i need some help with my anti-virus please!

hey im having a serious problem. i have an error message come up now alot and it says " this window contains popups"and it wont let me open it. it does this on nearly every window i try to right click. this isnt really to bad because i can just open it regular. but, the thing is my anti virus update is a popup window and it wont start unless u can click something in the window but, i cant see the window! help please!

im running win xp with 384 megs of ram. a P4. Dell. XP is as patched as i can get it.

Are you by any chance running a program called Pop-Up Stopper Free Edition ??

Cause if you are just simply hold the "Ctrl" key down. This will allow the window that you want to be displayed.

That's my guess ..

For an accurate response, you really need to include which browser and pop-up blocker you're using. You may also want to add your ISP, as snome (like AOL) have some pre-enabled pop-up blocker software. There will be an easy way to re-configure whatever it is, but we can't help without more info :)

to my knowledge im not using any pop up blocker... none that i can see anyway... and my ISP is Yahoo SBC dial up ( gag!)

i this just started happening bout a week ago... never happend before. but i really need those AV updates soon!

Like corndog420 suggest a little more info might help.

Can you tell us what processes you have running on your computer.

is there a way i can copy and paste the processes? because writing it all out would take a long time~!

If you had installed yahoo toolbar recently in Internet Explorer , it will automatically stop popups (check the icon next to search web, in yahoo toolbar).

You can allow selective pop-ups by clicking the popup-blocker icon and select "Always allow pop-ups from ..." from the list in the window.

This is only when you use IE and Yahoo Toolbar.

im not positive but, i might have DL something from the tech tv website. do yall know anything that could do something like this that would be hidden?

i havent found any programs that are pop up blockers... all it says is " this window contains popups" and i cant up it.... this is really making me mad.

Ok, at least please post a (verbatim) copy of the error message so that we can help. Whatever it is, it is easily fixed, so if you can't get useful help here, just begin at the beginning, so to speak, and check ALL of your internet preferences. Go to your ISP's homepage and see if they have something enabled, check your browser, check your process list (as suggested). It will be very important to check your firewall's settings, of course, assuming you have one. I don't know of any software that TechTV puts out, per se. They link to a ton of different software that might be the cause of your problem, but there's nothing malicious about anything they link to, so it's likely to be a matter of clicking a check-box somewhere.

Good luck, I need to hit the hay, sorry I couldn't be of more help

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : unknown exception code (0xe06d7363) occurred at PC=0x77E73887
Function=RaiseException+0x50
Library=C:\WINDOWS\system32\kernel32.dll

Current Java thread:
at sun.plugin.services.WIExplorerBrowserService.installBrowserEventListener(Native Method)
at sun.plugin.viewer.LifeCycleManager.installBrowserEventListener(Unknown Source)
- locked <0x1003fa98> (a java.lang.Object)
at sun.plugin.viewer.LifeCycleManager.checkLifeCycle(Unknown Source)
at sun.plugin.viewer.IExplorerPluginObject.initPlugin(Unknown Source)
- locked <0x1003fa70> (a sun.plugin.viewer.IExplorerPluginObject)
at sun.plugin.viewer.IExplorerPluginObject.mayInit(Unknown Source)
at sun.plugin.viewer.IExplorerPluginObject.frameReady(Unknown Source)
at sun.plugin.viewer.frame.IExplorerEmbeddedFrame.setFrameSize(Unknown Source)

Dynamic libraries:
0x00400000 - 0x00419000 C:\Program Files\Internet Explorer\iexplore.exe
0x77F50000 - 0x77FF7000 C:\WINDOWS\System32\ntdll.dll
0x77E60000 - 0x77F46000 C:\WINDOWS\system32\kernel32.dll
0x77C10000 - 0x77C63000 C:\WINDOWS\system32\msvcrt.dll
0x77D40000 - 0x77DCC000 C:\WINDOWS\system32\USER32.dll
0x77C70000 - 0x77CB0000 C:\WINDOWS\system32\GDI32.dll
0x77DD0000 - 0x77E5D000 C:\WINDOWS\system32\ADVAPI32.dll
0x78000000 - 0x78086000 C:\WINDOWS\system32\RPCRT4.dll
0x70A70000 - 0x70AD5000 C:\WINDOWS\system32\SHLWAPI.dll
0x71700000 - 0x71849000 C:\WINDOWS\System32\SHDOCVW.dll
0x71950000 - 0x71A34000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
0x773D0000 - 0x77BC2000 C:\WINDOWS\system32\SHELL32.dll
0x77340000 - 0x773CB000 C:\WINDOWS\system32\comctl32.dll
0x771B0000 - 0x772D1000 C:\WINDOWS\system32\ole32.dll
0x5AD70000 - 0x5ADA4000 C:\WINDOWS\System32\uxtheme.dll
0x75F80000 - 0x7607C000 C:\WINDOWS\System32\BROWSEUI.dll
0x72430000 - 0x72442000 C:\WINDOWS\System32\browselc.dll
0x75F40000 - 0x75F5F000 C:\WINDOWS\system32\appHelp.dll
0x76FD0000 - 0x77048000 C:\WINDOWS\System32\CLBCATQ.DLL
0x77120000 - 0x771AB000 C:\WINDOWS\system32\OLEAUT32.dll
0x77050000 - 0x77115000 C:\WINDOWS\System32\COMRes.dll
0x77C00000 - 0x77C07000 C:\WINDOWS\system32\VERSION.dll
0x76200000 - 0x76298000 C:\WINDOWS\system32\WININET.dll
0x762C0000 - 0x76348000 C:\WINDOWS\system32\CRYPT32.dll
0x762A0000 - 0x762AF000 C:\WINDOWS\system32\MSASN1.dll
0x76F90000 - 0x76FA0000 C:\WINDOWS\System32\Secur32.dll
0x76620000 - 0x7666E000 C:\WINDOWS\System32\cscui.dll
0x76600000 - 0x7661B000 C:\WINDOWS\System32\CSCDLL.dll
0x76670000 - 0x76757000 C:\WINDOWS\System32\SETUPAPI.dll
0x75A70000 - 0x75B15000 C:\WINDOWS\system32\USERENV.dll
0x10000000 - 0x10008000 C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
0x75E90000 - 0x75F37000 C:\WINDOWS\System32\SXS.DLL
0x00E50000 - 0x00E6B000 C:\Documents And Settings\Tyler\Local Settings\Temporary Internet Files\Content.IE5\CJ8LS5C7\PopStop[1]\PopStop.dll
0x1A400000 - 0x1A47A000 C:\WINDOWS\system32\urlmon.dll
0x00F20000 - 0x00FA8000 C:\WINDOWS\System32\shdoclc.dll
0x74770000 - 0x747FF000 C:\WINDOWS\System32\mlang.dll
0x71AD0000 - 0x71AD8000 C:\WINDOWS\System32\wsock32.dll
0x71AB0000 - 0x71AC4000 C:\WINDOWS\System32\WS2_32.dll
0x71AA0000 - 0x71AA8000 C:\WINDOWS\System32\WS2HELP.dll
0x71A50000 - 0x71A8B000 C:\WINDOWS\system32\mswsock.dll
0x71A90000 - 0x71A98000 C:\WINDOWS\System32\wshtcpip.dll
0x76EE0000 - 0x76F17000 C:\WINDOWS\System32\RASAPI32.DLL
0x76E90000 - 0x76EA1000 C:\WINDOWS\System32\rasman.dll
0x71C20000 - 0x71C6E000 C:\WINDOWS\System32\NETAPI32.dll
0x76EB0000 - 0x76EDB000 C:\WINDOWS\System32\TAPI32.dll
0x76E80000 - 0x76E8D000 C:\WINDOWS\System32\rtutils.dll
0x76B40000 - 0x76B6C000 C:\WINDOWS\System32\WINMM.dll
0x5CD70000 - 0x5CD77000 C:\WINDOWS\System32\serwvdrv.dll
0x5B0A0000 - 0x5B0A7000 C:\WINDOWS\System32\umdmxfrm.dll
0x013B0000 - 0x015B1000 C:\WINDOWS\System32\msi.dll
0x00EC0000 - 0x00EDC000 c:\progra~1\mcafee.com\vso\McVSSkt.dll
0x00F00000 - 0x00F07000 C:\Program Files\Yahoo!\Messenger\idle.dll
0x1C000000 - 0x1C006000 C:\Documents and Settings\Tyler\My Documents\New Folder\AIM\idlemon.dll
0x0FFD0000 - 0x0FFF3000 C:\WINDOWS\System32\rsaenh.dll
0x76F20000 - 0x76F45000 C:\WINDOWS\System32\DNSAPI.dll
0x76FB0000 - 0x76FB7000 C:\WINDOWS\System32\winrnr.dll
0x76F60000 - 0x76F8C000 C:\WINDOWS\system32\WLDAP32.dll
0x722B0000 - 0x722B5000 C:\WINDOWS\System32\sensapi.dll
0x76FC0000 - 0x76FC5000 C:\WINDOWS\System32\rasadhlp.dll
0x63580000 - 0x63831000 C:\WINDOWS\System32\mshtml.dll
0x746F0000 - 0x74716000 C:\WINDOWS\System32\msimtf.dll
0x74720000 - 0x74764000 C:\WINDOWS\System32\MSCTF.dll
0x76390000 - 0x763AC000 C:\WINDOWS\System32\IMM32.DLL
0x6B700000 - 0x6B790000 C:\WINDOWS\System32\jscript.dll
0x746C0000 - 0x746E7000 C:\WINDOWS\System32\MSLS31.DLL
0x65E90000 - 0x65EC3000 D:\Program Files\Real\RealOne Player\rpplugins\ierpplug.dll
0x60A20000 - 0x60A68000 C:\WINDOWS\System32\PNCRT.dll
0x73300000 - 0x73375000 C:\WINDOWS\System32\vbscript.dll
0x02A10000 - 0x02BB3000 C:\WINDOWS\System32\macromed\flash\Flash.ocx
0x763B0000 - 0x763F5000 C:\WINDOWS\system32\comdlg32.dll
0x72D20000 - 0x72D29000 C:\WINDOWS\System32\wdmaud.drv
0x72D10000 - 0x72D18000 C:\WINDOWS\System32\msacm32.drv
0x77BE0000 - 0x77BF4000 C:\WINDOWS\System32\MSACM32.dll
0x77BD0000 - 0x77BD7000 C:\WINDOWS\System32\midimap.dll
0x65000000 - 0x65009000 C:\WINDOWS\System32\ddrawex.dll
0x51000000 - 0x5104D000 C:\WINDOWS\System32\DDRAW.dll
0x73BC0000 - 0x73BC6000 C:\WINDOWS\System32\DCIMAN32.dll
0x74CB0000 - 0x74D1F000 C:\WINDOWS\System32\mshtmled.dll
0x5FF20000 - 0x5FF43000 C:\WINDOWS\System32\MSRATING.DLL
0x5FF50000 - 0x5FF61000 C:\WINDOWS\System32\msratelc.dll
0x71D40000 - 0x71D5B000 C:\WINDOWS\System32\actxprxy.dll
0x1D300000 - 0x1D3D1000 C:\WINDOWS\System32\msdxm.ocx
0x35500000 - 0x35659000 C:\WINDOWS\System32\Quartz.dll
0x55650000 - 0x5567F000 C:\WINDOWS\System32\wmp.ocx
0x59160000 - 0x592B9000 C:\WINDOWS\System32\WMPUI.DLL
0x592E0000 - 0x594C8000 C:\WINDOWS\System32\wmploc.dll
0x52100000 - 0x5223E000 C:\WINDOWS\System32\wmpcore.dll
0x556E0000 - 0x5571F000 C:\WINDOWS\System32\wmpcd.dll
0x66E50000 - 0x66E8B000 C:\WINDOWS\System32\iepeers.dll
0x73000000 - 0x73023000 C:\WINDOWS\System32\WINSPOOL.DRV
0x6D440000 - 0x6D450000 C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
0x5EDD0000 - 0x5EDEA000 C:\WINDOWS\System32\OLEPRO32.DLL
0x6D310000 - 0x6D327000 C:\Program Files\Java\j2re1.4.2_01\bin\jpiexp32.dll
0x6D380000 - 0x6D398000 C:\Program Files\Java\j2re1.4.2_01\bin\jpishare.dll
0x08000000 - 0x08136000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\client\jvm.dll
0x04100000 - 0x04107000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\hpi.dll
0x04120000 - 0x0412E000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\verify.dll
0x04150000 - 0x04168000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\java.dll
0x04170000 - 0x0417D000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\zip.dll
0x06D60000 - 0x06E6F000 C:\Program Files\Java\j2re1.4.2_01\bin\awt.dll
0x06E70000 - 0x06EC0000 C:\Program Files\Java\j2re1.4.2_01\bin\fontmanager.dll
0x5C000000 - 0x5C0C8000 C:\WINDOWS\System32\D3DIM700.DLL
0x6D2F0000 - 0x6D304000 C:\Program Files\Java\j2re1.4.2_01\bin\jpicom32.dll
0x76C90000 - 0x76CB2000 C:\WINDOWS\system32\imagehlp.dll
0x6D510000 - 0x6D58D000 C:\WINDOWS\system32\DBGHELP.dll
0x76BF0000 - 0x76BFB000 C:\WINDOWS\System32\PSAPI.DLL

Heap at VM Abort:
Heap
def new generation total 576K, used 270K [0x10010000, 0x100b0000, 0x10770000)
eden space 512K, 45% used [0x10010000, 0x1004ad30, 0x10090000)
from space 64K, 54% used [0x100a0000, 0x100a8b30, 0x100b0000)
to space 64K, 0% used [0x10090000, 0x10090000, 0x100a0000)
tenured generation total 1408K, used 325K [0x10770000, 0x108d0000, 0x16010000)
the space 1408K, 23% used [0x10770000, 0x107c1730, 0x107c1800, 0x108d0000)
compacting perm gen total 4096K, used 3404K [0x16010000, 0x16410000, 0x1a010000)
the space 4096K, 83% used [0x16010000, 0x16363368, 0x16363400, 0x16410000)

Local Time = Fri Jan 30 00:36:46 2004
Elapsed Time = 4
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Client VM (1.4.2_01-b06 mixed mode)
#

the above error msg is another msg i found.... the one i asked about said " This window contains popups"

That latter complaint acutally has been confusing me, as well. I haven't received the msg, but know some that have. I've recommmended updating the Java client for IE, but don't know if it was successful (though I assume it was since I never heard back).

Micro$ no longer supports their own Java VM, and they offer a transitioning option here. I suspect that this error message may relate to this, though, as I say, I haven't seen it personally.

Again good luck, now I really am going to bed.

D/L this.. read up in the forums ..about what it is.. and how to use it..
http://mjc1.com/mirror/hjt/

Also learn the specs for your machine, exactly what version of Win XP is it Home/pro.. is it SP1 or SP1 & SP2.. P4 ..What?..

What is the error for what operation...

Hijackthis is so you can see what is starting up... and perhaps what is running in the background.. Post back the list (as per what you will read on the other forum) of the output from Hijackthis.. DON'T ATTEMPT To change settings yet..

To see that TaskManager is what you want.. ala--- CTL-ALT-DEL.. and Processes..

You could also consider running Spybot S&D (Make sure it has the latest updates installed..ala the update button... when it runs it should be scanning for 11500 or so types... less than 11000 and yours is seriously out of date)..

BUT at the very least.. give us a list of what is running in the Background in task manager..

Cheers

Ok, I don't know specifically what is causing your problem, but I will give you a temporary fix for this.
Go to the 'Start" button in the left hand bottom of your screen. Click on this. then "All Programs'. Navigate to 'Accessories' and from there to 'System Tools'. Then go down to 'System Restore". Click on 'System Restore' and pick a highlighted date before you started having this problem. Restore your system to this date.
If that does not temporarily cure your problem, then restore your system to an earlier date.
Now that your system is working properly, make a list of everything you have put into the system. You would have downloaded a pop up stopper that is configured to stop all pop ups and is not letting you load or open certain programs that you need. After you identify which one it is then you can restore your system to the previous state and configure this to allow the windows and pop ups that you will need.

hmm yes.. but.. if it is malware.. system restore.. will only keep the source of the problem..certainly not the answer..
Best get to the cause of the problem..


The problem here is a "Popup" Window when he is trying to update the AV.. certainly sounds odd.. this is why he has been asked for the EXACT Messgae .. untill then all we are doing is clutching at straws.. BUT knowing some of the othe details will help us work out what is happening..

Cheers

This is what is doing it:

Quote:

---

Settings\Temporary Internet Files\Content.IE5\CJ8LS5C7\PopStop[1]\PopStop.dll

---

Search for PopStop*.* and you should find where it is? There should be an executable (.exe) that will bring up a control panel that will let you uninstall or temporarily close it?

If all else fails boot into safe mode (F8 in XP) find PopStop.dll and rename it PopStop.txt........that should bugger it :D

Good Luck!

EDIT: Might be an idea to go into IE <tools> <internet options> and delete cookies, delete files and clear history?

Quote:

---

Originally posted here by nihil
This is what is doing it:



Search for PopStop*.* and you should find where it is? There should be an executable (.exe) that will bring up a control panel that will let you uninstall or temporarily close it?

If all else fails boot into safe mode (F8 in XP) find PopStop.dll and rename it PopStop.txt........that should bugger it :D

Good Luck!

EDIT: Might be an idea to go into IE <tools> <internet options> and delete cookies, delete files and clear history?

---

One more thing could be usefull. Safe mode probably would help but there is one more trick with those dlls IE loads on startup. Start regedit.exe and search for popstop.dll. It will probably be in HCR\CLASSID\ {something} \inproc
Delete {something} and it won't be loaded on startup... now you only have to delete the file phisicaly like nihil instructed you.

I had something like this happen a while back with MSIE and it turned out to be a bug of some kind. I don't recall what it was at this late date. I went through hell trying to get rid of it, and couldn't go to any online av site and run an online test because it wouldn't allow any pop up windows.

I finally ended up buying McAfee antivirus and it found whatever it was. Naturally, instead of just quarantining it for future reference, I deleted it. I now use Mozilla, and along with McAfee haven't been bothered since.

i have Mcafee AV....and the EXACT error msg is this. it is at the bottom left hand corner of my screen right next to the little "E" looking thing in IE. it says " this window contains popups" and thats it. but, it wont let me open anything. and as hard as i look i cant find ANY pop up software on my pc..... i have run virus scan and adaware.... it came up with nothing.

tartupList report, 1/30/2004, 12:15:03 PM
StartupList version: 1.52
Started from : C:\Documents And Settings\Tyler\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Tyler\My Documents\New Folder\AIM\aim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\DOCUME~1\Tyler\LOCALS~1\Temp\ICD2.tmp\jinstall.exe
C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe
c:\program files\mcafee.com\shared\mghtml.exe
C:\Documents And Settings\Tyler\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\DOCUME~1\Tyler\LOCALS~1\Temp\jinstaller142_03.exe
C:\DOCUME~1\Tyler\LOCALS~1\Temp\Jav1A.tmp.exe
C:\WINDOWS\System32\MSIEXEC.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

MsmqIntCert = regsvr32 /s mqrt.dll
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
VSOCheckTask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
VirusScan Online = "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe = C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
stcloader = C:\WINDOWS\System32\stcloader.exe
CleanUp = C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

AIM = C:\Documents and Settings\Tyler\My Documents\New Folder\AIM\aim.exe -cnetwait.odl
MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
(Default) =

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\ssflwbox.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Kontiki\bin\bh309190.dll (file missing) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB}
(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
PopStop - C:\Documents And Settings\Tyler\Local Settings\Temporary Internet Files\Content.IE5\CJ8LS5C7\PopStop[1]\PopStop.dll - {20988EDF-4CB5-4083-9829-262BBFD0CD52}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Disk Cleanup.job
Disk Defragmenter.job
McAfee.com Scan for Viruses - My Computer (T-3S73WVAPQZL94-Tyler).job
McAfee.com Update Check (T-3S73WVAPQZL94-Jason).job
McAfee.com Update Check (T-3S73WVAPQZL94-Tyler).job

--------------------------------------------------

Enumerating Download Program Files:

[PCPitstop Utility]
InProcServer32 = C:\WINDOWS\DOWNLO~1\PCPITS~1.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\System32\macromed\Shockwave 8\Download.dll
CODEBASE = http://download.macromedia.com/pub/s...irector/sw.cab

[{26E8361F-BCE7-4F75-A347-98C88B418322}]
CODEBASE = http://dst.trafficsyndicate.com/Dnl/T_92/QDow.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://download.yahoo.com/dl/installs/yinst0309.cab

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/downlo...22/wmv9VCM.CAB

[McAfee.com Operating System Class]
InProcServer32 = C:\WINDOWS\System32\mcinsctl.dll
CODEBASE = http://bin.mcafee.com/molbin/shared/...4/mcinsctl.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\RdxIE.dll
CODEBASE = http://207.188.7.150/10ba2a205546f82...p/RdxIE601.cab

[{62475759-9E84-458E-A1AB-5D2C442ADFDE}]
CODEBASE = http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe

[{8EDAD21C-3584-4E66-A8AB-EB0E5584767D}]
CODEBASE = http://toolbar.google.com/data/GoogleActivate.cab

[InstallShield International Setup Player]
InProcServer32 = c:\windows\downlo~1\isetup.dll
CODEBASE = http://www.installengine.com/engine/isetup.cab

[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.co...7896.856400463

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://active.macromedia.com/flash2/cabs/swflash.cab

[SysWebTelecomInt Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SYSWEB~1.DLL
CODEBASE = http://www.sponsoradulto.com/SysWebTelecomint.cab

[MSN Chat Control 4.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx
CODEBASE = http://fdl.msn.com/public/chat/msnchat45.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\WINDOWS\System32\upnpui.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll

--------------------------------------------------
End of report, 7,553 bytes
Report generated in 0.172 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

PopStop - C:\Documents And Settings\Tyler\Local Settings\Temporary Internet Files\Content.IE5\CJ8LS5C7\PopStop[1]\PopStop.dll - {20988EDF-4CB5-4083-9829-262BBFD0CD52}

what is that?

Hi

Here it is:

Quote:

---

Enumerating Browser Helper Objects:

---

Quote:

---

PopStop - C:\Documents And Settings\Tyler\Local Settings\Temporary Internet Files\Content.IE5\CJ8LS5C7\PopStop[1]\PopStop.dll - {20988EDF-4CB5-4083-9829-262BBFD0CD52}

---

Try http://www.winpatrol.com

Get the software and load/run it...........the second tab is something like "IE Helpers" Get rid of PopStop.

It is a BHO (Browser Helper Object) that is doing it :)

Cheers

EDIT: I just checked the site and the software is now up to v6.5 It is free.

Texan, just a word of advice, you need to keep an eye on BHOs and the Windows "Hosts" folder as this is where some ad/spyware likes to hide, and is generally missed by the traditional scanning software. ;)

THANK YOU!!!!!!!!!!!!!!!! THANK YOU ALL!

how did that get installed on my system though?

Quote:

---

Originally posted here by The Texan
how did that get installed on my system though?

---

From our good old friends at internet.com (Jup Media)

SBC Yahoo! Joins Anti-Pop-Up Crusade
http://www.internetnews.com/IAR/article.php/3077951

Could be part of the software you installed?

The Texan,

BHOs tend to be loaded when you visit a website...........you know like they prompt you to get Adobe Acrobat or whatever.

BHOs tend to be very small, they are effectively plug ins to the main browser software.

If you run advert blocking software this may have loaded at the same time.

Hard to tell where you actually got it from, if I had physical access to your machine for a couple of hours I might just be able to narrow it down :)

It does not appear to be a "bad guy" I think it is a control tool with the rules set too tight?

Cheers

there is something that bothers me. Take a look at this listing

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run


MsmqIntCert = regsvr32 /s mqrt.dll <---- I don't like this entry
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
VSOCheckTask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
VirusScan Online = "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe = C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
stcloader = C:\WINDOWS\System32\stcloader.exe <---- I don't like this entry
CleanUp = C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup

there are two startup entries that I don't like... any suggestions what it is? Is it safe to delete them?

Quote:

---

MsmqIntCert = regsvr32 /s mqrt.dll <---- I don't like this entry

---

Microsoft Message Queue Server (MSMQ) 1.0
found here http://support.microsoft.com/default...nt=1#appliesto

[quote]stcloader = C:\WINDOWS\System32\stcloader.exe <---- I don't like this entry[quote]
Could be a parasite (spyware)
Check here http://www.liutilities.com/products/...ary/stcloader/
But if yo go to the next link it is clasified as a Virus.... about time Parasite software was classified as Malware... oh the link here: http://www.viruslist.com/eng/viruslist.html?id=815149

Cheers

Ha!

You beat me to it :)

The first one is part of MS Windows.....handles the message queue,

The second one is adware.

Remember that you may have to boot into safe mode to get rid of it.

Cheers