Sites popup with login prompts, shouldnt be there

[oddjob]

Hi

Your reply in post #12 indicates a problem with hardware, typically a network card or video card & driver but it may be difficult to track down.

Apart from the java issue I mentioned the log is OK. (I did notice your comment that the virustotal scan came up clean).

Have you updated any drivers recently? Are you still getting the same browsing pop up trouble you had in your first post?


OJ

[Wormdundee]

Nope, pretty sure I haven't done any driver updating or anything like that.

As for the browsing popup trouble, yeh, still got that stupid login prompt.

[oddjob]

Despite having already removed TrustIn Contextual it may still be causing a problem behind the scenes. Let's look at it.

Read through this fix and put it into action.......

http://www.bleepingcomputer.com/forums/topic54501.html#fix

If this fixes the pop up ... just let us know.


If NOT ... Download Ewido/AVG Anti Spyware from here ….

http://www.ewido.net/en/

It has a fully working 30 day trial period.

Install it and update it to the latest definitions.

Do NOT use it yet.


Now boot to safe mode. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].


Next post a fresh HJT log here with the AVGAS scan report and another update on how things are going.



OJ

[Wormdundee]

Well things have changed themselves a bit. I don't get the login prompt on any of the websites anymore. Now I just get a Problem Loading Page - Connection was Reset problem on those specific sites.

Unfortunately, bleepingcomputer is one of those websites that gets that error, so I can't really go and read the instructions.
Also, I now get the Blue Screen of Death everytime I come back from a hibernation.

I don't really want to do anything else until I try that bleepingcomputer thing that you mentioned. So I dunno, I guess you could repost it here or something.

[oddjob]

First follow these instructions (if possible)....

Print out these instructions as we will need to close every window that is open later in the fix.

Download SmitRem.exe from here to your Desktop …..

http://www.downloads.subratam.org/smitRem.exe


Double-click the smitRem.exe and it will extract the files to a smitRem folder on your Desktop. Do not run it yet.

Download FixTC.reg to your desktop by right clicking on the following link and then selecting Save Link As or Save File as, depending on your browser.

http://download.bleepingcomputer.com/reg/FixTC.reg

Confirm that the file FixTC.reg now resides on your desktop as we will need it later.

Reboot to safe mode.

Log on to your user account.

Open the smitfraud folder then double click the RunThis.bat file to start the tool.
The scan log is saved here … log C:\smitfiles.txt

***************

Now the “copied” fix instructions from Bleeping Computer, as you suggested ….


1. Click on the Start Menu
2. Click on the Control Panel option.
3. Double-click on the Add or Remove Programs icon.
4. Look again for any/all of the following entries and double-click on each of them. Follow the prompts to uninstall the programs, but do not allow it to reboot the computer if it asks. If after you uninstall a particular entry below it still remains, double-click on the entry again to remove it.

Trust Cleaner
TrustIn Bar
TrustIn Contextual Ads
Trustin Popups
TrustIn Search Assistant
Trust Cleaner Promo

5. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.

6. Go to your desktop and double click on the FixTC.reg file that you downloaded earlier. When it asks if you would like to merge the information, press the Yes button and then the OK button.

7. Delete the following files and folders (Do not be concerned if a folder or file does not exist):

C:\Program Files\TrustIn Popups
C:\Program Files\TrustIn Bar
C:\Program Files\TrustIn Contextual
C:\Program Files\TrustIn Popups
C:\Program Files\TrustIn Search
%Temp%\wschtm35.dll
%Temp%\srsvc.exe
C:\WINDOWS\local.html
C:\WINDOWS\SYSTEM32\tisa.dll
C:\WINDOWS\SYSTEM32\lut.dat
C:\WINDOWS\SYSTEM32\tisa.cnf
C:\WINDOWS\SYSTEM32\ticads.exe
C:\WINDOWS\SYSTEM32\tctool.exe
C:\WINDOWS\SYSTEM32\ticont.dll
C:\WINDOWS\SYSTEM32\tpopup.exe
C:\WINDOWS\SYSTEM32\tconini.dat
C:\WINDOWS\SYSTEM32\lcch.dat
C:\WINDOWS\onlineshopping.ico
C:\WINDOWS\removeadware.ico
C:\WINDOWS\sexpersonals.ico
C:\WINDOWS\local.html
C:\WINDOWS\SYSTEM32\tu.exe
C:\WINDOWS\SYSTEM32\ttu.exe
C:\WINDOWS\se_spoof.dll
C:\WINDOWS\inetloader.dll
C:\Windows\mxd.exe
C:\Windows\tse.exe
C:\Windows\trustinbar.exe
C:\Windows\ads.js
C:\WINDOWS\videoslots.ico

8. Delete these icons from your Desktop:

Online Shopping.url
Remove Adware.url
Sex Personals.url
Video Slots.url

9. Close all open Windows.
10. Reboot your computer back to normal mode.
11. Download the ATF-Cleaner to your desktop from the following link:

http://www.atribune.org/ccount/click.php?id=1

When it is download to your desktop, double-click on the program to run it. Select the box labeled Select All and then press the Empty Select button. When it is done you can close the program.

***************

Perform an onlinescan with Panda ......

http://www.pandasoftware.com/products/activescan.htm

1. Once you are on the Panda site click the Scan your PC button
2. A new window will open...click the Check Now button
3. Enter your Country
4. Enter your State/Province
5. Enter your e-mail address and click send
6. Select either Home User or Company
7. Click the big Scan Now button
8. If it wants to install an ActiveX component allow it
9. It will start downloading the files it requires for the scan (Note: It may take a few minutes)
10. When download is complete, click on Local Disks to start the scan

Your computer should now be free of the Trust Cleaner infection.

***************

Please "copy/paste" the contents of the log C:\smitfiles.txt and a fresh HijackThis log.


Please tell us how the computer is operating now.


OJ