Pop-up ads making me insane

[hav0c]

Well I was checking out my nephews computer and as I was browsing the web I got some pop-up ads.. Weird.. I have google toolbar installed. So I run adaware and Spybot search and destroy, made sure they were both updated. They found nothing. The weird thing is I even got a pop-up here at Techimo. It was the only IE window open.. I think there is something running that is causing these pop-ups but I can't find it. He is using Windows XP with all patches installed. I also went to the task manager and found something weird. There was some process call "Ymp4m71i.exe" running. I ended the process and it spawned another proccess called "BrwxMFLv.exe" I ended that process and it spawned another process with some randomly generated name. Anyone have any idea what this is?

Long time no see!

He likely has a piece of hijackware installed. Have you checked the registry startup list. I bet you will find a strange application that is not supposed to be there.

If it is what I think this is, you will likely find "pc32.exe" in both a registry startup entry and on the HDD under the Windows directory. Remove the file and registry entry, then promptly tell you nephew to never install Clean Space or possibly Evidence Eliminator again.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

Invalid data: MSNSysRestore
C:\WINDOWS\System32\pc32.exe bg

If not, then check the the "Downloaded Program Files" directory under the Windows directory for any strange entries.

BTW, have you ran Trend Micro's free online virus scan yet?

http://housecall.trendmicro.com

Another possibility is a quick scan with Hijack This....

http://mjc1.com/mirror/hjt/

Robert Richmond

[Shifter2101]

try looking here.
you'll want to look on this page first. then, if nothing, try the link in the first sentance on that page.

just a thought.
have you disabled Windows Messenger? if not, go here. look for "shoot the messenger". there is other stuff on that site you might want to employ on your nephews machine as well.

hope this helps.

merry merry happy happy

[hav0c]

Hey Rob! Hows it going?

Anyways I downloaded AVG and ran a scan, found a virus called Backdoor.VB.9.M , Its all good now.

Thanks