Hi, I went fishing yesterday and upon returning home the wife told me that she had some add/remove programs window popup in IE. She exited out of it by hittimg the close X instead of right clicking the bar below and closing it that way. The she got a popup about some Backtera virus and to download some WinAntiVirus Pro software but there was no way of closing it short of a reboot. Now from time to time we get strange popups.

I do have the Paid version of SpySweeper, which I have ran in safe mode, I have alos followed your steps to prepare for running HiJack this, I ran ATF-Cleaner, SpySweeper in safe mode and then HiJack this and have enclosed the log files from both. Any help sure would be appreciated.

Thanks yall. BTW, for those of you interested yes I did catch a limit of Largemouth bass as well as a limit of trout!

Attached Files

	hijackthis.log (8.4 KB, 10 views)
	Spy Sweeper Session Log.txt (7.4 KB, 2 views)

Hi Mike. Well, that's the cleanest HJT log I've seen in a while!!

Let's see if the Security Team have any futher input.

Thanks. I'll wait till someone From the Security Team posts

Yup , no malware problems there sofar.

Do you get the popups at random , or only specific sites? Lets give Ewido a try:

http://www.pchelpforum.com/118557-post2.html

Its pretty much random, there does not seem to be any site in particular. I'll give Ewido a run and post back with my findings

I ran Ewido, here is my report. Hopefully this will tell you something.

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 5:36:10 PM, 5/28/2006
+ Report-Checksum: E7F73F44
+ Scan result:
C:\Documents and Settings\Mike\Cookies\mike@2o7[2].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Mike\Cookies\mike@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignored
C:\Documents and Settings\Mike\Cookies\mike@adrevolver[1].txt -> TrackingCookie.Adrevolver : Ignored
C:\Documents and Settings\Mike\Cookies\mike@atdmt[2].txt -> TrackingCookie.Atdmt : Ignored
C:\Documents and Settings\Mike\Cookies\mike@bfast[2].txt -> TrackingCookie.Bfast : Ignored
C:\Documents and Settings\Mike\Cookies\mike@com[1].txt -> TrackingCookie.Com : Ignored
C:\Documents and Settings\Mike\Cookies\mike@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Ignored
C:\Documents and Settings\Mike\Cookies\mike@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored
C:\Documents and Settings\Mike\Cookies\mike@edge.ru4[1].txt -> TrackingCookie.Ru4 : Ignored
C:\Documents and Settings\Mike\Cookies\mike@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Ignored
C:\Documents and Settings\Mike\Cookies\mike@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Ignored
C:\Documents and Settings\Mike\Cookies\mike@z1.adserver[1].txt -> TrackingCookie.Adserver : Ignored
C:\Program Files\DIGStream\digstream.exe -> Not-A-Virus.Downloader.Win32.DigStream : Ignored

::Report End