probs with my favorites plz help me if u can NO SPAM!!!

[Mut68]

ok im not that good at the tech stuff about pc's k!! so iv got the same prob as the other people junk keeps on appering in my favorites and iv got spybot s&D and ad-aware 6 and norton 2004 and nothing gets rid of the junk plz help WITH OUT THE TECH STUFF!!! plz if u can and im runing win xp

 

[Tom]

Have you installed anything recently, like MSN+ ? What about any p2p software?

Do a CTRL-ALT-DEL, tell us whats listed in the processes box.

 

[~Yuckfou~]

ok im not that good at the tech stuff about pc's k!! so iv got the same prob as the other people junk keeps on appering in my favorites and iv got spybot s&D and ad-aware 6 and norton 2004 and nothing gets rid of the junk plz help WITH OUT THE TECH STUFF!!! plz if u can and im runing win xp

Stop using shitty porn sites, problem will be solved.

 

[.Wilier.]

sounds like Adware tbh. Norton Corperate picks it up in a scan.
Most Adware requires that you manually uninstall it or remove it from the registry.

The Symantec Security site gives detail of them all, just search for Adware on their site

 

[Vae]

If you've run Spybot S&D and Adaware then you could try CWshredder and then Hijackthis from this set of forums:

http://www.spywareinfo.com/forums/index.php?act=SC&c=3

The people there are pretty useful. Once you've run CWshredder then run Hijackthis and post the log file it generates onto the forums for the guys to look at and try to spot your problem.

 

[Mut68]

ye here is my hijack log thing i cant log onto the web site iv regestared 2 time and i cant log on can u plz post this for me and give me the link plz

Logfile of HijackThis v1.97.7
Scan saved at 19:57:20, on 17/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Scott\My Documents\My Received Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bygames.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-gb\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TuneUP.hta
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_42.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38122.486712963
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

[Tom]

Right, have a look in your c:\windows\downloaded program files\ folder, it contains activex software that you click yes/no to on certain web pages. Back the files up, and delete them.

 

[Mut68]

hmm ye how do i back these files up and if i del them will it fix my prob??? or should i just del them and get them back???

 

[Tom]

Just make a copy of them to another folder. Deleting them won't harm your system. It will remove all those bits and pieces that are installed when you visit a certain page and something says 'do you want to install blah (always trust software from bullshitsoft)'

 

[MrBlack]

I know I'll get flamed for being pompous and unhelpful by even thinking of suggesting this, but I'm going to anyway:

http://www.opera.com
http://www.mozilla.org

Purveyors of two very worthy browser alternatives that suffer none of this silliness that you are experiencing.

Switching browsers isn't for everyone, sure, and IE is pretty damn good. I'm not even saying these other two are _more_ secure as a whole, it's just that IE bears the brunt of this kind of rubbish. I know that when I use Opera, I can visit dodgy porn sites.. I mean "do some valuable research" in peace.

That aside, your system doesn't appear to be running anything that shouldn't be, although I don't recognise the O16 lines from HijackThis.

A response to this other forum thread (very similar porblem to yours):
http://www.daniweb.com/techtalkforums/showthread.php?mode=hybrid&t=5979

recommends removing TuneUP.hta with HijackThis, although I don't know what TuneUP is. anyone?

 

[Miles_Binck]

O16 lines are for downloaded program files like windowsupdate, shockwave flash or jirc.


Mut68, open up Regedit (Start > Run > type: regedit > hit enter), click on the My Computer icon and the do a search (Edit > Find) for TuneUP (spelt exactly as it is typed here) then enter all the locations where it is found on here.

Also look in your Startup menu (Start > All Programs > Startup) for TuneUP.hta, if it is there right click on it and choose properties and paste the target line here.

 

[Mut68]

e TuneUP i cant find it in the run thing but i found it on the start up bit plz explan in more detail not that smart with pc