FRIHOST • FORUMS • FAQ • TOS • BLOGS • DIRECTORY
You are invited to Log in or Register a Frihost Account!

GAHHH! POPUPS!!!!!!

   Frihost Forum Index -> Computers -> Computer Problems and Support
 


bladesage
I am really ticked off at this point, to say the least. I have popup ad blockers, that block any browser ads. But the problem is, these are nothing like normal popups...



Sorry for the enormous pic, it doesn't look legible shrunk.

I have a Gateway 600YGR Laptop, with dual intel processors of some speed, 512 MB memory, and a 50 GB hard drive.

This is most frustrating, as you can well imagine. I haven't a penny to my name, so I can't pay for any miracle software. I just really need some help here Confused.

Thanks for the time (and putting up with my huge pic)!!!
Chris24
All for free programs you can use.

Ad-Aware.......... http://www.lavasoft.com/
Spybot......... http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10401314.html?tag=lst-0-1

Avg antivirus............ http://free.grisoft.com/doc/1


Should get ya going
Sunny
This is not a popup, seems like you are affected by adware/broowser hijackers. As chris said you can try and run adware remover softwares. or download a small utility "hijack this" and copy its log here for us to be able to help you.
yjwong
You can download HijackThis and then go to http://hijackthis.de. Scan your computer and paste the log file generated to the textbox there. It will auto analyse your log.
bladesage
Hijack This wrote:

Logfile of HijackThis v1.99.1
Scan saved at 8:53:29 AM, on 4/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
C:\Program Files\GoGoData.com\GoGoData Toolbar\GoGoTray.exe
C:\PROGRA~1\GoGoData.com\GOGODA~1\ADBUST~1.EXE
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spyware Sledgehammer\Spyware Sledgehammer.exe
C:\PROGRA~1\Yahoo!\browser\ybrowser.exe
C:\Documents and Settings\Alex\My Documents\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/
O2 - BHO: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - C:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O3 - Toolbar: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - C:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe"
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [STDL] C:\WINDOWS\system32\stub.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
O4 - HKCU\..\Run: [GoGoTray.exe] C:\Program Files\GoGoData.com\GoGoData Toolbar\GoGoTray.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Project1.lnk = C:\WINDOWS\system32\Stub.exe
O9 - Extra button: (no name) - {7B6E4BB4-8464-47CF-9A5B-F82F6B408A6E} - C:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O9 - Extra 'Tools' menuitem: GoGoData AdBuster - {7B6E4BB4-8464-47CF-9A5B-F82F6B408A6E} - C:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144349603407
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144349596577
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


I actually still had hijackthis from when I contacted Microsoft for help, so here's my new log. I considered them popups because they
appear in vast quantities, and severely slow my computer. Thanks!!
Chris24
Alex

get rid of or stop the process of gogo data. That should help right off the bat.

That also means editing startup in msconfig , to make sure this process does not start when u turn on computer

Then go about scanning and rescanning to find this little bugger
Sunny
After looking at the logs, one would get the impression
that gogodata is messing it up for you, but gogodata is listed in downloads.com with a cnet rating of 5 out of 5.
How can a process be adware when cnet rates it so high.

Moving little down I found this

Startup: Project1.lnk = C:\WINDOWS\system32\Stub.exe
- HKLM\..\Run: [STDL] C:\WINDOWS\system32\stub.exe

What is stub.exe? little search on net game me this info

Quote:
Process File: stub.exe

Process Name:Ezula
Author:

Description:

The process is harmful as it refers to adware and spyware program types. The application collects personal and secret information from your computer (e.g. passwords) and sends it to third parties. Moreover, your Internet experience may be interrupted by a multitude of pop-up windows and banners. The process must be deleted immediately.

SOURCE

Unless you are sure if that file is something else which is safe I suggest you to delete the file immediately and delete the registry keys using hijack this.
bladesage
I ran Hijack this again, and wiped everything off the list. I uninstalled GoGoData Toolbar first. I still have the problem, it seems more frustrating now than ever.

I very much appreciate the help, and the fact that you care enough to research it. I just wish this was gone.
Chris24
did you remove the gogodata.dll from your registry?
bladesage
Well, I didn't see anything for gogodata.dll, but I got 2 more screenshots looking for it:

Both at:

http://defection.frih.net/other/screenshots-a.htm

(This topic is already too huge)
Chris24
Quote:
O2 - BHO: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - C:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O3 - Toolbar: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - C:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL



See if the tomaha~1.dll is still in ur registry
Daniel15
That message seems to be related to Casino sites... Do a search for "click ok to download our free software while browsing the site"

Maybe this will help you?
Reply to topic    Frihost Forum Index -> Computers -> Computer Problems and Support

FRIHOST HOME | FAQ | TOS | ABOUT US | CONTACT US | SITE MAP
© 2005-2007 Frihost, forums powered by phpBB.