Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
HI! I really hope you can help me. Almost every time I click on any link in explorer I get a lot of pop-ups from a porn site called "the hun". If I'm lucky I can close them quickly, if I dont they continue to pop up. The pop-up has a text that says that if I get this popup 30 times or more I'm infected with a dangerous trojan...I have tried to use ad aware, spybot and jv16. I found some bad files, but the problem with the pop-ups remains...HELP ME!!!
Download Panicware or even Google have a pop up stopper that is incorporated in your browser page.
Also disable Messenger in Services. It is not related to Windows Messenger so don't worry.
That should fix it.
0 
Get rid of IE and download Netscape 7.X , it has built in popup stopper and you never see any popups , works great .
0
Hi Bo
Make sure you update ad-aware and spybot..(if you havn't already) and let those programs clean out whatever they find.
Wouldn't hurt to run a full system scan with updated antivirus too.
Then if problems still persist download "hijack this" from the link below, unzip the file, run hijack this.exe, hit the scan button, the scan button will change to "save log" button, save the log and post it in reply.
Most stuff you see in the scan is needed and/or safe so dont delete anything yet
0
That is another new hijack, not
much info on it yet.Someone posted that EMS Free Surfer will
stop the popups, so you can still get
around the internet.
Whenever you shut down your computer, you will need to close EMS first.http://www.webattack.com/download/dlfreesurfer.shtml
Above is a temp fix, posted by a user at
spywareinfo with the same problem.IE hell has arrived.
0
As blender said, try HijackThis. It should show the offending crapware causing the pop-ups. A pop-up stopper is good, but you really need to get rid of the cause. Otherwise, the pop-up stopper is just a bandaid, not the cure.
Download here:
Upzip it and run it. Copy and paste the log into your reply here and someone will tell you what things to fix.
0
I have just spent 'lots' of hours on a friends computer trying to sort out the same thing. His IP uses a proxy server and as soon as I allow his IP with Kerio firewall 'the hun' takes over. I have run hijack this and all the entries (only about 15 in total) appear OK. I did clean bulk crap out of the machine last month using all the 'norm' stuff like spybot, adaware, HJT, cwshredder etc. Everything was running fine up until last Thursday and then it hit him. Said he hadn't downloaded anything, gone to porn sites etc. so don't know where it came from or how to stop it. Will give freesurfer a go but there must be a way to dispose of this. BTW his IP is australis in Australia in case that has any bearing on the problem.
AAAAAAARRRRRRRGGGGGGHHHHHH
Dog
0
Hi! thanks for the replies, but nothing seem to work. Panicware pop-up stopper didn't work and as some of you pointed out, I don't think a pop-up stopper is the right solution. As I wrote I have tried a lot of different programs, also cool web shredder and hijackthis. Unfortunately I was stupid so I deleted everything in hijackthis. Any way, here is the log:
Logfile of HijackThis v1.97.3
Scan saved at 15:32:20, on 02-11-2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\LEXBCES.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.exe
C:\Programmer\Norton Internet Security\IAMAPP.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton Internet Security\NISUM.exe
C:\WINDOWS\system32\slserv.exe
C:\Programmer\Norton Internet Security\NISSERV.exe
C:\Programmer\Norton Internet Security\SymProxySvc.exe
C:\Programmer\Norton Internet Security\ATRACK.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Winnie Semlow\Skrivebord\HijackThis.exeO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [iamapp] C:\Programmer\Norton Internet Security\IAMAPP.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.exe"
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1067616750078
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
0
Go here and read about LEXBCES.exe and LEXPPS.exe
http://www.answersthatwork.com/Tasklist_pages/tasklist_l.htm
0
Bo,
This is a post from Tony K., respected
spyware removal expert.http://tomcoyote.org/forums/index.php?showtopic=519
Hope it helps.
0
Bo
You can restore what you deleted in hijack this..
Start hijack> click misc tools> click backups> restore what you deleted thru there> reboot and you can re-run the hijack scan again...don't delete the stuff in there yet cus most is safe or needed. Either repost log here or on the site abnormal gave you.
0
Found 'the hun' in the registry along with yahoo in the same value. Deleted both occurences and now no hassles.(So Far). Also made all active x 'promt' and refused on pages I did not know or trust for sure.
HTH
Dog
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
