Gaming HELP!. Random pop-ups?

[Splych]

EDIT: I tried Goored. Nothing.[/b]What do you mean 'Nothing' - it didn't run / didn't scan / didn't find anything / didn't clean anything - What ??

When you double-click it you should've got message of 'Gooredfix will automatically check and remove infection....blah blah blah' & you click either [Yes] or [No]
A DOS box should've popped up & when programs finished you then should've got Notepad open up with a log file (You also should've got a folder & a TXT file on your desktop)

If all that happened & nothing was cleaned - then you haven't got that type of problem with firefox
(It was worth a try anyway)

When I say nothing, I mean like, it ran and just found nothing. Said it was clean.

QUOTE(Davess @ Jan 29 2010, 07:07 PM)

Btw. Google Chrome

Used to use it. But am using FireFox because of the addons and plugins.

 

[zeromac]

EDIT: I tried Goored. Nothing.[/b]What do you mean 'Nothing' - it didn't run / didn't scan / didn't find anything / didn't clean anything - What ??

When you double-click it you should've got message of 'Gooredfix will automatically check and remove infection....blah blah blah' & you click either [Yes] or [No]
A DOS box should've popped up & when programs finished you then should've got Notepad open up with a log file (You also should've got a folder & a TXT file on your desktop)

If all that happened & nothing was cleaned - then you haven't got that type of problem with firefox
(It was worth a try anyway)

When I say nothing, I mean like, it ran and just found nothing. Said it was clean.

QUOTE(Davess @ Jan 29 2010, 07:07 PM)

Btw. Google Chrome

Used to use it. But am using FireFox because of the addons and plugins.

May as well give re-installing Firefox a try

Btw what version are you using?

 

[Splych]

May as well give re-installing Firefox a try

Btw what version are you using?

That's what I am thinking... But I am using Google Chrome atm.

It it nice =]

I used to be a Google Chrome user, but I am considering it again now. It has extensions, which is good to know and my gmail is here aswell. It has a extension [aka. an addon at firefox] that is like a shortcut to gmail. and also tells me how much mail i have that is unread xD.

But I will try leaving FireFox afk once I re-install it. And it is at version 3.5.7. I am surprised it hasn't prompted me to update yet...

 

[DeMoN]

The latest Firefox version is 3.6.
If you set it to automatically check for updates and it didn't, then I think you might have a virus.

 

[Splych]

The latest Firefox version is 3.6.
If you set it to automatically check for updates and it didn't, then I think you might have a virus.

Ugh. I may have a virus. I am doing to leave an overnight scan ... Just to be safe.

avast! was doing quite a good job, but it scans very slow. i might consider avira again, just those ads are annoying .__.

 

[cracker]

I highly suggest Malwarebytes Anti-Malware along with exeHelper and rkill.exe. I know the last two sound shady but they are legit programs to remove malware and have worked for me a few times.

Also if you have to manually remove programs and files then it usually means that they are in use. KillBox is a great app to get around this (many times without having to reboot).

 

[Splych]

Ugh... Computer went to standby when I left it here. The scan is still not done.

I installed SUPERAntiSpyware [hehe. You'll be surprised to find out it actually does work]. It's scanning... And it feels like it is getting somwhere. It's detected Adware. Tracking Cookie [37 of em'] and Trojan.Dropper/Win-NV [2 of em]. I wonder if it will detect more things...?

I highly suggest Malwarebytes Anti-Malware along with exeHelper and rkill.exe. I know the last two sound shady but they are legit programs to remove malware and have worked for me a few times.

Also if you have to manually remove programs and files then it usually means that they are in use. KillBox is a great app to get around this (many times without having to reboot).

I tried those last two .exes you gave. The exeHelper didn't give anything any signs of there being anything bad. Then rKill was scanning and then it just closed itself. I don't know if that means my computer is clean or it crashed or if the virus/malware is trying to do something.

 

[Splych]

CRAP.

This is quite important, but, I was reading thorough this thread...
http://community.norton.com/t5/Norton-360/...rus/td-p/194917

I was reading about his problem which was exactly like mine. But here's the weird part...
I am experiencing both his problem and my own. When I am using FireFox, it creates a new tab then the URL is some random noe. Then the one that the person was experiencing in that thread, well, I am experiencing it now.

In FireFox, I used to get a new tab created. After the new tab is created, I am redirected to some other site.
I switched to Google Chrome, and am now experiencing the problem where you search something in Google and then after am directed to that fake site.

Why is it happening in Google Chrome now!? I am stumped now. I am running out of things to do, and I am not sure what is causing these problems =[

 

[cracker]

Make sure the HOSTS file (mentioned before) doesn't have google referenced in it. As said before unless you specifically went in and changed something yourself it should only have 127.0.0.1 localhost.

 

[Splych]

Sounds similar to Google Search Engine virus I had. Kept redirecting me every time I clicked a search in Google.

Check your hosts file. There may have been strings added by a virus which your AV removed but the strings still exist. Follow these steps:

1) Open Notepad as an Admin
2) Click Open & browse to C:/Windows/System32/drivers/ect
3) Select to see "All Files" in the drop down menu from the "Open File" dialog box
4) Click Hosts
5) Should look like this.

If there's anything else delete it but you MUST have the 127.0.0.1 localhost line. Unles there are lines that you know are suppose to be there... (like when you pirate Photoshop CS4, there are blacklist URLs there or you'll get caught...)

Good Luck.

~ Jon
I saw something inserted by SpyBot S&D. I deleted it. Was I suppose to keep it there because it just said it was inserted by SpyBot S&D .

QUOTE(cracker @ Jan 30 2010, 04:39 PM) Make sure the HOSTS file (mentioned before) doesn't have google referenced in it. As said before unless you specifically went in and changed something yourself it should only have 127.0.0.1 localhost.

Fixed. I made sure i deleted everything that was unnecessary.

EDIT: Umm... It seems like it only has been happening in Google. I have followed everything you guys have said, but this problem... It is only happening in google. For example, if I search "Test" in google, I go to the Test Cricket wikipedia page, I get redirected to some random site. But when I search it in Yahoo, I can go directly to the wikipedia page of Test Cricket with no problem. Oh and that problem... The one where a new tab is created then directs me to some site, yeah, am experiencing that in Google Chrome too.

 

[zeromac]

Sounds similar to Google Search Engine virus I had. Kept redirecting me every time I clicked a search in Google.

Check your hosts file. There may have been strings added by a virus which your AV removed but the strings still exist. Follow these steps:

1) Open Notepad as an Admin
2) Click Open & browse to C:/Windows/System32/drivers/ect
3) Select to see "All Files" in the drop down menu from the "Open File" dialog box
4) Click Hosts
5) Should look like this.

If there's anything else delete it but you MUST have the 127.0.0.1 localhost line. Unles there are lines that you know are suppose to be there... (like when you pirate Photoshop CS4, there are blacklist URLs there or you'll get caught...)

Good Luck.

~ Jon
I saw something inserted by SpyBot S&D. I deleted it. Was I suppose to keep it there because it just said it was inserted by SpyBot S&D .

QUOTE(cracker @ Jan 30 2010, 04:39 PM) Make sure the HOSTS file (mentioned before) doesn't have google referenced in it. As said before unless you specifically went in and changed something yourself it should only have 127.0.0.1 localhost.

Fixed. I made sure i deleted everything that was unnecessary.

EDIT: Umm... It seems like it only has been happening in Google. I have followed everything you guys have said, but this problem... It is only happening in google. For example, if I search "Test" in google, I go to the Test Cricket wikipedia page, I get redirected to some random site. But when I search it in Yahoo, I can go directly to the wikipedia page of Test Cricket with no problem. Oh and that problem... The one where a new tab is created then directs me to some site, yeah, am experiencing that in Google Chrome too.

Well that rules out FF as a culprit but have you tried disconnecting your computer from the internet completly ie.unplugging routers etc and then scanning?

 

[cracker]

Since it happes to Google searches only and it isn't something in HOSTS then I would assume it is an application/dll/plugin that is loaded in the background that is redirecting your search.

Use HiJackThis to get a list of what services and programs are loaded at startup and post it here.

 

[Slyakin]

Man, I had a virus long ago that would constantly redirect every google search possible to some random fake domain. The virus was annoying as hell, but Malware Bytes fixed it right up. Sorry man, I knew how you feel, but I can't help you.

 

[Splych]

<!--quoteo(post=2568290:date=Jan 30 2010, 09:45 PM:name=zeromac)--><div class='quotetop'>QUOTE(zeromac @ Jan 30 2010, 09:45 PM) <a href="index.php?act=findpost&pid=2568290"><{POST_SNAPBACK}></a></div><div class='quotemain'><!--quotec-->Well that rules out FF as a culprit but have you tried disconnecting your computer from the internet completly ie.unplugging routers etc and then scanning?<!--QuoteEnd--></div><!--QuoteEEnd-->
Yeah. That's what I have been trying to do. Nothing really happened. Like the redirecting kept on happening still.

<!--quoteo(post=2568298:date=Jan 30 2010, 09:51 PM:name=cracker)--><div class='quotetop'>QUOTE(cracker @ Jan 30 2010, 09:51 PM) <a href="index.php?act=findpost&pid=2568298"><{POST_SNAPBACK}></a></div><div class='quotemain'><!--quotec-->Since it happes to Google searches only and it isn't something in HOSTS then I would assume it is an application/dll/plugin that is loaded in the background that is redirecting your search.

Use <a href="http://free.antivirus.com/hijackthis/" target="_blank">HiJackThis</a> to get a list of what services and programs are loaded at startup and post it here.<!--QuoteEnd--></div><!--QuoteEEnd-->

Spoiler

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:29:19 PM, on 1/30/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\Explorer.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\splych\AppData\Local\Google\Chrome\Application\chrome.exe
C:\chatterbox\chat manager.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank">http://go.microsoft.com/fwlink/?LinkId=54896</a>
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://go.microsoft.com/fwlink/?LinkId=69157" target="_blank">http://go.microsoft.com/fwlink/?LinkId=69157</a>
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=69157" target="_blank">http://go.microsoft.com/fwlink/?LinkId=69157</a>
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank">http://go.microsoft.com/fwlink/?LinkId=54896</a>
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank">http://go.microsoft.com/fwlink/?LinkId=54896</a>
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://go.microsoft.com/fwlink/?LinkId=69157" target="_blank">http://go.microsoft.com/fwlink/?LinkId=69157</a>
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
<b>O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)</b>
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIF5BA~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\splych\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [GrooveMonitor] C:\PROGRA~1\MIF5BA~1\Office14\GROOVEMN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\splych\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: Download All by FlashGet3 - C:\Users\splych\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Users\splych\AppData\Roaming\FlashGetBHO\GetUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: S&end to OneNote - res://C:\PROGRA~1\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Linked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Linked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\system32\
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Chat Server (ChatServer) - Unknown owner - c:\chatterbox\chatserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 8516 bytes

There it is. I am thinking about that no name one...
<b>O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)</b>

<!--quoteo(post=2568311:date=Jan 30 2010, 10:06 PM:name=Slyakin)--><div class='quotetop'>QUOTE(Slyakin @ Jan 30 2010, 10:06 PM) <a href="index.php?act=findpost&pid=2568311"><{POST_SNAPBACK}></a></div><div class='quotemain'><!--quotec-->Man, I had a virus long ago that would constantly redirect every google search possible to some random fake domain. The virus was annoying as hell, but Malware Bytes fixed it right up. Sorry man, I knew how you feel, but I can't help you.<!--QuoteEnd--></div><!--QuoteEEnd-->
... Bleh.

 

[Skyline969]

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\chatterbox\chat manager.exe
O13 - Gopher Prefix:
O23 - Service: Chat Server (ChatServer) - Unknown owner - c:\chatterbox\chatserver.exe

Unless you installed those yourself, I would be looking into those. They look kinda sketchy to me.

 

[Splych]

Ugh... I tried using a bunch of methods, and none of them worked. I backed up my files, and reformatted my HDD. One day... I am moving to Linux or Mac .__.
Or if I have the time, I will research on the hacked version of the Mac software.

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\chatterbox\chat manager.exe
O13 - Gopher Prefix:
O23 - Service: Chat Server (ChatServer) - Unknown owner - c:\chatterbox\chatserver.exe

Unless you installed those yourself, I would be looking into those. They look kinda sketchy to me.

SUPERAntiSpyware was installed by me.
013 - Gopher Prefix, I have no idea what that is.
Chatterbox, I installed it, but it didn't work. I forgot why I installed it though...

 

[Skyline969]

Ugh... I tried using a bunch of methods, and none of them worked. I backed up my files, and reformatted my HDD. One day... I am moving to Linux or Mac .__.
Or if I have the time, I will research on the hacked version of the Mac software.

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\chatterbox\chat manager.exe
O13 - Gopher Prefix:
O23 - Service: Chat Server (ChatServer) - Unknown owner - c:\chatterbox\chatserver.exe

Unless you installed those yourself, I would be looking into those. They look kinda sketchy to me.

SUPERAntiSpyware was installed by me.
013 - Gopher Prefix, I have no idea what that is.
Chatterbox, I installed it, but it didn't work. I forgot why I installed it though...

Well if your HDD got formatted, problem solved.

But I would have gotten rid of chatterbox and Gopher Prefix and seen if that made a difference.

 

[Splych]

Ugh... I tried using a bunch of methods, and none of them worked. I backed up my files, and reformatted my HDD. One day... I am moving to Linux or Mac .__.
Or if I have the time, I will research on the hacked version of the Mac software.

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\chatterbox\chat manager.exe
O13 - Gopher Prefix:
O23 - Service: Chat Server (ChatServer) - Unknown owner - c:\chatterbox\chatserver.exe

Unless you installed those yourself, I would be looking into those. They look kinda sketchy to me.

SUPERAntiSpyware was installed by me.
013 - Gopher Prefix, I have no idea what that is.
Chatterbox, I installed it, but it didn't work. I forgot why I installed it though...

Well if your HDD got formatted, problem solved.

But I would have gotten rid of chatterbox and Gopher Prefix and seen if that made a difference.

Bleh... I know, fixed. But Chatterbox wouldn't go away even with the help of HiJackThis.

 

[Skyline969]

Ugh... I tried using a bunch of methods, and none of them worked. I backed up my files, and reformatted my HDD. One day... I am moving to Linux or Mac .__.
Or if I have the time, I will research on the hacked version of the Mac software.

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\chatterbox\chat manager.exe
O13 - Gopher Prefix:
O23 - Service: Chat Server (ChatServer) - Unknown owner - c:\chatterbox\chatserver.exe

Unless you installed those yourself, I would be looking into those. They look kinda sketchy to me.

SUPERAntiSpyware was installed by me.
013 - Gopher Prefix, I have no idea what that is.
Chatterbox, I installed it, but it didn't work. I forgot why I installed it though...

Well if your HDD got formatted, problem solved.

But I would have gotten rid of chatterbox and Gopher Prefix and seen if that made a difference.

Bleh... I know, fixed. But Chatterbox wouldn't go away even with the help of HiJackThis.

CCleaner also has a nice way to force programs to uninstall, including registry values, etc.

 

[Splych]

CCleaner also has a nice way to force programs to uninstall, including registry values, etc.

It wasn't even showing in the uninstall menu.

So I wouldn't know how to uninstall it... Unless CCleaner can do that?