Winantivirus 2007 Popup's

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

If you have not received help after three days, please post a link to your topic HERE.

2 Pages
1
2
→

You cannot start a new topic
You cannot reply to this topic

Winantivirus 2007 Popup's Slow Brower on a new Computer

#1 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 13 July 2007 - 11:37 PM

Hello,

I have a problem with a continues POP UP for WINANTIVIRUS PRO 2007. I have several great Spyware and Malware programs running to prevent and remove spyware, but this one continues to come back. Also. Windows defender keeps finding a win32/fotomoto file that wants to change my home page browser. Problably all part of the same problem, or maby mutliple problems. Non of my Virus and firewall software I have in place is working and this is a brand new computer. Kinda frustrated with it. I do not want my personal info compromised . Can you help me out? I would greatly appreciate it and would love to learn what you guys know so I could help others in the future.

Regards,

David T.

#2 oldf@rt

Forum Addict

Group: Members
Posts: 2,609
Joined: 06-November 05
Gender:Male
Location:Avondale, Arizona USA

Posted 13 July 2007 - 11:52 PM

Hi, this program that you are have a problem with, I call ripoffware. Lets try a couple of things here, and see if we can get rid of it. First, please download and install Rogue Remover Free. make sure that you update the database. Disconnect from the internet. Disable Windows Defender, and any other program you have running. Run the program and let it remove everything that it finds. Let us know the results. There will be more to do.

Please take into account that you should only have one active malware program and one active antivirus running at a time. Having more than one running causes conflicts that will open your computer to infection, and can prevent these fixes from being effective. You can re connect to the net when you have finished running and repairing with rogue remover. Be sure to reactivate your protection and restart your computer before you connect again.

The name says it all -- 59 and holding permanently

**WARNING** _{Links I provide might cause brain damage}

#3 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 01:01 AM

It only found a SPYNOMORE cookie that it removed. Nothing else was found. What else can be done? I knopw something is going on becuse that POPUP is happening everytime I visit a sie that has anything to do with SPYWARE sofware.

Your thoughts?

Thanks for your help.

DAvid

#4 oldf@rt

Forum Addict

Group: Members
Posts: 2,609
Joined: 06-November 05
Gender:Male
Location:Avondale, Arizona USA

Posted 14 July 2007 - 02:05 AM

Lets see what superantispyware can find and eliminate: Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

The name says it all -- 59 and holding permanently

**WARNING** _{Links I provide might cause brain damage}

#5 buddy215

Forum Addict

Group: BC Advisor
Posts: 4,490
Joined: 14-April 06
Gender:Male
Location:West Tennessee

Posted 14 July 2007 - 04:48 AM

Super Antispyware removes some Vundo related infections. If you still have a problem after using it:
Use Vundofix to help you remove WINANTIVIRUS PRO 2007.
http://www.atribune.org/content/view/24/2/

Run the online scan for Bit Defender in normal mode. Allow it to quarantine whatever it finds.
http://www.bitdefender.com/scan8/ie.html

--------------------------------------------------------------------------------

Post a Hijack This log in the Hijack This Forum by following the directions in the link below. DO NOT post the log in this forum.
http://www.bleepingcomputer.com/forums/topic34773.html

#6 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 12:38 PM

#7 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 12:40 PM

Look at what XoftSpy just found on the PC. They are quarantined, but each time it is scanned it still shows the files being detected. Quarantined items will still show be detected even though they are quarantined? Correct? Lot of items. I did this before I realized you guys had left some further directions for me to complete. I will do what you ask next. Thanks again!

David

#8 oldf@rt

Forum Addict

Group: Members
Posts: 2,609
Joined: 06-November 05
Gender:Male
Location:Avondale, Arizona USA

Posted 14 July 2007 - 01:43 PM

I have one more thing for you to do: Before you do this, if you are using a custom hosts file, HostsXpert will restore the original M$ file.

Download HostsXpert.zip

Extract (unzip) HostsXpert.zip to a a permanent folder on your hard drive such as C:\HostsXpert
Double-click HostsXpert.exe to run the program.
Click "Make Hosts Writable?" in the upper right corner (If available).
Click "Restore Microsoft's Hosts file" and then click "OK".
Click the X to exit the program.
Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

The name says it all -- 59 and holding permanently

**WARNING** _{Links I provide might cause brain damage}

#9 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 02:07 PM

I do not think I using a customer host file? How would I know? Sorry so thick on that subject.

#10 oldf@rt

Forum Addict

Group: Members
Posts: 2,609
Joined: 06-November 05
Gender:Male
Location:Avondale, Arizona USA

Posted 14 July 2007 - 03:35 PM

If you are using a custom hosts file, you would know.

A custom hosts file is used to block known bad web sites from being opened by saying that they are contained on your local computer, not where there are actually at.

The name says it all -- 59 and holding permanently

**WARNING** _{Links I provide might cause brain damage}

#11 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 06:38 PM

SuperAntisptware details. I found more items.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/14/2007 at 05:54 PM

Application Version : 3.9.1008

Core Rules Database Version : 3269
Trace Rules Database Version: 1280

Scan type : Complete Scan
Total Scan Time : 03:38:51

Memory items scanned : 504
Memory threats detected : 2
Registry items scanned : 6280
Registry threats detected : 28
File items scanned : 248760
File threats detected : 58

Trojan.Duncan
C:\WINDOWS\SYSTEM32\CLICSPI.DLL
C:\WINDOWS\SYSTEM32\CLICSPI.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761eb929-7707-4719-a8dd-7dfd0fca0378}
HKCR\CLSID\{761EB929-7707-4719-A8DD-7DFD0FCA0378}
HKCR\CLSID\{761EB929-7707-4719-A8DD-7DFD0FCA0378}\InprocServer32
HKCR\CLSID\{761EB929-7707-4719-A8DD-7DFD0FCA0378}\InprocServer32#ThreadingModel
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\clicspi

Unclassified.SpywareBot (Not A Threat)
C:\PROGRAM FILES\SPYWAREBOT\SPYWAREBOT.EXE
C:\PROGRAM FILES\SPYWAREBOT\SPYWAREBOT.EXE
[SpywareBot] C:\PROGRAM FILES\SPYWAREBOT\SPYWAREBOT.EXE
[SpywareBot] C:\PROGRAM FILES\SPYWAREBOT\SPYWAREBOT.EXE
HKU\S-1-5-21-220523388-1647877149-725345543-1003\Software\SpywareBot
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Inno Setup: Setup Version
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Inno Setup: App Path
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#InstallLocation
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Inno Setup: Icon Group
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Inno Setup: User
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Inno Setup: Selected Tasks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Inno Setup: Deselected Tasks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#DisplayIcon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#QuietUninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#DisplayVersion
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#Publisher
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#URLInfoAbout
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#HelpLink
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#NoModify
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#NoRepair
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareBot_is1#InstallDate
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#spywarebot [ C:\Program Files\SpywareBot\SpywareBot.exe -boot ]
C:\Program Files\SpywareBot\Launcher.exe
C:\Program Files\SpywareBot\SpywareBot.url
C:\Program Files\SpywareBot\unins000.dat
C:\Program Files\SpywareBot\unins000.exe
C:\Program Files\SpywareBot
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot\SpywareBot on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot\SpywareBot.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot\Uninstall SpywareBot.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot
C:\DOCUMENTS AND SETTINGS\AMY LYNN TWILLEY\DESKTOP\SETUP.EXE
D:\KEPT PROGRAMS\SETUP.EXE
C:\WINDOWS\Prefetch\SPYWAREBOT.EXE-2E4F0AB3.pf

Adware.Tracking Cookie
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@stopzilla[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@ads.ookla[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@sales.liveperson[3].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@interclick[3].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@ad.yieldmanager[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy lynn twilley@CAGG76HG.txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@msnservices.112.2o7[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@click.cashengines[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@www.amaena[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@www.burstbeacon[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@adinterax[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@precisionclick[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@www.drivecleaner[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@stats.drivecleaner[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@ads.medbanner[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@adopt.specificclick[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@winantispyware[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@apmebf[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy lynn twilley@CAT4K5EK.txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@adtrackz[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy lynn twilley@CAFU1OWQ.txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@drivecleaner[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy lynn twilley@CAPL1MPR.txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@sales.liveperson[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@www.winantispyware[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@pch.122.2o7[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@overture[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@kaboose.112.2o7[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@specificclick[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@ads.adbrite[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@realnetworks.112.2o7[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@sales.liveperson[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@msnportal.112.2o7[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@ads.monster[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@siemens.112.2o7[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@media.mtvnservices[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@www.winantiviruspro[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@adv.webmd[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@anad.tacoda[2].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@interclick[1].txt
C:\Documents and Settings\Amy Lynn Twilley\Cookies\amy_lynn_twilley@www.googleadservices[3].txt
D:\Amy\Cookies\amy@adv.webmd[1].txt
D:\Amy\Cookies\amy@www.mymediacom[1].txt
D:\Amy\Cookies\amy@www.mymediacom[2].txt

#12 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 06:43 PM

Trying the Vundofix now. Stay tuned. David

#13 twilldab

Member

Group: Members
Posts: 28
Joined: 13-July 07

Posted 14 July 2007 - 06:56 PM

I have been noticing on boot up my virus scan is blocking access to this file ssttt.exe. Any thoughts on this file? This stated happening after installing SUPERAntiSpyware.exe. Would it have anything to do with it? Just curious.

Also Vundofix did find some items and rebooted system. Thanks for that. Trying http://www.bitdefender.com/scan8/ie.html next.

Thanks for help.

#14 oldf@rt

Forum Addict

Group: Members
Posts: 2,609
Joined: 06-November 05
Gender:Male
Location:Avondale, Arizona USA

Posted 14 July 2007 - 07:15 PM

Once you have completed the bitdefender scan, post the hijack this log. It looks like you need one of the hijack this team members to help you finish killing the Vundo Trojan. I might be a little early, I am waiting on the bit defender results.

The name says it all -- 59 and holding permanently

**WARNING** _{Links I provide might cause brain damage}