Constant pop ups in IE 7

[dan12]

Hi, Noticed you online.I'm working presently so don't have access to my pc where I have all your logs.
As we had deleted most of the tools we used, I was trying to finish off with the less amount of tools to down load for you but I think it will be best if we down load OTMoveIt2 again, reason being that it will give me a report as to wether the deletions were carried out, otherwise will have to have another kav scan.
I will put a post by you in the morning with the detail for the fix.
dan

[dan12]

Have windows defender and spysweeper disabled as previous post.

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as
All Files and name it FixServices.bat. Please save it on your desktop.

Code: Select all

@echo off
sc stop npfss
sc delete npfss
exit

Double click FixServices.bat. A window will open and close. This is normal.


Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  Code: Select all

  C:\Windows\System32\drivers\npfss.sys
  C:\Windows\System32\drivers\core.cache.dsk
  
  
      

  
  
  
• Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt2
  

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Post me the OTMoveIt2 log
let me know how it goes!
dan

[Strobes]

File move failed. C:\Windows\System32\drivers\npfss.sys scheduled to be moved on reboot.
File move failed. C:\Windows\System32\drivers\core.cache.dsk scheduled to be moved on reboot.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03202008_120534


I don't know if it would help, but should I turn off Trend Micro Antivirus also?

[dan12]

Did you run the batch File?
I was reluctant to turn off your a\v, try the same again with the batch, this time try it in safe mode then we will look at other options

[Strobes]

I tried it a couple times and in safe mode. In safe mode it says the files weren't found.

[dan12]

ok, leave it with me and I will look a little deeper.

[dan12]

Ok, another thought!
Have system files and folders revealed plus windows defender and spysweeper disabled.

Right click start, In the drop down menu click "Explore" Then navigate to each file\ folder in the left hand pane, which will reveal its content in the right hand pane, highlight file or folder right click and Delete, if present:

C:\Windows\System32\drivers\npfss.sys << This file first
C:\Windows\System32\drivers\core.cache.dsk This file

If it allows you to delete them then do me a kaspersky scan also a malwarebytes scan as that was the scan that picked it up.
dan

Edit: post if you can't remove them, if any message is displayed, what it say's, anything to help me to have something to go on.

[Strobes]

ok well I went to delete the files and I couldn't find the core.cache.dsk. I think I finally might've deleted it because the Malware Bytes couldn't find it either. It did however find another trace that I was able to delete successfully. So far, I haven't had any popups. I'm going to do another scan right now and I'll post it as soon as it's finished.

[Strobes]

Malwarebytes' Anti-Malware 1.08
Database version: 493

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 98772
Time elapsed: 36 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[dan12]

Looking a lot better

I couldn't find the core.cache.dsk

Ok, may well have gone in the cleaning process.

For my information though were you able to delete this file: C:\Windows\System32\drivers\npfss.sys
I wouldn't mind seeing a kaspersky scan to make sure we have it all.
Note* don't forget to renable all programs we disabled and hide your system files\folders

What I will do is just keep the thread open for a few days, to see how it goes.
Then I will close the thread if you have no more problems.
dan

[Strobes]

I can't seem to find the Kaspersky scan on my computer but it reported back nothing. I also was able to delete the other file you asked about.

[dan12]

Ok,as I said I will keep thread open for a short time.
If your happy were done

[Strobes]

Just in case, do you still want any scans so you can make a final check? If not, thank you for helping me with all of this. I really appreciate it.

[dan12]

No, That's fine were done
My pleasure.
Happy surfing

[Elrond]

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.