$50 if you help me ~ Part 2

format

and next time dont click on stupid shit and keep windows updated

keep your 50

Search and install a program called Spykiller (it works)

check.. :

start -> execute .. enter "regedit"

HKEY_LOCAL MACHINE -> SOFTWARE -> MICROSOFT -> WINDOWS -> CURRENT VERSION -> RUN ..

you'll see lots of spywares . exe

Install anti spyware software.

I have.

I don't see anything that shouldn't be there.

Sounds about right !!

Hey download the program NoAdware 2.0 and search for updates in it :D it finds almost everything ;) ill promise you this is gonna work :D.... it finds the impossible ones too... ;)

Did you try what I suggested? I had the same problem and got rid of it.

Format is not an option, I don't click on stupid shit, and I do keep windows updated.

download and install all windows updates as well

I tried everything everyone suggested in the last thread.

I do and I did. Popups are still here.

if that doesnt work here run HiJack This program ;) it is called

"HiJack This"

see when you scan if any of those resaults come up:

O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - C:\WINDOWS\System32\msmk.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

if so then put a check on it and then press FIX it will ask if you want to backup just backup ;) ive had this one before :d... here ;) well if your not lying i think :D i own these 50 :D....

Restart the computer.

Empty your Temporary Internet Files and history in Internet Options. And clean out your
%Userprofile%\Local Settings\Temp
folder. It's a good idea to do that regularly.

Did anyone look at the site I posted to see what it is?

you'll need virus scan, trojan hunter, and adaware professional.

Be sure you have the latest update patch for each program.

If your running windows XP go into control panel. system. and turn off system restore. then update.

Go into your systems TEMP folder under windows and delete everything in there.

Delete your temporary internet files and your IE cache (if you use IE)

Empty your recycle bin.

Shut your computer down and start it in safe mode by holding F8 on the bootup.

then run trojan hunter. (www.trojanhunter.com)

Virus Scan. (norton or mcafee should work fine)

and finally AdaWare Pro.

Once all three of these programs have run through completely opt to delete any crap they come up with, when all is finished, reboot and problem should be solved.

Long and drawn out yes, but helpful hopefully. My sister had the same problem on her comp and the above fix worked. The majority of people who have trojan and virus softwared void its effectiveness by running it daily, but not running it in safe mode.
anything other than safe mode and something will usually get missed.

Hope this helps. If not I apologize and wish you luck.

Try my idea CollegeSucks it should work just try ;)....

install both Ad-aware and Spybot (Search & Destroy) works well with each other. they have different databases

Lol :D it should work using just HiJack This and go by my option it is quick and should fix your problem

Download HiJack This from Here
Download NoAdware from Here

And just run NoAdware with the newest update like in the post above just so you didnt miss my posting =) cuz my fix should work :D and HiJack follow my items in that post and if that works these 50 are mine :D its easy its quick and it does solve your problem

-------------
From Previous Post
-------------
O2 - BHO: (no name) - haha123;98DBBF16-CA43-4c33-BE80-99E6694468A4} - C:\WINDOWS\System32\msmk.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

you never posted the results from hijack this

Didn't it work CollegeSucks ;)....

if not then here this is a definent solution ;) Pestpatrol :D is a program you buy and it costs alot but i can give it to you here its 6MB :P and it has database over THOUSANDS of spywares here :D including more like Internet Optimizer and other spywares here ;)

PestPatrol For Free For You CollegeSucks

Hijackthis is the shiznit, has worked for every spyware/adware problem I have come accross.

You could also use the free web-based service at http://www.sarc.com .

Scroll down to "Check for Security Risks" button. If it finds anything it will give you suggestions on how to fix the problem. And there's a lot of free removal tools.

Hope that helps.

I couldn't get it to download. If anyone ask the latest version, can you email it to me?

joseph4829 at yahoo.com

CollegeSucks why cant you answer ;) my way is working like a charm just install Pest Patrol and your save for ever :S... i mean it got 200 spywares other programs did not get..

I don't reply unless I have a question or have tried it yet. Downloading now to see if it works.

I installed the pest patrol you gave me and it didn't install anything.

I tried it too... went through install and then nothing..

Here is what Hijack this gave me....


Logfile of HijackThis v1.98.0
Scan saved at 1:49:05 AM, on 7/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Joseph\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS11
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: (no name) - {85CBFDE0-B26B-4EE5-BD3C-4DE111DE763E} - C:\WINDOWS\System32\winnet.dll
O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - C:\WINDOWS\System32\msmk.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: Quick To-Do PRO.lnk = C:\Program Files\Quick To-Do Pro\qtodopro.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Help - {0987DF24-9BA4-45B5-8B17-4E6FB0BCEE48} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {C9FA2E8A-4BEE-4AA4-86A9-097A12D809E6} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {D55A7B55-1C7B-44DD-B3AA-B57020FA94BA} - http://www.comcastsupport.com (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: http://*.pictureratingsites.com
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.napster.com/client/setup.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/def...ploader_v5.cab

Contact me 292387969

Why?

File csrss.exe & svchost.exe are related to keyloggers. Someone has control of your computer. post your e-mail address. I have a program to send you.

Sorry, didn't see it before. I'm sending the program now.

hahah, don't install anything this guy is trying to give you
those aren't necessarily keyloggers, they're windows services...
download and install what the other guy gave you... pestpatrol...
then run the update
then run the program....
it should scan your system, take 5 minutes... present you with all your cookies, all your spyware, etc...

Really??

Smss.exe description:
File smss.exe is related to adware ConfigSys. File smss.exe is related to keylogger Employee Watcher. File smss.exe is related to keylogger ICE Remote Spy. File smss.exe is related to keylogger Is My Mate Cheating Online. File smss.exe is related to keylogger Key Logger Buddy Pro. File smss.exe is related to keylogger KidWatcher. File smss.exe is related to keylogger Spy Software 4 Parents.

Files related to Smss.exe:
smss.exe, csrss.exe, svchost.exe, Uninstall.exe, uninstall.dat



File Smss.exe removal:
WARNING!!! File Smss.exe is related to keyloggers. Your system is under security threat. We advice you to scan your computer and eliminate possible threats

really
smss is a windows session manager...
csrss is dll subsection manager...
if you want, load up a command prompt, and type:
tasklist /svc

it'll show you every dll hook attached to csrss...
if you want more info, look on the microsoft site

smss CAN be exploited by common trojans, but it's also a default service in winxp....
(take a look at your process manager, you'll probably see it there too.....)

Whatever man, he doesn't have to listen to me if he doen't want to.

http://www.2-spyware.com/file-smss-exe.html

here man...
http://www.microsoft.com/resources/d...c_str_elqj.asp

search for smss.exe

straight from microsoft

I'm just going from what the website says, maybe their wrong but they have helped me in the past.

Lol you install the software and you run it up launch it.... go and update it and then you say SCAN ALL DRIVES and then just FILE -> SCAN and when it is done scanning you press select all and del thats how it works it erases it i know it will its just eather that you are saying this so you dont have to pay.... cuz this program is the best in the bizzness

SEE THIS GUY HAS HIS MIND IN A RIGHT PLACE... follow my instructions pestpatrol is rare to find online... but i gave it to you and this guy knows im not lying the other guy is babbling

Try to locate file winnet.dll inside windows/system dir
and just delete this file (winnet.dll)
(must run safe mode for this).


Also see file c:\windows\setupapi.log .
This file contains plenty useful information
about what were installs on your computer
so far... and you can see what happened.


This works on WIN ME, but I suppose
for XP must be similarly.

Hope this help

csrss.exe

http://research.pestpatrol.com/Searc...6b1e0b2fe7cfe0

Thats what i am saying :D pestpatrol takes it automaticly :D but somehow this guy is trying to say that installing it and updating wont work he wont even get to scan it thats bullshit i was scanning mine and delete mine

if its that bad, wipe the drive already.

give up dude
check your computer, you'll see that csrss.exe is running there as well..
it runs on ALL machines...

It CAN be overwritten/modified to be used as a keylogger, but, it's also a vital part of windows...