adwarw bug

[gary]

I recently pick up a "bug" that is driving me up the wall. I keep getting
popups in internet explorer 6 at any and all times. I get up in the morning
and there will be 15-20-25 popups on my screen. I have run all sorts of
virus (Norton, Adaware, RegClean etc to) trying to cure the problem to no
avail. I am including some screen shots of what I am getting. The key seems
to be something called CiD (see circled on the screen shots) buried in my
system. I can't find anything that looks like this CiD thing. The IE pop
up blocker does no good. Can anyone help me out or head me in the right
direction. I am using WinXP Home on an HP computer. I ran the HighJackThis
scan program and got the attached results. Can anyone tell what the culprit
might be and where to find. I made some screen shots of some of the pop ups
but IE Outlook won't send the file. In each pop up in the very left hand
top corner will always appear the letters like this CiD: (usually followed
by a company name or some other advertisement) I ran a scan using HiJackThis
and is attached the log it produced. Can someone take a look and see if
they see anything that could be causing my problem?Thanks.

 

[David H. Lipman]

From: "gary" <gmcne@bellsouth.net>

| I recently pick up a "bug" that is driving me up the wall. I keep getting
| popups in internet explorer 6 at any and all times. I get up in the morning
| and there will be 15-20-25 popups on my screen. I have run all sorts of
| virus (Norton, Adaware, RegClean etc to) trying to cure the problem to no
| avail. I am including some screen shots of what I am getting. The key seems
| to be something called CiD (see circled on the screen shots) buried in my
| system. I can't find anything that looks like this CiD thing. The IE pop
| up blocker does no good. Can anyone help me out or head me in the right
| direction. I am using WinXP Home on an HP computer. I ran the HighJackThis
| scan program and got the attached results. Can anyone tell what the culprit
| might be and where to find. I made some screen shots of some of the pop ups
| but IE Outlook won't send the file. In each pop up in the very left hand
| top corner will always appear the letters like this CiD: (usually followed
| by a company name or some other advertisement) I ran a scan using HiJackThis
| and is attached the log it produced. Can someone take a look and see if
| they see anything that could be causing my problem?Thanks.
|

You posted this already and I replied to you as well !

I'll repeat one last time...

Please do NOT post otr attach HiJack This logs here or in other News Groups.

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[Milo]

Hi garry...
if you can use this site
http://hijackthis.de

then there would a log from your hijackthis and then post it there and have
it evaluated follows that you would see some are flagged as red but dont go
there yet
have only the string of the bad files indicated ok...

example like this
HKLM\*****\verybad.exe
HKLM\*****\verybad. anything that is flagged as unknown or red ok

am sure its no longer a hijackthis log but a processed and simplified form
hence it can no longer be considered as a Hijackthis log file.

and lets see what was found by the site recommended. ok

Thanks...
--
Milo



"gary" wrote:

> I recently pick up a "bug" that is driving me up the wall. I keep getting
> popups in internet explorer 6 at any and all times. I get up in the morning
> and there will be 15-20-25 popups on my screen. I have run all sorts of
> virus (Norton, Adaware, RegClean etc to) trying to cure the problem to no
> avail. I am including some screen shots of what I am getting. The key seems
> to be something called CiD (see circled on the screen shots) buried in my
> system. I can't find anything that looks like this CiD thing. The IE pop
> up blocker does no good. Can anyone help me out or head me in the right
> direction. I am using WinXP Home on an HP computer. I ran the HighJackThis
> scan program and got the attached results. Can anyone tell what the culprit
> might be and where to find. I made some screen shots of some of the pop ups
> but IE Outlook won't send the file. In each pop up in the very left hand
> top corner will always appear the letters like this CiD: (usually followed
> by a company name or some other advertisement) I ran a scan using HiJackThis
> and is attached the log it produced. Can someone take a look and see if
> they see anything that could be causing my problem?Thanks

 

[BoaterDave]

Hi Milo

I still struggle with your English (grin!) but I think you intended to
suggest to Gary that he posted his HJT Log in the 'Auto-check' facility
available at www.hijackthis.de . I have used this facility many times
myself.

As I had a few minutes spare, I did this on Gary's behalf (in case he didn't
realise what you had meant) and the following item was highlighted as 'bad':

O4 - HKCU\..\Run: [HoldCity]
C:\DOCUME~1\HP_Owner\APPLIC~1\LINKOK~1\oozeplayhide.exe

This item was also shown up as questionable:

C:\Program Files\AdwareAlert\AdwareAlert.srv.exe

There is a 023 Entry too which mentions a "Fuzzy Algorithmcheck (3.07
/ 5.00), Neutral"

O23 - Service: AdwareAlert Scanning Engine (AdwareAlertSrv) - Unknown
owner - C:\Program Files\AdwareAlert\AdwareAlert.srv.exe


Just hope this information might prove helpful to you and/or Gary.

Dave

***************************************************************



"Milo" <connojara@yahoo.com> wrote in message
news:07B49593-8458-458B-91CF-76AAD33515C5@microsoft.com...
> Hi garry...
> if you can use this site
> http://hijackthis.de
>
> then there would a log from your hijackthis and then post it there and
> have
> it evaluated follows that you would see some are flagged as red but dont
> go
> there yet
> have only the string of the bad files indicated ok...
>
> example like this
> HKLM\*****\verybad.exe
> HKLM\*****\verybad. anything that is flagged as unknown or red ok
>
> am sure its no longer a hijackthis log but a processed and simplified form
> hence it can no longer be considered as a Hijackthis log file.
>
> and lets see what was found by the site recommended. ok
>
> Thanks...
> --
> Milo
>
>
>
> "gary" wrote:
>
>> I recently pick up a "bug" that is driving me up the wall. I keep
>> getting
>> popups in internet explorer 6 at any and all times. I get up in the
>> morning
>> and there will be 15-20-25 popups on my screen. I have run all sorts of
>> virus (Norton, Adaware, RegClean etc to) trying to cure the problem to no
>> avail. I am including some screen shots of what I am getting. The key
>> seems
>> to be something called CiD (see circled on the screen shots) buried in my
>> system. I can't find anything that looks like this CiD thing. The IE
>> pop
>> up blocker does no good. Can anyone help me out or head me in the right
>> direction. I am using WinXP Home on an HP computer. I ran the
>> HighJackThis
>> scan program and got the attached results. Can anyone tell what the
>> culprit
>> might be and where to find. I made some screen shots of some of the pop
>> ups
>> but IE Outlook won't send the file. In each pop up in the very left hand
>> top corner will always appear the letters like this CiD: (usually
>> followed
>> by a company name or some other advertisement) I ran a scan using
>> HiJackThis
>> and is attached the log it produced. Can someone take a look and see if
>> they see anything that could be causing my problem?Thanks
>

 

[Milo]

Sorry for my fuzzy typing dude and Gary my apo - am half asleep when I did
started with the correspondence you know me am always cryptic hahaha..

O4 - HKCU\..\Run: [HoldCity]
C:\DOCUME~1\HP_Owner\APPLIC~1\LINKOK~1\oozeplayhide.exe
|
REMOVE THIS it should not run on auto start

C:\Program Files\AdwareAlert\AdwareAlert.srv.exe
|
REMOVE THIS VIA going to its own folder and looking for
uninstall/uninst
"Just make sure you or Gary didnt purchase this product"

O23 - Service: AdwareAlert Scanning Engine (AdwareAlertSrv) - Unknown
owner - C:\Program Files\AdwareAlert\AdwareAlert.srv.exe
|
It did attached on the services list so better do a restart after
proceeding
with the use of its own uninstaller.

And Gary if you were mislead to purchased this product call your credit card
company
and have it cancelled.
--
Milo



"BoaterDave" wrote:

> Hi Milo
>
> I still struggle with your English (grin!) but I think you intended to
> suggest to Gary that he posted his HJT Log in the 'Auto-check' facility
> available at www.hijackthis.de . I have used this facility many times
> myself.
>
> As I had a few minutes spare, I did this on Gary's behalf (in case he didn't
> realise what you had meant) and the following item was highlighted as 'bad':
>
> O4 - HKCU\..\Run: [HoldCity]
> C:\DOCUME~1\HP_Owner\APPLIC~1\LINKOK~1\oozeplayhide.exe
>
> This item was also shown up as questionable:
>
> C:\Program Files\AdwareAlert\AdwareAlert.srv.exe
>
> There is a 023 Entry too which mentions a "Fuzzy Algorithmcheck (3.07
> / 5.00), Neutral"
>
> O23 - Service: AdwareAlert Scanning Engine (AdwareAlertSrv) - Unknown
> owner - C:\Program Files\AdwareAlert\AdwareAlert.srv.exe
>
>
> Just hope this information might prove helpful to you and/or Gary.
>
> Dave
>
> ***************************************************************
>
>
>
> "Milo" <connojara@yahoo.com> wrote in message
> news:07B49593-8458-458B-91CF-76AAD33515C5@microsoft.com...
> > Hi garry...
> > if you can use this site
> > http://hijackthis.de
> >
> > then there would a log from your hijackthis and then post it there and
> > have
> > it evaluated follows that you would see some are flagged as red but dont
> > go
> > there yet
> > have only the string of the bad files indicated ok...
> >
> > example like this
> > HKLM\*****\verybad.exe
> > HKLM\*****\verybad. anything that is flagged as unknown or red ok
> >
> > am sure its no longer a hijackthis log but a processed and simplified form
> > hence it can no longer be considered as a Hijackthis log file.
> >
> > and lets see what was found by the site recommended. ok
> >
> > Thanks...
> > --
> > Milo
> >
> >
> >
> > "gary" wrote:
> >
> >> I recently pick up a "bug" that is driving me up the wall. I keep
> >> getting
> >> popups in internet explorer 6 at any and all times. I get up in the
> >> morning
> >> and there will be 15-20-25 popups on my screen. I have run all sorts of
> >> virus (Norton, Adaware, RegClean etc to) trying to cure the problem to no
> >> avail. I am including some screen shots of what I am getting. The key
> >> seems
> >> to be something called CiD (see circled on the screen shots) buried in my
> >> system. I can't find anything that looks like this CiD thing. The IE
> >> pop
> >> up blocker does no good. Can anyone help me out or head me in the right
> >> direction. I am using WinXP Home on an HP computer. I ran the
> >> HighJackThis
> >> scan program and got the attached results. Can anyone tell what the
> >> culprit
> >> might be and where to find. I made some screen shots of some of the pop
> >> ups
> >> but IE Outlook won't send the file. In each pop up in the very left hand
> >> top corner will always appear the letters like this CiD: (usually
> >> followed
> >> by a company name or some other advertisement) I ran a scan using
> >> HiJackThis
> >> and is attached the log it produced. Can someone take a look and see if
> >> they see anything that could be causing my problem?Thanks
> >
>
>
>