Porn Pop Up Again ...

Lisa Probert · Jul 9, 2003

Hi,
I'm having trouble with a pop up that advertises porn about every 5-10 minutes, when I'm logged on with IExplorer. I've had a quick search through this forum and downloaded HijackThis and the log file is appended below. Can anyone point me to what might be wrong and let me know how to get rid of this.
Thanks,
Lisa

Logfile of HijackThis v1.95.0
Scan saved at 19:44:49, on 08/07/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Smtray.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\evntsvc.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\COMPAQ\CPQINET\CPQInet.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Lisa Probert\Local Settings\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://bookmarks.bluewin.ch/e/searchpane.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://news.bbc.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=100c&ac
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=100c&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=100c&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.bluewin.ch/index_e.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=100c&s=search&ap=b204
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bluewin.ch/index_e.html
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab

dvk01 · Jul 9, 2003

nothing obvious in the log

Steely · Jul 9, 2003

If somebody else has an account/ another profile - you might need to scan/re-run Hijack this on that one (or each profile) too, then re-post. Good luck.

Lisa Probert · Jul 10, 2003

Thanks for looking at the log file, but this is the only account on the machine. We run Norton as a virus scanner, do you have any more ideas about how to trace this pop up?

dvk01 · Jul 10, 2003

if there is nothing in HJT then it's possibly a messenger pop up so
Windows XP
1. Click on the Start button and open the control panel.
2. Open the Performance and Maintenance control panel and go to Administrative Tools.
3. Now double-click on Services, then scroll to Messenger.
4. Double-click Messenger and click Stop to stop the service.
5. Change the startup type to Disable and click Apply at the bottom.
6. Click OK to exit window.

BTW, this has nothing to do with the MSN /Windows Messenger Instant Messaging service

Windows 2000
1. Click on the Start button -> Settings -> Control Panel.
2. Double click on Administrative Tools.
3. Now double-click on Services, then scroll to Messenger.
4. Double-click Messenger and click Stop to stop the service.
5. Change the startup type to Disable and click Apply at the bottom.
6. Click OK to exit window.

For Windows 95, 98, and ME
* Under Control Panel, select Add/Remove.
* Select Windows Setup.
* Select System Tools.
* Click Details.
* Uncheck WinPopUp.
* Click OK.
* Reboot

Alternative way is if you use a decent firewall then block ports 135,137,138,139,445 both TCP & UDP and both incoming & outgoing, that also stops other unwanted nasties

or you're just surfing the wrong sites and the pop ups are hard coded into the web pages

can you give some examples of the sites that the pop ups occur on

Lisa Probert · Jul 10, 2003

Many thanks, that seems to have sorted out the problem.
There was no specific sites that were activating the message, it was just popping up every 5-10 minutes. As far as I know, we didn't surf too many "wrong sites".
Lisa

Porn Pop Up Again ...

Top Contributors this Month

Recommended Communities