1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Pop up(virus?) that won't go away- http://ib.adnxs.com/pop?enc

Discussion in 'Windows - Virus and spyware problems' started by jmk1011, Sep 3, 2012.

  1. jmk1011

    jmk1011 Member

    Joined:
    Mar 24, 2007
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    11
    Hello folks... I am experiencing a "pop-up" that I can't get rid off. I can't find it in the registry keys, Malware, Norton, ATF...can't find it. I am including the entire address for this monster as well as Hijack This log file.
    I'm thanking everyone in advance for the help.
    Whole address:
    http://ib.adnxs.com/pop?

    enc=6Ba6EoHqzT_oFroSgerNPwAAAAAAAPA_6Ba6EoHqzT_oFroSgerNP7mkAiSWBPtwFk9ZnlC0-yqW3EJQAAAAAPRnDQAdAgAAHQIAAAIAAAAN8SgAlEECAAAAAQBVU0QAVVNEANACLAEHBAAAIiQAAgQCAQUAAIQApSIioAAAAAA.&cnd=%21giXpzwiO5B0QjeKjARgAIJSDCTADOIeICEAESJ0EUPTPNVgAYJYDaABwigF43gGAAZoCiAHeAZABAZgBAaABCqgBALABALkB6yp7LoTqzT_BAesqey6E6s0_yQGzBjlvtP_EP9kBAAAAAAAA8D_gAQA.&udj=uf%28%27a%27%2C+16620%2C+1346559126%29%3Buf%28%27r%27%2C+2683149%2C+1346559126%29%3B&ccd=%21FwVdLgiO5B0QjeKjARiUgwkgBA..&vpid=45&creative_click=http%3A%2F%2Fwww.arcadecandy.com%2Faj%2F551%2F5361%2FSUBID%2FREQUESTID&referrer=http%3A%2F%2Fib.adnxs.com%2Fpop%3Fenc%3DU8xB0NGqzj9TzEHQ0arOPwAAAAAAAPA_U8xB0NGqzj9TzEHQ0arOP8UXB-W5YZlMFk9ZnlC0-yqP3EJQAAAAAPRnDQAdAgAAHQIAAAIAAAD4sxMAlEECAAAAAQBVU0QAVVNEANACLAEHBAAAFzAAAgQCAQUAAIQAUiUsmAAAAAA.%26cnd%3D%2521GySQHQiS2Q8Q-OdOGAAglIMJMAM4h4gIQARInQRQ9M81WABglgNoAHBCeAKAAVaIAQKQAQGYAQGgAQqoAQCwAQC5AbPbOCPTqs4_wQGz2zgj06rOP8kBuTwk0vWaxT_ZAQAAAAAAAPA_4AEA%26udj%3Duf%2528%2527a%2527%252C%2B15733%252C%2B1346559119%2529%253Buf%2528%2527r%2527%252C%2B1291256%252C%2B1346559119%2529%253B%26ccd%3D%2521HAVKKwiS2Q8Q-OdOGJSDCSAE%26vpid%3D45%26creative_click%3Dhttp%253A%252F%252Faegis.GetValuePlus.com%252FDefaultPage.aspx%253Fnm%253D01lgavw2kwxjab%26referrer%3Dhttp%253A%252F%252Fus.mc1814.mail.yahoo.com%252Fmc%252FshowMessage%253F.rand%253D210744448%2526mid%253D2_0_0_1_469110_ALvVimIAABB6UELcbw2mC2I4XH4%2526fid%253DInbox%26dlo%3D1&dlo=1

    Hijack This Log:
    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 10:18:06 AM, on 9/3/2012
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Citrix\GoToMyPC\g2svc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Citrix\GoToMyPC\g2comm.exe
    C:\Program Files\Citrix\GoToMyPC\g2pre.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Citrix\GoToMyPC\g2tray.exe
    C:\Program Files\Norton 360\Norton 360\Engine\6.3.0.14\ccSvcHst.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Norton 360\Norton 360\Engine\6.3.0.14\ccSvcHst.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\SM1BG.EXE
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
    C:\Program Files\GamesBar\SearchEngineProtection.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Yahoo!\Companion\Installs\cpn1\ytbb.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.my.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: (no name) - {3f2ae504-aa17-4805-90e8-56e48f98731c} - C:\Program Files\BibleTriviaTime_4l\bar\1.bin\4lSrcAs.dll (file missing)
    R3 - URLSearchHook: YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    O2 - BHO: QpBHO Class - {1658D3A1-9E13-4196-A82A-D70D70880F36} - C:\Program Files\Hewlett-Packard\SmartPrint\QuickPrintBHO.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Norton 360\Engine\6.3.0.14\coIEPlg.dll
    O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Norton 360\Engine\6.3.0.14\IPS\IPSBHO.DLL
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: BHO_PROJECT - {9194649F-7143-4308-90C1-D6A35B0E354E} - C:\Program Files\OApps\bho_project.dll
    O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.109\oberontb.dll (file missing)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Norton 360\Engine\6.3.0.14\coIEPlg.dll
    O3 - Toolbar: (no name) - {7abeab51-07be-42c5-89b4-c7f1a3a31816} - (no file)
    O3 - Toolbar: (no name) - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
    O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
    O4 - HKCU\..\Run: [SearchEngineProtection] C:\Program Files\GamesBar\SearchEngineProtection.exe
    O4 - S-1-5-18 Startup: _uninst_41650139.lnk = C:\Documents and Settings\Owner\Local Settings\Temp\_uninst_41650139.bat (User 'SYSTEM')
    O4 - .DEFAULT Startup: _uninst_41650139.lnk = C:\Documents and Settings\Owner\Local Settings\Temp\_uninst_41650139.bat (User 'Default user')
    O4 - Startup: _uninst_41650139.lnk = C:\Documents and Settings\Owner\Local Settings\Temp\_uninst_41650139.bat
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: &Search - http://tbedits.bibletriviatime.com/...7212-4CAE-B1B7-468AADAF0D32&n=2012031400&cv=1
    O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://zone.msn.com
    O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
    O16 - DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} (ZPA_WheelOfFortune Object) - http://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab
    O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab
    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553547600} - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames/CheckersZPA.cab55579.cab
    O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (MSN Games – Backgammon) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab64162.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Norton 360\Engine\6.3.0.14\ccSvcHst.exe
    O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 11100 bytes
    Thank you so very much for any help. I've reached my "know-what-to-do" limit but am more than happy to learn more.
    jmk1011
     
    Last edited: Sep 3, 2012
  2. AfterDawn

    AfterDawn Advertisement

  3. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    37,807
    Likes Received:
    7
    Trophy Points:
    118
    moved to correct forum as not an "all other topics" issue. have you tried system restore thru safemode administrator to before this problem started?
     
  4. jmk1011

    jmk1011 Member

    Joined:
    Mar 24, 2007
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    11
    Yes I have. It still pops up. When I'm in IE and type any new web address it pops up.
     
  5. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    37,807
    Likes Received:
    7
    Trophy Points:
    118
    go into internet options in control panel & click on the advanced tab near top right. click the "restore advanced settings" tab near middle right. put a check mark back in "empty temporary internet files folder when browser is closed". click on the "reset" tab near bottom right corner to reset internet explorer.
     
  6. jmk1011

    jmk1011 Member

    Joined:
    Mar 24, 2007
    Messages:
    10
    Likes Received:
    0
    Trophy Points:
    11
    Kudos to you ddp!!!!!. I wish I could thank you properly but suffice it to say, you are my hero!!!! Thank you, thank you, thank you.
     
  7. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    37,807
    Likes Received:
    7
    Trophy Points:
    118
    no problem, teach learn,
     
  8. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    37,807
    Likes Received:
    7
    Trophy Points:
    118
    rihana05, read jmk1011's 2nd sentence here, look at the red word. "I can't find it in the registry keys, Malware, Norton, ATF...can't find it."
     
  9. theroc

    theroc Member

    Joined:
    Jan 28, 2013
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    11
    @ddp, is there a similar procedure for Firefox to get rid of this? I too have tried several malware removal tools. I cant seem to find any trace of it in the registry either. If not a simple procedure like in IE, can you tell me what entries to look for in the registry?

    It primarily seems to be happening only in Yahoo sites using the Firefox browser.

    Thanks!
     

Share This Page