to get rid of. One of those searchbars that is capable of drive-by installation. Also a good bet as the culprit in houllier*s trouble. Check out http://www.spywareinfo.com/toolbars/ for a listing of registry keys associalted with toolbars of all sorts.
I have had better luck with SpyHunter for removing toolbars and such than even SpyBot and AdAware. The free trial download will list all spyware detected and the associated registry keys if you want to do a manual removal. "Course, if you have a couple of hundred keys to remove the $30 for the full version may not look too bad. You can download it at http://www.enigmasoftwaregroup.com/
Since you've already run SpyBot, do as Doc says and make sure you download the latest updates as well. He nails it with aaalllll those searchbars and malware which in fact are why you get allll those popups, but one more needs mentioning: DAP.exe. Download accelerator is crapware and is really buggy and should be gotten rid of.
PS
I wonder what your log would have looked like a few days ago.https://forums.windrivers.com/images.../2005/03/1.gif
EDIT
Download the Google toolbar to replace all those junk ones: and it contains an effective popup stopper for freee!!!
Check Add/Remove Programs for anything nCase and CommonName, and un-install them. I know that nCase connects to a web site to install. Not sure about CommonName.
Check out this site for help finding programs that loading at startup:
http://www.answersthatwork.com/Taskl...s/tasklist.htm
Another thing to try if running XP is SFC /purgecache then SFC /scannow from "RUN".
And stay away from P2P software unless you know that the one you are using is ad-ware free. Good luck finding that! K++ is getting harder and harder to find.
Ummm. I think this one has been all taken care of Snowman.https://forums.windrivers.com/images.../2006/04/1.gif He is now left with only searchbars and some leftover crap. No need for SFC any longer.Quote:
Originally Posted by SnowBlindGrafix
That "HiJack This" is a really marvelous tool. Do yourself a favor and download it, save it to a disk and run it every so often.
We have encountered problems like this at work. I work in a library and we have public users that do horrendous things with our computers. HiJack This was helpful in getting rid of all sorts of things, that nCase thing included.
:thumbs:
I did, i posted my log above ;)Quote:
Originally Posted by Green_Eyed
I haven't had any pop ups for last couple of days so it all seems to be ok now, i got rid of everything you said and seems fine.
Thanks all for your help.
And THAT is the important thing. https://forums.windrivers.com/images.../2006/04/1.gif Now: keep the crap off, right houllier? Good luck: now YOU know how to help others, right? https://forums.windrivers.com/images.../2005/03/1.gifQuote:
Originally Posted by houllier*
If you run a firewall or ad blocking you can block these and this has worked for me.
62.146.88.105 ilead.itrack.it :thumbs:
Mark
Welcome to Windrivers Logan
Some "ad blockers" are the worst spyware
Spybot immunise is quicker off the mark, and its easy to add them to the host file as 127.0.0.1
No idea why you put up that ip and fqdn, there is no authorisation to view.