Re: Persistant Page Popups

David H. Lipman wrote:
From: "Scorchar" <burnt@xxxxxxxxx>

| I use WinXP SP2 with all updates inc IE7

| This is an example of what's been happening for weeks:
| - Startup
| - call Google with IE7 (Firefox 2 responds the same way)
| - search for "convert flac to mp3" (I don't need help with that search)
| - select www.mymusictools.com & the expected page opens
| - 2 other pages also open: www.amaena.com & www.smartaudioconverter.com
| - I closed those 2 pages & backed up to Google & www.myshopping.com.au
| opened as well as Google.

| This is one of many such incidents.

| - I was using AVG free anti virus at the time when it first started
| along with Zone Alarm.
| - I'm now using the trial version of Pc_cillin Internet Security 2007
| - I've run Ad-Aware & SpyBot with their latest updates.

| I know that I can suppress the page content using the Hosts files, but
| that doesn't stop the page itself from trying to open.

| How can I stop the unwanted pages from opening, preferably for IE7 & FF2?



Two phase answer...

Perform Part 1 then perform Part 2

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 6.0,
then you are strongly urged to remove any/all versions.
There are vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 6.0

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.6.0

http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1




Part 1
------------
Download Adware-Virtumundo Removal Tool -- http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are
using WinXP, Win2K or Win2003 your system will be left in a state where you will have to
manually shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in
your bowser but your PC will automatically be shutdown. It is suggested that you move the
report out of c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:
--------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *


Thanks for responding David.

I've re-installed Java 6.0; I was using v5.0

VirtumundoBeGone.exe worked as expected.

WinFixerFix.exe wouldn't run.

vundofix.exe worked except it couldn't remove c:\windows\system32\wprsalei.dll.
I can't find any reference to that file on the net & it didn't show up on a search, so I deleted the 2 references to it from my registry. That was risky as I didn't know what the file was for, however given the nuisance value of what was happening, it was an acceptable risk.

Everything is working within normal parameters again. Thank you.

My VundoFix report:

VundoFix V6.3.6

Checking Java version...

Scan started at 9:06:06 AM 15 Feb 07

Listing files found while scanning....

C:\WINDOWS\system32\awtqnml.dll
C:\WINDOWS\system32\awtqool.dll
C:\WINDOWS\system32\awtuurs.dll
C:\WINDOWS\system32\awtuuvs.dll
C:\WINDOWS\system32\byxvvuv.dll
C:\WINDOWS\system32\byxwwxv.dll
C:\WINDOWS\system32\byxxxut.dll
C:\WINDOWS\system32\cbxursr.dll
C:\WINDOWS\system32\cbxwvvs.dll
C:\WINDOWS\system32\cbxywwx.dll
C:\WINDOWS\system32\cbxyyvv.dll
C:\WINDOWS\system32\ddccdcb.dll
C:\WINDOWS\system32\ddcddda.dll
C:\WINDOWS\system32\ddcdeff.dll
C:\WINDOWS\system32\ddcywtt.dll
C:\WINDOWS\system32\efcbaba.dll
C:\WINDOWS\system32\efcbxvu.dll
C:\WINDOWS\system32\efcccdb.dll
C:\WINDOWS\system32\efcyaww.dll
C:\WINDOWS\system32\fccbaww.dll
C:\WINDOWS\system32\fccbbbc.dll
C:\WINDOWS\system32\fccccdc.dll
C:\WINDOWS\system32\fccdbya.dll
C:\WINDOWS\system32\gcagtijt.ini
C:\WINDOWS\system32\gebcbcb.dll
C:\WINDOWS\system32\gebcbcd.dll
C:\WINDOWS\system32\gebyxuv.dll
C:\WINDOWS\system32\hggdbax.dll
C:\WINDOWS\system32\hggdccd.dll
C:\WINDOWS\system32\hggebxv.dll
C:\WINDOWS\system32\hgggddc.dll
C:\WINDOWS\system32\hgghfcy.dll
C:\WINDOWS\system32\hgghgfc.dll
C:\WINDOWS\system32\hgghhec.dll
C:\WINDOWS\system32\iifeecc.dll
C:\WINDOWS\system32\iiffday.dll
C:\WINDOWS\system32\iifffee.dll
C:\WINDOWS\system32\jcybyoqt.ini
C:\WINDOWS\system32\ljjggdc.dll
C:\WINDOWS\system32\ljjihfc.dll
C:\WINDOWS\system32\ljjiifg.dll
C:\WINDOWS\system32\mljgdax.dll
C:\WINDOWS\system32\mljgebb.dll
C:\WINDOWS\system32\mljggdb.dll
C:\WINDOWS\system32\mljghed.dll
C:\WINDOWS\system32\mljhigh.dll
C:\WINDOWS\system32\mljkigf.dll
C:\WINDOWS\system32\mljkiij.dll
C:\WINDOWS\system32\nnnkjjj.dll
C:\WINDOWS\system32\nnnolji.dll
C:\WINDOWS\system32\nnnonop.dll
C:\WINDOWS\system32\opnmmkk.dll
C:\WINDOWS\system32\pmnmlmj.dll
C:\WINDOWS\system32\pmnmmmn.dll
C:\WINDOWS\system32\pmnmnkk.dll
C:\WINDOWS\system32\qomjhge.dll
C:\WINDOWS\system32\rqrpooo.dll
C:\WINDOWS\system32\rqrrpml.dll
C:\WINDOWS\system32\rqrrsst.dll
C:\WINDOWS\system32\ssqoljk.dll
C:\WINDOWS\system32\ssqomnn.dll
C:\WINDOWS\system32\ssqqoon.dll
C:\WINDOWS\system32\tjitgacg.dll
C:\WINDOWS\system32\tqoybycj.dll
C:\WINDOWS\system32\tuvsrss.dll
C:\WINDOWS\system32\tuvttro.dll
C:\WINDOWS\system32\ufdhrrnv.ini
C:\WINDOWS\system32\urqqrsr.dll
C:\WINDOWS\system32\vnrrhdfu.dll
C:\WINDOWS\system32\wprsalei.dll
C:\WINDOWS\system32\wvusrom.dll
C:\WINDOWS\system32\wvutqqn.dll
C:\WINDOWS\system32\xxyayxw.dll
C:\WINDOWS\system32\xxywxxx.dll
C:\WINDOWS\system32\xxyxxyx.dll
C:\WINDOWS\system32\xxyyyxx.dll
C:\WINDOWS\system32\yayyxvv.dll
C:\WINDOWS\system32\yayyxwt.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\awtqnml.dll
C:\WINDOWS\system32\awtqnml.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtqool.dll
C:\WINDOWS\system32\awtqool.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtuurs.dll
C:\WINDOWS\system32\awtuurs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtuuvs.dll
C:\WINDOWS\system32\awtuuvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxvvuv.dll
C:\WINDOWS\system32\byxvvuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxwwxv.dll
C:\WINDOWS\system32\byxwwxv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxxxut.dll
C:\WINDOWS\system32\byxxxut.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxursr.dll
C:\WINDOWS\system32\cbxursr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxwvvs.dll
C:\WINDOWS\system32\cbxwvvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxywwx.dll
C:\WINDOWS\system32\cbxywwx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxyyvv.dll
C:\WINDOWS\system32\cbxyyvv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddccdcb.dll
C:\WINDOWS\system32\ddccdcb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcddda.dll
C:\WINDOWS\system32\ddcddda.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcdeff.dll
C:\WINDOWS\system32\ddcdeff.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddcywtt.dll
C:\WINDOWS\system32\ddcywtt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcbaba.dll
C:\WINDOWS\system32\efcbaba.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcbxvu.dll
C:\WINDOWS\system32\efcbxvu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcccdb.dll
C:\WINDOWS\system32\efcccdb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcyaww.dll
C:\WINDOWS\system32\efcyaww.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccbaww.dll
C:\WINDOWS\system32\fccbaww.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccbbbc.dll
C:\WINDOWS\system32\fccbbbc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccccdc.dll
C:\WINDOWS\system32\fccccdc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fccdbya.dll
C:\WINDOWS\system32\fccdbya.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gcagtijt.ini
C:\WINDOWS\system32\gcagtijt.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcbcb.dll
C:\WINDOWS\system32\gebcbcb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcbcd.dll
C:\WINDOWS\system32\gebcbcd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebyxuv.dll
C:\WINDOWS\system32\gebyxuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggdbax.dll
C:\WINDOWS\system32\hggdbax.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggdccd.dll
C:\WINDOWS\system32\hggdccd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggebxv.dll
C:\WINDOWS\system32\hggebxv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgggddc.dll
C:\WINDOWS\system32\hgggddc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghfcy.dll
C:\WINDOWS\system32\hgghfcy.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghgfc.dll
C:\WINDOWS\system32\hgghgfc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghhec.dll
C:\WINDOWS\system32\hgghhec.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iifeecc.dll
C:\WINDOWS\system32\iifeecc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iiffday.dll
C:\WINDOWS\system32\iiffday.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iifffee.dll
C:\WINDOWS\system32\iifffee.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jcybyoqt.ini
C:\WINDOWS\system32\jcybyoqt.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjggdc.dll
C:\WINDOWS\system32\ljjggdc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjihfc.dll
C:\WINDOWS\system32\ljjihfc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjiifg.dll
C:\WINDOWS\system32\ljjiifg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgdax.dll
C:\WINDOWS\system32\mljgdax.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgebb.dll
C:\WINDOWS\system32\mljgebb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljggdb.dll
C:\WINDOWS\system32\mljggdb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljghed.dll
C:\WINDOWS\system32\mljghed.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljhigh.dll
C:\WINDOWS\system32\mljhigh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljkigf.dll
C:\WINDOWS\system32\mljkigf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljkiij.dll
C:\WINDOWS\system32\mljkiij.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnkjjj.dll
C:\WINDOWS\system32\nnnkjjj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnolji.dll
C:\WINDOWS\system32\nnnolji.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnonop.dll
C:\WINDOWS\system32\nnnonop.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\opnmmkk.dll
C:\WINDOWS\system32\opnmmkk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnmlmj.dll
C:\WINDOWS\system32\pmnmlmj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnmmmn.dll
C:\WINDOWS\system32\pmnmmmn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnmnkk.dll
C:\WINDOWS\system32\pmnmnkk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qomjhge.dll
C:\WINDOWS\system32\qomjhge.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrpooo.dll
C:\WINDOWS\system32\rqrpooo.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrrpml.dll
C:\WINDOWS\system32\rqrrpml.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrrsst.dll
C:\WINDOWS\system32\rqrrsst.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqoljk.dll
C:\WINDOWS\system32\ssqoljk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqomnn.dll
C:\WINDOWS\system32\ssqomnn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqqoon.dll
C:\WINDOWS\system32\ssqqoon.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tjitgacg.dll
C:\WINDOWS\system32\tjitgacg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tqoybycj.dll
C:\WINDOWS\system32\tqoybycj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvsrss.dll
C:\WINDOWS\system32\tuvsrss.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvttro.dll
C:\WINDOWS\system32\tuvttro.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ufdhrrnv.ini
C:\WINDOWS\system32\ufdhrrnv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\urqqrsr.dll
C:\WINDOWS\system32\urqqrsr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vnrrhdfu.dll
C:\WINDOWS\system32\vnrrhdfu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wprsalei.dll
C:\WINDOWS\system32\wprsalei.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvusrom.dll
C:\WINDOWS\system32\wvusrom.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvutqqn.dll
C:\WINDOWS\system32\wvutqqn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyayxw.dll
C:\WINDOWS\system32\xxyayxw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxywxxx.dll
C:\WINDOWS\system32\xxywxxx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyxxyx.dll
C:\WINDOWS\system32\xxyxxyx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyyyxx.dll
C:\WINDOWS\system32\xxyyyxx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yayyxvv.dll
C:\WINDOWS\system32\yayyxvv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yayyxwt.dll
C:\WINDOWS\system32\yayyxwt.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.6

Checking Java version...

Scan started at 9:13:41 AM 15 Feb 07

Listing files found while scanning....


VundoFix V6.3.6

Checking Java version...

Scan started at 9:18:35 AM 15 Feb 07

Listing files found while scanning....

C:\WINDOWS\system32\wprsalei.dll

Beginning removal...

Performing Repairs to the registry.
Done!

VundoFix V6.3.6

Checking Java version...

Scan started at 9:25:52 AM 15 Feb 07

Listing files found while scanning....


VundoFix V6.3.6

Checking Java version...

Scan started at 9:47:04 AM 15 Feb 07

Listing files found while scanning....

No infected files were found.

.

Relevant Pages

  • A good Java installation package can make things much easier
    ... Following the configuration habit of Java, ... the installation deployment of report designer ...
    (microsoft.public.sqlserver.olap)
  • Lotus Notes Viewer not opening ZIP files created using Java
    ... We have a Java Notes agent in a Domino application which automatically creates reports in Zip format and sends them to several users on a daily basis. ... The Lotus Notes R5/R6/R7 View action button in the Attachment property box does not work for Zip files created using Java. ... We have a servlet that creates a report and attaches it as a .ZIP file ...
    (comp.lang.java.help)
  • Bug report on Font.canDisplay
    ... SDN members can obtain fully licensed Java IDEs ... Java Developer Bug Report Review Team ... It treats displaying a non-descript blob or box ... I understand the problem is the fonts LIE. ...
    (comp.lang.java.programmer)
  • Re: Confused by Java
    ... going all the way to the critical updates ... Is one of these the update needed for Java? ... Microsoft is no longer allowed to provide its own Java ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: June Windows Updates breaks Java?
    ... We found that the percentage of issues compared to the security concerns, so we weighed the risks and decided to let critical updates install. ... I have found that it doesn't seem to matter what version of Java, ... a difference so uninstalling apparently doesn't "fully" uninstall. ...
    (microsoft.public.windowsupdate)