Newbie dot Org

Pop UPS !
kris ( again :P) 09/11/04	hi all i have many popups i have run adaware se and spy sweeper and search and destroy ..
kris 09/11/04	lol forgot log .. Logfile of HijackThis v1.98.2 Scan saved at 0:12:47, on 12-9-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\System32\zdablpu.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\Internet Optimizer\optimize.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Sitecom Wireless LAN\WLANUTL.exe C:\Program Files\Internet Optimizer\actalert.exe C:\Program Files\Web_Rebates\WebRebates1.exe C:\Program Files\Web_Rebates\WebRebates0.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Documents and Settings\kris kalwij\Mijn documenten\sweepers\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.slotch.com/?&account_id=153510 R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem302.dll O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [eszbmpknf] C:\WINDOWS\System32\zdablpu.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [\Pribi.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pribi\Pribi.exe O4 - Global Startup: Sitecom Wireless LAN Utility.lnk = ? O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {018A066F-584A-422F-AC4C-0B1F5FE5C040} (VacPro.olanda_ver3) - http://www.advnt01.com/dialer/olanda_ver3.CAB O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-nl/nl/games4.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = home.intra O17 - HKLM\Software\..\Telephony: DomainName = home.intra O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = home.intra O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = tilbu1.nb.home.nl O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = home.intra O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = tilbu1.nb.home.nl O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = tilbu1.nb.home.nl O18 - Filter: text/html - {A5D7362A-932C-4396-B174-BB005A76FA97} - C:\Documents and Settings\kris kalwij\Local Settings\Application Data\microsoft\internet explorer\V0.15.dat
kris 09/12/04	help !!! :p
ed 09/12/04	resstart to safe mode and navigate to C:\WINDOWS\System32 and delete zdablpu.exe C:\Program Files and delete the folder ISTsvc C:\Program Files and deletew the folder Internet Optimizer C:\Program Files and delete the folder Web_Rebates boot it back to normal mode close internet explorer , run hjt again select these and click fix R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem302.dll O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll O4 - HKLM\..\Run: [eszbmpknf] C:\WINDOWS\System32\zdablpu.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe" O4 - HKCU\..\Run: [\Pribi.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pribi\Pribi.exe O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll If the following are not from your internet service provider have hjt fix them also O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = home.intra O17 - HKLM\Software\..\Telephony: DomainName = home.intra O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = home.intra O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = tilbu1.nb.home.nl O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = home.intra O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = tilbu1.nb.home.nl O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = tilbu1.nb.home.nl Kris YOU have not listed any info regarding your computer regading anti adware nor antivirus. If this is because you dont have them then I just have to say that you brought your problems on yourself and have most assuredly been the cause for several other peoples computer problems. You need to have ad-aware and a full time regularily updated anti virus avg free virus scanner
Mark 09/12/04	Good catch Ed. No AV.

This site maintained by Galaxy Website Design