Internet Explorer, Pop ups, and removing the thing...

[Angborn]

[Angborn]

[amb141]

Ang

The pop ups you are seeing (the ones that aren't associated with IE) are generated by the Windows Messenger component of XP.

Go to read the information there, and download and run "Shoot the Messenger".

BTW -- Although, like all Mozilla browsers Firefox 0.8 will not run ActiveX applications, it will run most standard plugins (Flash, Shockwave, Java) just fine. Post backif you want and let's see if we can't help you get the plugins you want up and running in the faster and more secure Firefox rather than the dinosaur IE.

alan

[Gecko]

To stop the windows messanger pop-ups
Start > Control panel > Admin tools > Services > right click Messenger > Properties > Start method > Set it to "Disabled" > Click OK.

Default browser
Start > Control panel >Internet Options > Programs tab, click to select that Internet Explorer should check to see whether it is the default browser check box, and then click OK.
Now start IE and say no to setting it as the default browser

[amb141]

Gecko is right, of course, about disabling the Windows Messenger Service manually -- the one advantage of Gibson's "Shoot the Messenger" is that the WMS can be toggled on and off easily should anyone ever need it for its original intended use. I can't imagine ... but then again I don't use XP.

alan

[Angborn]

Okay....

So last night, before I saw all your replies, I figured maybe it was time i dropped McAfee and got some better protection for my comp. So, I went to Panda and d/l'd their trial version. No problems setting it up, smooth and all that.

So, when I first installed it it tells me to uninstall McAfee first. Okay, gonna have a new virus protection software on here soon anyway, might as well. Dropped McAfee, installed Panda, ran a complete system scan right off the bat, before I even finish installation.

It claims to find 9 infected files, and disinfects them for me. Okay, cool, right?

So, after installation, no more pop-ups (yay!).

But, after reading your posts, I was going to go ahead and do the stuff you guys suggested. But...

When I go Start Menu > Control Panel, instead of getting a Control Panel window, my Start Menu bar and all my icons on my desktop disappear completely. I cannot right-click to see my desktop menu either. the only thing i can get to is my Task Manager.

So, does this mean my comp is infected or what? Any idea what the heck is going on? BTW, I've rebooted several times now, to no avail. Each time I hit control panel -or- my computer, the entire start menu bar and all my desktop icons disappear and can't be found.

Note: in my Task Manager, there is a process running called "AVENGINE.EXE". Sounds like something malicious if I ever heard it. Should I disable this process?

HELP!

[brad]

AVENGINE.EXE is part of Panda. Don't kill it!
Download / Install / Update / and Run .

Download and install . Now Run it and post a copy of the Log File here.
brad

[Angborn]

AVENGINE.EXE hasn't been touched

I d/l'd, updated, and ran SpyBot - it found lots of crap... thanks for that, brad.

I'm currently rebooting my comp because after running SpyBot I couldn't get any web pages to load... as soon as it's back up I'll d/l Hijack This... I have to go to work soon though /cry - so I might not be able to get back to this until this evening to post the logs from Hijack This.

Thanks for all your help already guys! y'all rock!

[Angborn]

Logfile of HijackThis v1.97.7
Scan saved at 3:05:52 PM, on 2/24/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\ABBYY FineReader 5.0 Sprint\CAgent.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\PSD Tools\blengine.exe
C:\Documents and Settings\Aaron Pual Johnson\Application Data\rncr.exe
C:\WINDOWS\System32\wnsapisv.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Aaron Pual Johnson\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://my.ign.com/my/sb?action=email&network=1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.fastwebfinder.com/hp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html

O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000240} - C:\Program Files\ClearSearch\IE_ClrSch.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\Program Files\Submit\submithook.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [ABBYY Community Agent] C:\Program Files\ABBYY FineReader 5.0 Sprint\CAgent.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [sys] regedit /s C:\WINDOWS\sys.reg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSNet\RSEDNClient.exe
O4 - HKCU\..\Run: [BLMessagingIntegration] C:\Program Files\Common Files\PSD Tools\blengine.exe
O4 - HKCU\..\Run: [Usrr] C:\Documents and Settings\Aaron Pual Johnson\Application Data\rncr.exe
O4 - HKCU\..\Run: [WNST] C:\WINDOWS\System32\wnsapisv.exe
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\AARONP~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKLM\..\RunOnce: [SpyBotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O9 - Extra button: Researcher (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: http://ad.searchsquire.com
O15 - Trusted Zone: http://search.searchsquire.com
O15 - Trusted Zone: http://update.searchsquire.com
O15 - Trusted Zone: http://www.searchsquire.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://www.comcastsupport.com/sdccommon ... gctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} (InstallCtl Class) - http://download.redswoosh.net/Installer ... taller.cab

[Angborn]

Maybe I wasn't clear in my first post, but the pop-ups I'm getting aren't in any Windows Messenger windows.... they're in Internet Explorer windows.

How the heck do I stop these freaking pop-ups?? HELP!



Oh, yeah, and that problem I was having where selecting my Control Panel made my Start Menu bar and all my Desktop Icons disappear has stopped doing it... whatever it was that was causing that to happen was either fixed or fixed itself <shrug>

[brad]

Here's a start:
Remove/Repair the following in HiJack This:
C:\Program Files\Common Files\PSD Tools\blengine.exe
(This is adware.buddylinks It has been discused here already. Total removal instructions:)

C:\Documents and Settings\Aaron Pual Johnson\Application Data\rncr.exe
C:\WINDOWS\System32\wnsapisv.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#22776
(Total Removal instructions: )
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://my.ign.com/my/sb?action=email&network=1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.fastwebfinder.com/hp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html
O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000240} - C:\Program Files\ClearSearch\IE_ClrSch.DLL
O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\Program Files\Submit\submithook.dll

O4 - HKCU\..\Run: [Red Swoosh EDN Client] C:\Program Files\RSNet\RSEDNClient.exe
O4 - HKCU\..\Run: [BLMessagingIntegration] C:\Program Files\Common Files\PSD Tools\blengine.exe
O4 - HKCU\..\Run: [Usrr] C:\Documents and Settings\Aaron Pual Johnson\Application Data\rncr.exe
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\AARONP~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O9 - Extra button: Researcher (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: http://ad.searchsquire.com
O15 - Trusted Zone: http://search.searchsquire.com
O15 - Trusted Zone: http://update.searchsquire.com
O15 - Trusted Zone: http://www.searchsquire.com

Now reboot and test. Then update and re-run all Spyware and Antivirus Programs!

brad

[Angborn]

Thanks to Brad here for his guidance, I finally got the pop-ups to stop.

The long and short of it was that I had a few spyware registry apps that had attached themselves inside my computer... the programs (SpyBot; HijackThis; Panda Platinum) that I've D/L'd have found most if not all of the little bugs in my comp that were causing the madness.

Thanks a million Brad!!

[brad]

You're welcome.... my pleasure.
brad