popups

[Hamilton]

anybody besides me getting tile related popups while clickin around in here?

[Sponsored Links]

[RLeVan]

I'm not seeing any pop-ups Jack w/ Firefox. What browser are you using?

[Splinter]

What you will not find are screens popping up all over the place and other obnoxious interruptions. This site is a breeze.

The above is taken from Mr. Bridge's homepage, so I'd imagine the popups are not the fault of this site. Instead, you may have some unknown software on your computer that is causing it. Download Ad-aware from www.lavasoft.com to do a scan of your computer.

[Hamilton]

Thanx guys :bow:

[davem]

If there are popups we're not causing them or getting paid for them.




Wait a sec. Flatfloor! :mad:

:D

[RLeVan]

If that doesn't fix the problem, you can use a nifty program called Hijack This (http://www.spywareinfo.com/~merijn/index.html)

Once you run the program, it should copy the results to a clipboard. Post the results here if you are still having a problem.

[Hamilton]

I forgot about hijack this.... damn. thanx for the link, i love this prog.

[Mike2]

Jack, we do get this swamp creature popup from time to time. :D

[Hamilton]

I usually use Panda antivirus online scan. It will find everything being an
outside source and not controlled by virus's on board. But there are 2 files
it cannot disinfect. Ive tried using my ztree to delete the 2 files from my
pc manually after reading the scan report. I still feel i may be in for a total
reinstall of windows soon. Each time i run my scan panda detects numerous
spyware programs as well as viruses... and there are always 2 that do not
go away and in a short period of time im back to the same old hassle.
Im gonna give hijack this a run, ive had great results with it in the past.
dangerous program if misused, but it finds everything.

[Hamilton]

Rick as to your advice i will post hijack this results here although it may
be more appropriate to do this in computer training... i dont think this should
offend anyone in a major way, next time i will take this across the board.
If any mods want to move this thread i understand entirely...
Jack

Logfile of HijackThis v1.99.1
Scan saved at 8:45:31 PM, on 2/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime Alternative\qttask.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\system32\NMSSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jack\Desktop\resized photos\HijackThis.exe

R3 - Default URLSearchHook is missing
O1 - Hosts: lineage2-unlimited.com L2authd.lineage2.com
O2 - BHO: bitlocker - {01EB5130-FC0C-4d75-B9CE-4801B1B854F5} - C:\WINDOWS\system32\nsj43.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5F543EEC-7E3A-9F2B-25D1-B85F9C780EF4} - C:\WINDOWS\ihnjpiyt.dll (file missing)
O2 - BHO: (no name) - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINDOWS\DH.dll (file missing)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll
O3 - Toolbar: Search - {CAE59CFA-1CAB-B6A7-1C17-8A546DDBCB3F} - C:\WINDOWS\ihnjpiyt.dll (file missing)
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll (file missing)
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Outlook Mail Services] express.exe
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c566.cab
O16 - DPF: {CA356D79-679B-4B4C-8E49-5AF97014F4C1} - http://files-pl.starware.com/installs/4.0.0.200511081803/ReleaseProduction/323/Starware_323.cab
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\qcyplbv.exe (file missing)

[RLeVan]

This may get ugly. Any file with an obfuscated name (i.e. random letters) can be troublesome.

You may need to run HiJack this again and repost the results after I tell you what to delete.

Here is what you want to get rid of:

O2 - BHO: (no name) - {5F543EEC-7E3A-9F2B-25D1-B85F9C780EF4} - C:\WINDOWS\ihnjpiyt.dll (file missing)

O2 - BHO: (no name) - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINDOWS\DH.dll (file missing)

O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll

O3 - Toolbar: Search - {CAE59CFA-1CAB-B6A7-1C17-8A546DDBCB3F} - C:\WINDOWS\ihnjpiyt.dll (file missing)

O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll (file missing)

O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe

O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com

O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zan...bridge-c566.cab
O16 - DPF: {CA356D79-679B-4B4C-8E49-5AF97014F4C1} - http://files-pl.starware.com/instal...tarware_323.cab

O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\qcyplbv.exe (file missing)

Once you clean these, reboot and see if any files came back.

[Hamilton]

Thanx Rick. Ill give it another run and follow your advice. I used to be able
to tell at one time. so much crap is loaded against my will these days ive
forgotten what should be running and what shouldnt.

[muskymike]

Yeah Jack, something is up with your puter, I have NEVER hadda popup on this site.
Oh, besides the swamp creature. :lol1:

[Shaughnn]

When I tell people about this site, I make a point of saying that i've never gotten spam from it in the couple years I've been hanging out here. What sort of 'tile related pop-ups" are they Jack? Any from our friends in China?
Shaughnn

[Hamilton]

Ive actually gotten popups from Tile related sites. advertisements for sealers
and other products. i have always been annoyed so i havent taken full notice
i click them off. Im pretty sure its not the sponsors for the site though. Its
gotta be some 3rd party crap. heres what i got when i ran the fix for hijack
this. i still gotta reboot. i couldnt copy this into notepad sorry rick it wouldnt
let me. hope you can read it.

[RLeVan]

Have you tried the LSP Fix? I tend to trust HiJack this error messages more than regular popups. SpyBot Search & Destroy (http://www.safer-networking.org/en/index.html) It will probably have the same error, but it's another good prog to have in your arsenal against this junk.

Here's your LSP-Fix (http://www.cexx.org/lspfix.htm) if you don't have it yet.

Sorry it took so long to reply. :cool:

[Hamilton]

Heres the new scan after relog.....

thanx for anylizing for me :yipee:

Logfile of HijackThis v1.99.1
Scan saved at 9:43:09 PM, on 2/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime Alternative\qttask.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jack\Desktop\resized photos\HijackThis.exe

R3 - Default URLSearchHook is missing
O1 - Hosts: lineage2-unlimited.com L2authd.lineage2.com
O2 - BHO: bitlocker - {01EB5130-FC0C-4d75-B9CE-4801B1B854F5} - C:\WINDOWS\system32\nsj43.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5F543EEC-7E3A-9F2B-25D1-B85F9C780EF4} - C:\WINDOWS\ihnjpiyt.dll (file missing)
O2 - BHO: (no name) - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINDOWS\DH.dll (file missing)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll
O3 - Toolbar: Search - {CAE59CFA-1CAB-B6A7-1C17-8A546DDBCB3F} - C:\WINDOWS\ihnjpiyt.dll (file missing)
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll (file missing)
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Outlook Mail Services] express.exe
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com

[Hamilton]

I still see a few things .. as before with the panda scan theres something
embedded deep that wont go.

[RLeVan]

Have you tried the LSP-fix and SpyBot?

Look for cleaning 180Solutions crap off your comp. That's your Zango problem, and they have been known to be less than honest if you asked them to remove their software.

I'll do a couple searches and see what I can do.

[RLeVan]

Removing WebHancer (http://www.cexx.org/webhancer.htm)

Zango Fix (http://forums.spywareinfo.com/index.php?showtopic=62158&hl=180search)

Wiki Remove Zango (http://en.wikipedia.org/wiki/Zango_Messenger)

[Hamilton]

:scratch: If a person cannot legally take what he wants from the internet, such
as media etc, why is it legal for companies to forcefully upload programs and
control my computer. I visualize some major class action lawsuits in the future. Maybe i am blind to any already happening but this just SUX lol.

[RLeVan]

You can thank the DMC and Can-Spam act for that. If it were up to me, I'd take a club to every person that tried to put spyware on my computer.

Hopefully we can get your comp clean.

[Hamilton]

There are 4 things that come up in the lsp fix and im not sure what to remove
if any, again im unable to copy the list.

[RLeVan]

Can you do the 'ol pen and pencil copy and paste? We're getting there.

[Hamilton]

MSWSOCK.dll TCIP
winrnr.dll NTDS
webhdll.dll [Protocallhandler]
rsvpsp.dll [Protocallhandler]

[RLeVan]

MSWSOCK.dll TCIP - this one is okay

winrnr.dll NTDS - this one is okay too

webhdll.dll [Protocallhandler] - this is one you don't want. Here's how to remove it manualy. Remove (http://www.spywareguide.com/product_show.php?id=26)

rsvpsp.dll [Protocallhandler]- this should be okay from what I can tell right now.

Are you still getting the popups?

[Hamilton]

Ill try the lsp first, and as i type popups.... hmmm. I guess ill have to refer
back to this thread tomorrow and remove manually. just used the lsp program
but i got popups... took a screen of the popup ill post just for proof before
i log off

[Hamilton]

i dont know how or why but this is what im getting and like i said before
these dont appear to be affiliated with this site, maybe some kind of
keylogger has gotten to my system......

[RLeVan]

Let me look into it a bit more, we'll get ya fixed by tomorrow.

[RLeVan]

Here is an interesting read:

Zone Alarm vs. 180SolutionsZone Alarm vs, 180Solutions (http://news.yahoo.com/s/cmp/20060131/tc_cmp/177105408)

Your Zango Problem (http://www.180solutions.com/Press/ReadArticle.aspx?id=12)

Note they are headquarted in Bellevue, WA.

[Hamilton]

I did the manual removal through the control panel. I had the energy for
that. tomorrow eve i will run through my system tree and delete the other
recommended files. I like ztree for these kinds of things. Im still faced with
a couple files that wont be deleted. Ive lost the log from the last scan by
panda Im sure i can find it at any rate.. there were 2 files that could not be fixed.When i went into ztree
suprisingly ztree couldnt remove them. I still think it may simply be time
for my yearly reinstall of windows.

[RLeVan]

Arghh, I hate that. What browser are you using?

[Hamilton]

IE 6 i know i should use fox, and i have in the past.... no excuses lol.

[RLeVan]

Firefox won't fix your problems but ActiveX controls in IE6 add to them. Sorry that you had to put up with the dirtier side of marketing on the internet.

[Hamilton]

nothin new man, i appreciate your help though. Im not a total noob but
this stuff gets pretty in depth. if i could only post all the popups .... lmao
i just had another one. a search engine for tile and granite hahahah ohhh
this is funny. my affair with the internet is a love hate relationship lol. :devil2: