msn users sign on

well noahdfear, I spoke too soon. Just after I posted back, the **** thing came up twice. It seems to assume that I haverregistered with msn users.com, which I most asuredly have not, and asks if I want to sign back on.

Maybe I'm just going to have to put up with it.

 

No you don't have to put up with it. We'll get to the bottom of this! You may have already done these things but I'd like for you to go thru each step and make sure.

1. Open task manager, look for msmsgs.exe on the processes tab, highlight and end process if there. Look also for msnmsgr.exe and end process.
2. Start>run and type services.msc. Locate messenger in the list, right click and stop if available, then properties. Set to disable and OK out. Locate Terminal services and set to disable.
3. Start>run Copy the following and paste it in. RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove Hit enter. Don't worry about error message if you get one. Just OK.
4. If you don't use and have no intention of using MSN Messenger, look for it in add/remove programs and remove if there. Go to add/remove windows components and make sure there is no check next to MSN Explorer or Windows Messenger.
5. Open your user account, click manage network passwords and remove all listed.
6. Reboot

 

Thanks noahdfear. The only thing I hadn't done was disable terminal services which I have now done. So we'll see what happens now.

I'll keep you posted.

 

Hope it tames the beast, but if not we'll dig til we get it put down.

 

Well noahdfear, the beast still walks and has presented itself 5 times so far today, still asking if I want to sign on and asking for e-mail address and password. I have no password because I have not registered.

It also had a link to click if one is not already registered and I ain't going there.

Any further ideas? I am wiped out.

 

I know that we have already uninstalled windows messenger, but there may be some system components that haven't figured it out yet. So....
Double check that auto login is unchecked in Outlook Express. In Outlook Express, click Options on the Tools menu. On the General tab, click to clear the Automatically log on to Windows Messenger check box. Click OK.


Try doing this;
Click Start, click Run, type gpedit.msc, and then press ENTER.
Double-click the following items to expand them:
Local Computer Policy
Computer Configuration
Administrative Templates
Windows Components
Windows Messenger
Double-click Do not allow Windows Messenger to run, and then click Enabled.
Click OK, and then quit the Group Policy snap-in.


You can also try setting the program access and defaults to custom. Described here.

Do you have RegSeeker? It may help to clean the registry. It will remove the old entries associated with windows messenger and MSN Explorer that may be causing the popup. Might have to run it several times.

 

Everything done except RegSeeker and that one makes me a little nervous. I did make the change in gpedit.msc as suggested.

Lets see what happens now before I take the scary step of getting into registry.

Thanks again. I'll keep you posted.

 

It is still here. As said prevuiously the Title bar at top of windiow reads www.msn users.com.

Within the window are these words Welcome to MSN Communities! Please sign-in with your Passport account.

There follows a box for username (e-mail acct) and a box for password.

At bottom of window it offers a link from which to register.
A box reading CANCEL. Window has the usual ex X at upper right corner to close window. I've been alternately usding cancel and red x.

Wonder if I needed to restart to make the change take place?

 

I've done a restart and it still pops up.

 

I have chased link after link to try getting prompted to sign in to an MSN Community, and I have yet to pull up a page that says Welcome to MSN Communities. The www.msnusers.com brings up MSN Groups homepage for me. Very strange that you not only had this on your old PC running XP Home, but now on a new PC with clean install of XP Pro. I can only suspect at this point that someplace you visited, some site, has dropped something on your PC. I don't want to call it a hijack, because it hasn't taken over your browser or anything, but similar to it. You must be being prompted to sign into a particular community.

Download both Spybot and Ad-aware, install, configure to my specs. here and run, deleting all they find.

Run an online scan at RAV and/or Housecall.

Clean out Temps and TIFs like this. Start>run and type cleanmgr /sageset:1 and hit enter. Check all boxes except compress old files and OK out. Start>run and type cleanmgr /sagerun:1 and hit enter.

Run RegSeeker. It doesn't remove anything automatically. You can select what is deleted. There is a checkbox in the lower left corner for backup. If checked, anything removed will be backed up. I use it regularly and delete all it finds. I've not had a problem yet doing so, but look thru what it finds before doing so. It does sometmes find things you don't want removed. Use the histories button to clear typed URLs and cookies, old start menu items and clean/stream keys.

Reboot with fingers crossed that you never see it again.

 

OK. went the route. Spybot found several items which I had it remove. Ad-aware found 1 which I had it remove.

So I'm going to re-boot and see what happens.

I'll keep you posted.

 

msn users problem

Well, noahdfear -

The beast showed up once today but after I had to do a System Restore. After a reboot, I had some pages with hugh font sizes and some with very small font sizes. Numerous web pages I couldn't get to accept my username and password. After System Restore all back to normal and I went in again with Spybot and Ad-aware and again cleaned house. There was spyware (something called Alexa) found and removed again. I uninstalled both programs and re-booted and all still seems well.

RegSeeker didn't reveal anything looking remotely like msn issues. So I let them be. Most issues were invalid file paths and names.

So, we'll see what happens now. The beast has not appeared since the last clean out.

Again, noahdfear, my heartfelt thanks for your patience and expertise.

 

RickyD2,

You are very welcome. I'm glad I was able to help. Is the beast still dead?

 

He was, day before yesterday all day, but yesterday, and again this morning he's back. I've done all the things you suggested including going back and let RegSeek delete all it found.

Strangest part about all this is that it will appear 3-4 times in rapid succession and then dissapear for the rest of the day, at least that is what it did yesterday. It popped up 3 times in quick succession about 30 min ago but none since.

I'm just totally confused.

 

Clean up with Spybot and Ad-aware again. Are you using a firewall? XP's is better than none at all. Some freebies here. I like the Zone Alarm. If you continue to have problems with it, post a HijackThis log.

 

Thanks noahdfear. I re-ran Spy Bot, AdAware and RegSeeker before I posted.
I use ZoneAlarm free firewall.

I'll see if the beast shows up today and next time it does I'll use the HiJack this program.

Thanks again.

 

Here is the HiJack this log. The beast popped in and I made this log immediately.

Logfile of HijackThis v1.97.7
Scan saved at 1:19:59 PM, on 5/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\CPal\CPBrWtch.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\cisvc.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Executive Software\Diskeeper Home Edition\DKService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CPal\CPal.exe
C:\Program Files\MailWasher Pro\MailWasher.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Executive Software\Diskeeper Home Edition\DfrgFat.exe
C:\Documents and Settings\Dick\Local Settings\Temporary Internet Files\Content.IE5\RMJ97RKQ\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tomowa.com/my_website/Richard/Page 10.html?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.partstockpc.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [Cookie Pal] "C:\Program Files\CPal\CPBrWtch.exe "
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE "
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.partstockpc.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38084.7538078704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Logfile of HijackThis v1.97.7
Scan saved at 1:19:59 PM, on 5/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\CPal\CPBrWtch.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\cisvc.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Executive Software\Diskeeper Home Edition\DKService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CPal\CPal.exe
C:\Program Files\MailWasher Pro\MailWasher.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Executive Software\Diskeeper Home Edition\DfrgFat.exe
C:\Documents and Settings\Dick\Local Settings\Temporary Internet Files\Content.IE5\RMJ97RKQ\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tomowa.com/my_website/Richard/Page 10.html?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.partstockpc.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [Cookie Pal] "C:\Program Files\CPal\CPBrWtch.exe "
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE "
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.partstockpc.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38084.7538078704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

I didn't quit on ya! Your log looks pretty good. I didn't see anything out of the ordinary. Only a couple of things to fix, some of which are optional.

Scan again, place a check next to these, close all other windows and fix.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =


If you did not set these, fix them also.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tomowa.com/my_website/Ri...Page 10.html?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.partstockpc.com
O14 - IERESET.INF: START_PAGE_URL=http://www.partstockpc.com


I would also fix these and from within Weatherbug's options deselect running at startup.

O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/mini...ransporter.cab?

Weatherbug, although a handy little app, is recognized as spyware. I think you should consider uninstalling and finding a replacement. I just installed Weather Pulse, and although the graphics aren't as good, and may not have as many options, it appears to be spyware and ad free. I haven't had a popup from opening it yet, which I can't say for weatherbug. The EULA looks good too. Maybe someone else has another recommedation for replacement.

Check your firewall's programs access and logs for clues on this MSN Communities pop-in. Copy the window address when it pops in and post it or PM it to me. I'll sign in and see where it takes me. Can you post a screenshot?

 

I just went thru ZA and removed all access for msn. I uninstalled weatherbug some time back before the above log was run. I've had 6 visits from the little beast in the last hour. If it shows up again I'll screenshot it for you.
Gonna be out of town starting tomorrow until May 12. We'll see what happens when I boot up then.
Thanks again.

 

Well it's still showing up but I cannot screenshot it for some unknown reason. I'm using ctrl+prtscreen and clpbrd will capture it and the screen behind it. When I save it to My Documents and try to insert it into e-mail, it does not show up in that version of My Documents as found in browse. When I access My Documents directly it is there. Are there two versions of My Documents running at same time?
I'll get back to to you later.