Member Avatar for Celor

Hello, it has been a while since I posted here, but last time I did you people helped out alot. So, now I have another problem! THis time with spyware.

I have this thing that keeps coming on called "MyWebSearch installer" Which is this installer (duh :P) that pops up every so often, and the only way to stop it is to puch the alt-ctrl-del keys.

I have tried using

-Spybot: Search and Destroy.
-AD-ware SE (By Lavasoft)
-HiJackThis.

None of them seemd to help.

Also I allways have this bachground program runnign that is called "Pop64" which makes these annoying pop-ups occur all of the time.

((HiJackThis log))

Logfile of HijackThis v1.99.0
Scan saved at 6:02:51 PM, on 3/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME22\Binn\sqlservr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ptech.exe
C:\WINDOWS\system32\ptech.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Efficient Networks\EnterNet 300\app\EnterNet.exe
C:\Program Files\AIM\aim.exe
C:\NeverwinterNights\NWN\nwtoolset.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\HiJackThis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {1F2DF599-7765-2434-1AFE-D343FD69EB88} - (no file)
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O4 - HKLM\..\Run: [kyoktn] c:\windows\system32\kyoktn.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [sixtysix] C:\WINDOWS\sixtypopsix.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ptech] C:\WINDOWS\system32\ptech.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe


Any help would be greatly appreciated.

  • 3 Contributors
  • 2 Replies
  • 109 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by alfman

Dani AI

Generated

The symptoms in this thread point to persistent adware that can reinstall itself from multiple places (startup entries, scheduled tasks, browser helpers or leftover services). The directions from to try an updated removal tool and from about a second-opinion scanner are sensible. A short, safe workflow — using up-to-date scanners, autorun inspection, and offline rescue media when needed — usually resolves installers that keep popping up.

Recommended removal sequence (do these in order):

  • Boot to Safe Mode (F8) to stop the offending process from respawning, then run an on-demand anti‑malware scan (use a current, reputable scanner).
  • Run an adware/PUA cleaner next, followed by a second-opinion scanner to find anything missed.
  • Use Autoruns to view and disable suspicious startup items (uncheck first, don't delete immediately), then inspect browser add-ons, proxy settings and the hosts file.
  • If processes keep returning, boot from rescue media or an offline scanner and run a full disk/rootkit check.

Tools and references that help with these steps: Malwarebytes and its adware cleaner for PUPs, HitmanPro as a fast second-opinion scanner, and Microsoft Sysinternals Autoruns/Process Explorer to inspect and disable persistent starters. Use offline rescue media or a rescue ISO when active scanners cannot remove a component.

Cautions and last resorts: back up user data and create a disk image before removing files or editing the registry; note the full path and publisher before deleting. If the system is still infected after the above, a clean OS reinstall is the safest option — especially on an unsupported OS. Consult the official Windows end-of-support guidance before continuing.

Recommended Answers

All 2 Replies

Member Avatar for alfman

Hello, it has been a while since I posted here, but last time I did you people helped out alot. So, now I have another problem! THis time with spyware.

I have this thing that keeps coming on called "MyWebSearch installer" Which is this installer (duh :P) that pops up every so often, and the only way to stop it is to puch the alt-ctrl-del keys.

I have tried using

-Spybot: Search and Destroy.
-AD-ware SE (By Lavasoft)
-HiJackThis.

None of them seemd to help.

Also I allways have this bachground program runnign that is called "Pop64" which makes these annoying pop-ups occur all of the time.

((HiJackThis log))

Logfile of HijackThis v1.99.0
Scan saved at 6:02:51 PM, on 3/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME22\Binn\sqlservr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ptech.exe
C:\WINDOWS\system32\ptech.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Efficient Networks\EnterNet 300\app\EnterNet.exe
C:\Program Files\AIM\aim.exe
C:\NeverwinterNights\NWN\nwtoolset.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\HiJackThis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {1F2DF599-7765-2434-1AFE-D343FD69EB88} - (no file)
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O4 - HKLM\..\Run: [kyoktn] c:\windows\system32\kyoktn.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [sixtysix] C:\WINDOWS\sixtypopsix.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ptech] C:\WINDOWS\system32\ptech.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe


Any help would be greatly appreciated.

hi my name is alfman i had ths same prob and tried hitmanpro and the prob is now gone so i hope that it works for you too

kind reguards alfman

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.