Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: Annoying Messages

  1. #1
    Junior Member
    Join Date
    May 2004

    Annoying Messages

    Hi I'm new here and have a really annoying problem. I keep getting these 2 messages:

    They pop up at random points during the day and often kick me out of games and minimizes other programs. It asks me to download some spyware remover (hah ). I think it may also be related to a process that takes me to at random points. It hasn't done any damage (yet) but it's still aggravating. These are processes I thought might be related to it:

    nmevtmsg.exe (no clue)
    msses.exe (another user posted about this)
    svvhost.exe (fake svc according to sophos)

    The messages ask me to download XoftSpySetup_3.2.exe from and the other message takes me to search page from

    I'd really appreciate it if someone can help me figure all this out. Oh, and if you need it, here's my hijackthis log:

    Logfile of HijackThis v1.97.7
    Scan saved at 5:31:40 PM, on 24/05/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\4LE3SXQJ\HijackThis[1].exe
    C:\Program Files\MSN Messenger\msnmsgr.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - C:\WINDOWS\System32\msmk.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: (no name) - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - C:\WINDOWS\msopt.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [DSL Monitor] C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [nmevtmsg] C:\WINDOWS\System32\nmevtmsg.exe
    O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) -
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
    O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) -
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) -
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) -
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
    O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) -
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) -
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C7313EDD-315E-46B6-AC86-D7E11C0FC274}: NameServer =

  2. #2
    Senior Member SirSub's Avatar
    Join Date
    May 2003
    Groom Lake, Nevada
    Since it asks you to download a spyware scanner...Have you tried doing a spyware scan yet?
    It is impossible to make anything foolproof because fools are so ingenious. - Murphy

  3. #3
    Ok... this is easy to remedy:
    open the administrative tools (in the control panel, or start menu) and select "services". Scroll down until you find "Messenger". Double click that service. First, press the "Stop" button and wait for the service to end. Then under "startup type" select "Disabled". You should also do this with the "Alerter" service.

    FYI: this is not the same as the MSN messenger chat program.

    to test if you left the messenger service running, open a command prompt and type:
    net send HI
    if you got a pop-up message saying HI then you need to turn the messenger service off.

    More information on windows services can be found at black viper's website:

    Is this really the best way to try and get people to buy your programs? scare tactics suck

    Welcome to AO
    You are so bored that you are reading my signature?

  4. #4
    HeadShot Master N1nja Cybr1d's Avatar
    Join Date
    Jul 2003
    Boston, MA
    Don't install what the program is tellin you yet. Its probably spyware installed from the "spyware scanner" Just run SPybot S&D, and Adaware.

  5. #5
    If you're lazy, you can also use "Shoot the Messenger" at

  6. #6
    Junior Member
    Join Date
    May 2004
    I disabled the messenger and alerter services. Seems to be working for now. I did do a spyware search but Ad Aware only found some cookies. I did a scan on housecall and found 2 viruses that AVG didn't pick up. Cleaning them right now. And yes, that program probably is spyware. I'll post again if it comes back.


  7. #7
    Junior Member
    Join Date
    May 2004
    Damn.. the messages are still coming. I checked an messenger/alerter are still disabled. Any ideas?

  8. #8
    Have you tried Spybot and/or Adaware yet? That should weed out the rest.

  9. #9
    "Windows has been detected spyware module on this computer"

    Oh wow, you would think that a real program for file/sys auditing and policies which also magicly has the ability to detect if these changes made are really the work of malware would atleast be able to properly form sentences a bit better. Hey, and it even tells you to go out and download more spyware *cough... tools.

    (Edited) Well there you have it. Windows is clearly a spyware module. Go get yourself a pet rock.

  10. #10
    Junior Member
    Join Date
    May 2004
    Ya, it really sucks. I tried Ad Aware but it isn't finding much. Is there a way to check what program executed the message? Maybe I can just delete that file. Oh, and does anyone know where I can get a clean copy of winlogon.exe?


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts