virus

[Dawgs0916]

hey guys. i have a question. im pretty sure i have a virus on my computer. i am getting an extreme amount of pop ups ranging from cell phone ads to online dating sites. they all start with this "CiD:" my computer speed has slowed drastically, as well as my internet. does anyone know how i can fix this? ive ran AOL scans for spyware and viruses and whatnot but it doesnt find anything!

 

[Achozen]

I think I just got one too. Help!?

 

[Yeagermeister]

If you have XP you can download windows defender from the microsoft website for free to help with the spyware. As for a virus there are several freebies that you can dl. There is AVG or AGV I can't remember or Avast.

There are many others but those should help.

 

[GTaylor]

If you don't mind, download and run HiJack This from here, copy and paste the information here. This runs a diagnostic of your programs.

Odds are you don't have a virus but rather spyware but to be safe let's protect you from everything. BTW - All apps are free.

Firewall - take your pick, ZoneAlarm or Comodo. I've used both and would recommend either. There are others SunBelt (Formerly Kerio but it's $10).

Anti-Virus - Again, take your pick: AVG Free or Avast. I've used both, prefer AVG although my complaint about AVAST being it works too well, others swear by AVAST. You can't go wrong with either.

Anti-Malware, I only know of one app that's free. Comodo's Boclean, this app doesn't scan and remove Trojans, rather it stops trojans before they install. I can't recommend this program enough.

Spyware, I've used Spybot Search and Destroy for years and haven't even looked elsewhere. I'm sure there are other apps but this one hasn't let me down.

Definitely download and install the above, also post the hijack this log. Same for you dangerdoom4124 and we'll see if we can find the cause of your problems.

 

[Dawgs0916]

hey...is this what you needed to see?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18:27 AM, on 9/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\AOL\1123292775\ee\services\safetyCore\ver210_5_4_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1123292775\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\AOL\1123292775\ee\SSCEvtHdlr.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\AOL\1123292775\ee\aolsoftware.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\1123292775\ee\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\mcafee.com\personal firewall\MpfTray.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Zango /fleok=1D8A83A5C5E4117D9DA9692A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Zango\bin\10.0.341.0\HostIE.dll (file missing)
O2 - BHO: (no name) - {137A377E-AAE7-F332-95DF-F28AACD7FBCF} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
O2 - BHO: (no name) - {9AE2D155-17E9-1A4D-B619-4F0142E979C0} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Zango - {07AA283A-43D7-4CBE-A064-32A21112D94D} - C:\Program Files\Zango\bin\10.0.341.0\HostIE.dll (file missing)
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1123292775\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1123292775\ee\services\safetyCore\ver210_5_4_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1123292775\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Application Data\flag ace stupid data\Hole About.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0\AOL.EXE" -b
O4 - HKCU\..\Run: [webrdr] C:\DOCUME~1\William\APPLIC~1\THATOB~1\blue draw.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt211YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.2.0.51g/cab/aolpPlugins.10.4.0.2.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {83EF1847-D835-490B-8D9D-90B2987D66E8} - http://pictures.aolcdn.com/ap/Resources/1.0.2.19.b//cab/YgpUploader.9.3.2.3.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AEF35AB3-6761-4AD0-A5D1-4075F90AA595} (Launch Control) - https://www.acculive.com/commander/Launch.ocx
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O20 - AppInit_DLLs:
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1123292775\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

--
End of file - 12487 bytes

 

[Achozen]

If you don't mind, download and run HiJack This from here, copy and paste the information here. This runs a diagnostic of your programs.

Odds are you don't have a virus but rather spyware but to be safe let's protect you from everything. BTW - All apps are free.

Firewall - take your pick, ZoneAlarm or Comodo. I've used both and would recommend either. There are others SunBelt (Formerly Kerio but it's $10).

Anti-Virus - Again, take your pick: AVG Free or Avast. I've used both, prefer AVG although my complaint about AVAST being it works too well, others swear by AVAST. You can't go wrong with either.

Anti-Malware, I only know of one app that's free. Comodo's Boclean, this app doesn't scan and remove Trojans, rather it stops trojans before they install. I can't recommend this program enough.

Spyware, I've used Spybot Search and Destroy for years and haven't even looked elsewhere. I'm sure there are other apps but this one hasn't let me down.

Definitely download and install the above, also post the hijack this log. Same for you dangerdoom4124 and we'll see if we can find the cause of your problems.

Thanks alot man, I appreciate it.

 

[GTaylor]

Dawgs0916,

Thanks for the information, I do have a concern with this line:

O4 - HKCU\..\Run: [webrdr] C:\DOCUME~1\William\APPLIC~1\THATOB~1\blue draw.exe

Usually if I see an app I'm not familiar with I check it out via security sites or google, when I checked this one through google (I searched as bluedraw.exe, blue draw.exe came up empty) I only had a few results and in each case they showed it as malware (Trojan). I don't want to alarm you but as a precaution I would check this out to see what it is, if you're not familiar with the folder format:

- Click Start, then run
- In the box, type in C:\Documents and Settings\William\Application Data
- From there look for a folder that starts with Thatob and do a google search to see what it is. Again, could be legit but at least you'd know for sure.

Also it looks like you either have or had (I'm thinking had) Zango, which is the granddaddy of spyware apps. If you still have it...bingo! We just found your pop-up problem. Zango looks for keywords when you go to sites then pops up adds (I.E. visit a floral site and all of a sudden an ad for 1-800-flowers appears), I would run spybot first to delete any entries, then run hijackthis and remove any [SIZE=-1]reminents of Zango/ShopperReports.

Other than that, you have quite a few files running which would slow the PC down, fortunately they're all legit. [/SIZE]My personal opinion (And take it for what it's worth - one dude's thought) but McAfee is really bloated, if you were to substitute McAfee firewall/anti-virus for Zone Alarm/Comodo and AVG/AVAST you'll really notice a difference in performance. Norton is just as bad.

I'm also not a fan of real player so if you ask me I would remove it, in it's place I've downloaded Real Alternative which are the codecs to run .ra and .rm files. However if you use real player for streaming sites (Radio shows, etc) then you may want to keep it unless you have the option of changing to windows media player. And yes, Virginia, there is also a Quicktime Alternative ...although since you have ITunes you're forced to keep Quicktime.

I'll post other things you can do to help increase speed later on, for now Zango and McAfee would be my concerns...not to mention what will make the biggest difference. Let me know if you have any questions or problems.

 

[Yeagermeister]

You have mcafee installed? that explains all the problems.

 

[Dawgs0916]

the problem is i thought i already deleted zango....ugh and removing mcafee as we speak. i ran avast and it found a few adwares and trojans but the popups still keep coming! is there any significance to the way they all start with "CiD:" and then the url?

 

[Yeagermeister]

the problem is i thought i already deleted zango....ugh and removing mcafee as we speak. i ran avast and it found a few adwares and trojans but the popups still keep coming! is there any significance to the way they all start with "CiD:" and then the url?

I hate to say it but you might be better off formatting and reinstalling.

 

[BrAinPaiNt]

I would suggest you save any files, make a word document with your email and ISP information and passwords.

After that I think you should reformat your hard drive.

You have so much junk on there I would be shocked if your computer does not bog down.

I seen at least 3 browser tool bars. Normally that means you have downloaded some stuff and that part of those things had tool bars with them and you just kept clicking yes.

ONE browser tool bar should be the max IMO. Heck I do not add them at all on my computer but if I was pressed to have to use one I would just use one and stick with the google one.

Also if you are not using AOL stuff than remove any AOL stuff that may come with your computer.

Some of those search programs are usually crap as well.

To me you should reformat and start from scratch.

When I would download or install a bunch of stuff on a regular basis I would usually reformat around once a year (sometimes a year and a half).

It looks like you just have too many junk programs on your puter. Reformatting would get rid of the spy ware and by also getting rid of some of the other stuff I bet your computer would run better.

Problem is if you have some standard computer software (like compaq, hp and some others) that either have the system restore stored on you hard drive or have their own system restore disk...they always contain a bunch of programs you just don't use or need.

First thing I do when I install a new puter with all of that stuff (like compaq, hp and others) is to go through and remove a bunch of junk programs they have on them.

It gets rid of a bunch

 

[GTaylor]

Why would you want to reformat? While it would help the PC run better it's akin to operating a chainsaw to slice bread. I would only consider this as a last resort, unless you have a rootkit in which case reformat would be the only option.

CID: is part of a program CiD Help and/or CiD Manager, look for it in Add/Remove and uninstall. BTW,
O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Application Data\flag ace stupid data\Hole About.exe is part of your pop-up problem. If it still exists after removing CID manually remove it.

I didn't mention anything about the AOL since IM was installed for both AOL and Yahoo but you could use Trillian or gaim in it's place as both will work with Yahoo/AOL. Toolbars the same way, I've never used them and would delete but if you're using it I wouldn't uninstall it.

One other item you could do is uncheck programs that start up.

- Start
- Run
- type in: msconfig (Enter)
- Go to last tab (Startup)

I don't know exactly whats in there but I would assume these are there and would uncheck:

jucheck.exe
jusched.exe

Anything with: real, AOL, Yahoo, Itunes, Nero, Quicktime (qttask). None of these programs should be running in the background and can always be manually started.

 

[CowboyJeff]

You have mcafee installed? that explains all the problems.

free.grisoft.com works for me.

 

[CowboyJeff]

Why would you want to reformat? While it would help the PC run better it's akin to operating a chainsaw to slice bread. I would only consider this as a last resort, unless you have a rootkit in which case reformat would be the only option.

CID: is part of a program CiD Help and/or CiD Manager, look for it in Add/Remove and uninstall. BTW,
O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Application Data\flag ace stupid data\Hole About.exe is part of your pop-up problem. If it still exists after removing CID manually remove it.

I didn't mention anything about the AOL since IM was installed for both AOL and Yahoo but you could use Trillian or gaim in it's place as both will work with Yahoo/AOL. Toolbars the same way, I've never used them and would delete but if you're using it I wouldn't uninstall it.

One other item you could do is uncheck programs that start up.

- Start
- Run
- type in: msconfig (Enter)
- Go to last tab (Startup)

I don't know exactly whats in there but I would assume these are there and would uncheck:

jucheck.exe
jusched.exe

Anything with: real, AOL, Yahoo, Itunes, Nero, Quicktime (qttask). None of these programs should be running in the background and can always be manually started.

Me thinks GTaylor knows what he is talking about. Be careful if you are infected with a rootkit. They are extremely difficult to remove (and they tend to return quickly). Whenever I see a rootkit, I always do a fresh install of XP from a Ghost image. You cant be too safe. Try downloading one of those free antivirus apps and run them in safe mode with no internet connectivity. Viruses/trojans/Malware tend to re-download themselves when they are removed incorrectly.

 

[Kangaroo]

The pop ups suggest spyware ot a virus. The free spybot is better than the windows defender also

I say download and install

http://www.safer-networking.org/en/index.html

Also i like using this as well to help prevent more is called spyware blaster by java cool

http://www.javacoolsoftware.com/sbdownload.html

 

[Faerluna]

I also see in your programs that you're using Smiley Central.

Despite what any spyware programs tell you, this is not spy ware, adware, malware, doesn't make your computer run slower, etc. I work for the company that makes this software and I can say on my Cowboys-loving honor that it is an absolutely clean program.

My 2 cents.

 

[Dawgs0916]

ok, well i havent been able to find any of the programs you told me to uninstall in the add/remove. especially not the CiD. i even went to the files and did a search and found nothing with that. im going crazy, my computer has never been this slow. it took me over 15 minutes just to get to this point to be able to reply to these posts! agh what is my best bet?! my computer is close to useless right now...

 

[GTaylor]

I also see in your programs that you're using Smiley Central.

Despite what any spyware programs tell you, this is not spy ware, adware, malware, doesn't make your computer run slower, etc. I work for the company that makes this software and I can say on my Cowboys-loving honor that it is an absolutely clean program.

My 2 cents.

I saw the Smiley Central and was going to bring it up but after doing some research I noticed noone was complaining about it being installed without their knowledge, so I ignored it.

There are many places he could have installed the spyware, though a shareware program, one of the IM programs, through a keygen program (Although those are more likely trojans than spyware) or he may have thought he was downloading a legit program when he was really downloading from an unscrupulous site.

 

[BrAinPaiNt]

ok, well i havent been able to find any of the programs you told me to uninstall in the add/remove. especially not the CiD. i even went to the files and did a search and found nothing with that. im going crazy, my computer has never been this slow. it took me over 15 minutes just to get to this point to be able to reply to these posts! agh what is my best bet?! my computer is close to useless right now...

Reformat.

I don't care if Gtaylor says it is like taking a chainsaw to a piece of bread, the bottom line is that it WILL take care of the problem and your computer Will run better.

It is one thing if you know a great deal about computers and you know how to go in and clean the registry, how to go into safe mode to get rid of some files. If you find every DLL and every file that some of these programs hide on your computer.

But the bottom line is a reformat is the quickest way and the way a layman can make sure to get 100% of the viruses/spyware off of your computer.

Plus it will help the computer run better without all of the other programs that you know longer need.

Sometimes the so called piece of bread turns into a redwood and only a chainsaw will work.

Sometimes these programs can be really nasty and sneaky. You can remove what you think is all parts of it only to restart your computer and find that it has loaded itself back onto your computer because you missed on hidden file.

Sometimes you have to remove these things from the computer in safe mode because they are already running in regular mode when you try to remove them and it will not let you.

Sometimes you may actually remove all of the program only to realize that it was using a shared DLL that other programs were using and now with that DLL missing it causes other programs to mess up.

The only 100% way to get rid of it, while at the same time improving your computers performance, is to reformat and start from scratch.

I have seen laymen time and time again wind up going through step after step, program after program, aggravation after aggravation only to finally to come to the conclusion that they need to start from scratch.

You can keep going with trying to take this or that off per GTaylor but in the end I will not be shocked if you come to the final conclusion just to reformat your drive.

 

[GTaylor]

Ouch, man! Why you breaking my manhood? It's still a chainsaw to butter issue and I have no problem recommending a reinstall, but if the issue is a single software then you're talking about spending hours to reinstall/update patches over something that could be resolved in minutes. Not only that but without knowing what caused the issue a user could be unwittingly putting themselves back in the muck that got them in trouble in the first place *Steps off Soapbox*

...with that said, I agree with BP to do the reinstall because we did the software removal and it didn't work (Why, as BP mentioned - could be hidden in the registry, could be using rootkit techniques to hide itself from the system, could be a thousand things.) So here's the steps I recommend:

- If you don't have the downloaded files for firewall/anti-virus/anti-spyware immediately download now and save to a cd
- Save all your important work/bookmarks, files, etc (Duhh)
- Do the reformat/reinstall
- After it's done, immediately install the firewall/anti-virus/BoClean/anti-spyware
- Goto Windows Update and update your patches (If you have MS Office installed then go to Office Update and do the same)
- Whatever software you use (Adobe, Java, Winamp, Quicktime, etc) download the latest version as older ones may have security holes that can be exploited
- Ask yourself if you really need certain software (Toolbars, IMs, etc), try to minimize this.
- Also be weary of software you download thats "Shareware" or where you download it from (Codecs especially!)
- Don't install any software that uses keygens (About 50% are trojans)

If this doesn't work, install linux. Screw the chainsaw, drop an A-Bomb on that stick of butter and start all over the proper way