Pop-ups minimizing my games

[Merlin4458]

Recently my mate went on cracks.com or something, now since then my games minimize and pop ups come up saying ur system might be vulnerable and ****, which is obviously a hoaks, but the thing is my counterstrike crashes when i minimize so these pop ups minimize me and then cant get backi n anyway.

Ive done thorough avast scan, microsoft spyweare, adaware, spoybot s& D and still nothing found.

Does anyone have a clue how to get rid of this

cheers

[dannyboy83]

download ad-aware by lavasoft, and spybot: search and destroy... not sure where from but google em (both are free for personal use)

download the up-to-date reference for each and run em. You probly have all sorts of spy-ware in your system generating popups and tracking your web history.

If you have Windows SP2, you should have a pop-up blocker (turned on by default) in Internet Explorer

[Merlin4458]

read my post m8, i stated that i had run them both..

http://www.winfixer.com/pages/scanne...3&ex=1&p=&ax=1

That is what comes up

[Merlin4458]

bumb? guys this is prob the most annoying thing possible. In the middle of a round andpop ups minimize your game

[Paul Adams]

Give us a HijackThis log:
http://www.majorgeeks.com/download3155.html

Also, Process Explorer from SysInternals is a great way to see what is running on your system and the full path to where it was launched from:
http://www.sysinternals.com/Utilitie...sExplorer.html

[Merlin4458]

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Programs\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\Programs\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Programs\MouseWare\system\em_exec.exe
C:\setup.exe
D:\Programs\gcasDtServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\programs\valve\steam\steam.exe
D:\Programs\Phone\Skype.exe
D:\Programs\ATITool\ATITool.exe
D:\Programs\Xfire\Xfire.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\RTLCPL.EXE
C:\WINDOWS\ALCFDRTM.EXE
D:\PROGRAMS\FIREFOX.EXE
D:\Programs\WinRAR.exe
C:\DOCUME~1\John\LOCALS~1\Temp\Rar$EX00.141\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Programs\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Programs\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Programs\LogiTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] D:\Programs\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] D:\Programs\LogiTray.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "D:\Programs\\nTune.exe" clear
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [gcasServ] "D:\Programs\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programs\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [MyVBApp] C:\setup.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\programs\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\programs\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "D:\Programs\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] D:\Programs\ManifestEngine.exe boot
O4 - Startup: LimeWire On Startup.lnk = D:\Programs\LimeWire.exe
O4 - Startup: Xfire.lnk = D:\Programs\Xfire\Xfire.exe
O4 - Global Startup: ATITool.lnk = D:\Programs\ATITool\ATITool.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\programs\INETREPL.DLL (file missing)
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\programs\INETREPL.DLL (file missing)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\programs\INETREPL.DLL (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqnbk/downloads/msxml4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - D:\Programs\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - D:\Programs\avgupsvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[Paul Adams]

The first place I would look is that C:\setup.exe calling itself "MyVBApp" which is running and is also set to start on logon.

If you don't recognise it, kill the task in memory and rename the file so it can't launch.


Also, another couple of useful utils from SysInternals:
AutoRuns shows you what programs are set to automatically start on bootup & logon, with the ability to easily disable or remove them

Rootkit Revealer to check for hidden processes & files on your disk than conventional AV doesn't pick up

[Merlin4458]

call the task in memory? do u mean ctrl alt delete then processes or msconfig in run?

[Paul Adams]

It means I did some fat-fingered typing

I meant KILL, not call.

Task Manager - highlight setup.exe - end process
If that can't do it, Process Explorer might have better luck.

Then "call" your friend who visited warez sites and installed that crap along with whatever crack he downloaded.

[Merlin4458]

lol, cheers bud, i found the file in my c drive and deleted it along with task manager
i will send it too him over msn

[vincent]

"D:\Programs\gcasDtServ.exe "

-LOL i like the process google search on this one.. shows how much MS knows on supposedly "how to protect your pc" LOL

click on Start click on run and type in [without quotes] "msconfig" and click ok-
click on the "Startup" tab and Untick the following from the list

"realsched.exe" -Real One Player Server Scheduler- Dont need it at startup
"jusched.exe"- Java Environment Scheduler -Dont need it at startup
"LimeWire.exe" - LimeWire -because you aint gonna download everytime u start the pc

then click the apply button and click on "exit without restart" when u do restart the pc- it'll nag about using MS config tool -all u do then is just tick the box and click ok

The amount of pc's i have doen the above to is barbaric -lol
what people expect from software is to install and work rather than take up Memory and CPU usage when their not using it

Now the spyware issue
------------------------------

Download and install the following below
Ad Aware SE
Latest Firefox [US 1.5]
Suggestion to use FF all the time ONLY use IE for FTTP/ web server access
Spyware Doctor
Spyware Sweeper

use al lof the Anti spyware appz suggested please bud because all of them work differently and many peeps trust Ad Aware too much when al lthat does is dust lil bits of spyware when al lthe other find stuff that Ad Aware wont

hope this help bud

Vincent

[Merlin4458]

cheers vincent ur actually a legend. I have done everything u have said and hopefully it will help my cause.

Thanks again