147ak477

Originally posted by gergermen at 2006-1-15 03:53 PM:


唔係啩~~~

CAP張圖睇下（下...

i have fix the O-17 file lu

also do u mean cap the screen of those files in regedit?

147ak477

after i fix the O-17
all the pop ups shows cannot find server
and one of those link is
http://www.ad-w-a-r-e.com/cgi-bin/PopupV3?ID={8583258A-8641-7559-614F-AEC2FEBEBF81}&type=normal&mSkip=1&rnd=19054

147ak477

after i fix O-17 for a while .
i disconnect and re-connect internet (coz cannot load 26fun.com) , but now the ads-pop -up can show again!

also i attach the screen cap for regedit
some of the directory in the local machine cannot be find

147ak477

links for some other ads:
http://www.hug-ediscounts.com/normal/yyy102.html
all of the URL ends like that


i scanned using hijackthis and find tha O-17 files again!
and i need to fixed it again

[ Last edited by 147ak477 on 2006-1-15 at 04:58 PM ]

147ak477

Originally posted by gergermen at 2006-1-15 05:09 PM:
又出返啲POPUP
睇啲圖又冇嘢

你...

hosts file starts similar to the one u shown but ends with like:

127.0.0.1       localhost
127.0.0.1  sds-qckads.com
127.0.0.1  status.qckads.com
127.0.0.1  www.qoolaid.com
127.0.0.1  www.qoologic.com
127.0.0.1  www.CLKPrecision.com
127.0.0.1  www.urllogic.com
127.0.0.1  www.clkoptimizer.com
127.0.0.1  www.isearch.com
127.0.0.1  isearch.com
127.0.0.1  www.idownload.com
127.0.0.1  idownload.com
127.0.0.1  www.mytotalsearch.com
127.0.0.1  mytotalsearch.com
127.0.0.1  www.lop.com
127.0.0.1  lop.com
127.0.0.1  www.websearch.com
127.0.0.1  websearch.com
127.0.0.1  www.page-not-found.net
127.0.0.1  page-not-found.net
127.0.0.1  www.isearchhere.com
127.0.0.1  isearchhere.com
127.0.0.1  as.adwave.com
127.0.0.1  sr.adwave.com
127.0.0.1  www.adwave.com
127.0.0.1  adwave.com EVENT:HOST:127.0.0.1
127.0.0.1  www.pacimedia.com
127.0.0.1  www.exactsearch.net
127.0.0.1  www.contextplus.net
127.0.0.1  www.contextplus.net
127.0.0.1  www.contextplus.net
127.0.0.1  www.contextplus.net
127.0.0.1  www.contextplus.net
127.0.0.1  www.contextplus.net
127.0.0.1  www.contextplus.net
( a lot of them)

lmhosts
starts and ends like normal

[ Last edited by 147ak477 on 2006-1-15 at 05:17 PM ]

147ak477

Originally posted by gergermen at 2006-1-15 05:17 PM:


就係佢，你改成我POST咁，就大功告成

嗰地址係連去一個搞DESKTOP MARKETING網站.

do u mean i manually edit the" hosts" file
and deleted everything after    127.0.0.1       localhost
and save?

147ak477

edited the hosts file
hope the popup doesn't show

你之前有冇裝過?咩SOFTWARE/ 咩TOOLBAR之類，同埋之前有冇呢種情況，幾時出現。

i downloaded a crack file from internet  "an exe file"
then the windows task bar pop up sth said spyware infected and my desktop background changed to the one i said above

then i install norton, microsoft antispy, yahoo task bar etc
still cannot solve.. it

i have just restarted the computer

147ak477

i edited the host file
and restart
and open the host file again
those strange things appeared again
and i manually edit it and connnect to internet

after i connect, microsoft anti-spyware detected the contextplus.com wants to modify the windows host file and i click block it

147ak477

pop up appeared again
i checked the host files
again they are modified
should i change the property of that file to read-only?

147ak477

now the situation is even worse
even the hosts files are "clean"
the pop-up still appear