Help With Popups, Adware, Viruses! New Here!

[Nutmeg]

Hi,

Thank you so much for your site. I have been experiencing problems. Here is a rundown of what's happening.

I've had tons of popups. I have run Adaware and Spybot S&D. Both found problems, even after deleting those listed, the popups continue.

Also, my Notepad and Windows Media Player programs were suddenly changed. The programs were still there, but the icons were changed to the generic Windows icon (white screen). I reinstalled both, but the icons still keep changing back. Looking in the Media Player folder, I found tons of weird things such as msbb, mprocessor, bikinidesk, ebatesmoneymaker, etc. I ended up deleting the entire folder and re-reinstalling Media Player from Microsoft. The only item remaining that I could NOT delete was MPlayer2.exe. The other strange items in the folder are now gone, but I want to make sure that it is fixed.

I had several trojans in my Restore folder. I followed some instructions I found (using "Disable System Restore") and that reduced the folder size from 2.5 GB back down to 15 MB. The strange thing there is that that Restore folder is already back up to 30 MB today. This might be normal, but I wanted to make sure that is fixed. A scan from House Calls did not detect the trojans again after the fix I tried.

One more thing that kinda concerns me. I read somewhere that when RUNDLL.32 starts showing up in your programs list (by pressing ctrl, alt, del) that this could signal problems. Although I understand that this is a normal and necessary program, it has suddenly started appearing in my list constantly. To worry or not?

Here is my HijackThis log. I sincerely appreciate any help, advice, and insight.

Susan

Logfile of HijackThis v1.97.7
Scan saved at 11:56:54 AM, on 7/1/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\INSTALLATION FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: AOL Toolbar (HKLM)
O9 - Extra button: ComcastHSI (HKCU)
O9 - Extra button: Help (HKCU)
O9 - Extra button: Support (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37871.4787731481
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX25.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_41.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

[Nutmeg]

By the way....I just ran Spybot S&D twice. It keeps finding something called:

Look2Me

It says it fixes it, but still finds it on the next scan.

Susan

[Dexter]

To be honest, I can't find much fault with this log. There is one item you could clean up, as it is associated with LimeWire, which does install spyware:

O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm

If you are running LimeWire, you should uninstall it, as spyware is part of the installation.






I've had tons of popups. I have run Adaware and Spybot S&D. Both found problems, even after deleting those listed, the popups continue.



Do you get popups when you browse legitimate sites? For instance, if you were to spend 15 minutes here at Short-Media, and click pn a bunch of different forums and threads within our site, will you get popups?




Also, my Notepad and Windows Media Player programs were suddenly changed. The programs were still there, but the icons were changed to the generic Windows icon (white screen). I reinstalled both, but the icons still keep changing back. Looking in the Media Player folder, I found tons of weird things such as msbb, mprocessor, bikinidesk, ebatesmoneymaker, etc. I ended up deleting the entire folder and re-reinstalling Media Player from Microsoft. The only item remaining that I could NOT delete was MPlayer2.exe. The other strange items in the folder are now gone, but I want to make sure that it is fixed.


Mplayer2.exe is a legit file:

http://www.liutilities.com/products/wintaskspro/processlibrary/mplayer2/



I had several trojans in my Restore folder. I followed some instructions I found (using "Disable System Restore") and that reduced the folder size from 2.5 GB back down to 15 MB. The strange thing there is that that Restore folder is already back up to 30 MB today. This might be normal, but I wanted to make sure that is fixed. A scan from House Calls did not detect the trojans again after the fix I tried.



This is normal. The system restore saves backups of your System Folder, up to a specified space limit. You can adjust how much maximum space SR uses in the SR control panel. As you install software, Windows updates, etc, this folder will grow.



One more thing that kinda concerns me. I read somewhere that when RUNDLL.32 starts showing up in your programs list (by pressing ctrl, alt, del) that this could signal problems. Although I understand that this is a normal and necessary program, it has suddenly started appearing in my list constantly. To worry or not?


Rundll32 can be a legit process, but also can be hijacked by viruses, trojans, etc. It is important to keep an eye on how many you have in your process list, then match them up to startup items. In your case, it matches up to:

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

Which is your Power Management Configuration manager. So this item is not a problem in your case.

Please let me know about the popups, if you are still having problems you may need to post a more detailed "startup log" from HJT.

Dexter...

[Dexter]

By the way....I just ran Spybot S&D twice. It keeps finding something called:

Look2Me

It says it fixes it, but still finds it on the next scan.

Susan


It is probably detecting a stray registry entry, as it does not appear that Look2Me is active on your system. Click here:

http://www.spywareinfo.com/~merijn/downloads.html

And download Kill2Me. Run it and let it fix whatever it finds. Then see if you get the entry some up on your next Spybot scan.

Dexter...

[Nutmeg]

Dexter,

Thanks so much! I ran a program that killed the Look2Me stuff and the popups have stopped. They weren't ordinary ads that happen when you visit certain sites. They were the real annoying ones that opened one right after the other even when you weren't at a site. On my next Spybot S&D scan, it didn't find it at all. I think that problem is now solved.

I deleted the 08 Limeshop entry, so I believe I am doing just fine. I think that when I tried to reinstall Windows Media Player that I must have installed it from some site that isn't so legit. That folder was FULL of adware, spyware, etc. After deleting all that stuff and downloading a clean copy from Microsoft, that seems ok, too.

I just can't figure out why the media player icon keeps changing back to the generic Windows icon (white computer screen icon). The program works fine even when clicking on that weird icon, so I guess I will just not worry.

Thanks soooooo much, Dexter!

Susan

[Dexter]

You are very welcome. I recommend you also go here:

http://www.panicware.com/product_psfree.html

And download the Pop-Up Stopper FREE Edition. It will help you with normal popups as well.

Feel free to hang around here, we have a great site with lots of great & knowledgeable folks. :)

Dexter...

[Duality76]

Hey, I can't open that kill2me link thing? What else can I try to get it?

[profdlp]

Hey, I can't open that kill2me link thing? What else can I try to get it?


Try here. (http://www.majorgeeks.com/download4166.html) :)

[Duality76]

Thanks profdlp :)