http://i.trkjmp.com/crossdomain.xml

Viruses and worms
1

when i surf in the internet it keeps popping up this message…i followed the instructions given to another link but the problem remains…
i would really appreciate your help.
Thanks in advance…

Here is the report from AdwCleaner:

AdwCleaner v2.002 - Logfile created 09/18/2012 at 02:18:42

Updated 16/09/2012 by Xplode

Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

User : User - USER-HP

Boot Mode : Normal

Running from : C:\Users\User\Desktop\adwcleaner.exe

Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

***** [Internet Browsers] *****

-\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\ Mozilla Firefox v4.0.1 (el)

-\ Google Chrome v21.0.1180.89

AdwCleaner[R1].txt - [9290 octets] - [17/09/2012 21:05:14]
AdwCleaner[S1].txt - [9956 octets] - [17/09/2012 21:06:39]
AdwCleaner[S2].txt - [762 octets] - [18/09/2012 02:18:42]

########## EOF - C:\AdwCleaner[S2].txt - [821 octets] ##########

2 
http://i.trkjmp.com/kwd?c    I am receiving the same thing.  I though it was being caused by Mozilla Firefox because when I removed it, it seemed to stop.  I updated Mozilla with a fresh download and it just keeps coming back.

I am also having a difficult time downloading other sites that are not necessarily considered dangerous, like Nero and something else. I get a message after it is downloaded that this is not generally downloaded and it is a danger.

Please solve this problem, and send a solution SOMEONE!

3

Malwarebytes Anti-Malware (Δοκιμαστική έκδοση) 1.65.0.1400
www.malwarebytes.org

Έκδοση βάσης δεδομένων: v2012.09.17.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
User :: USER-HP [διαχειριστής]

Προστασία: Ενεργοποιημένη

18/9/2012 2:35:01 πμ
mbam-log-2012-09-18 (02-35-01).txt

Τύπος σάρωσης: Πλήρης σάρωση (C:|D:|E:|F:|G:|H:|)
Ενεργοποιημένες επιλογές σάρωσης: Μνήμη | Εκκίνηση | Μητρώο | Σύστημα αρχείων | Ευρετική μέθοδος/Extra | Ευρετική μέθοδος/Shuriken | PUP | PUM
Απενεργοποιημένες επιλογές σάρωσης: P2P
Αντικείμενα που σαρώθηκαν: 586549
Χρόνος που έχει διανυθεί: 1 ώρα(ες), 55 λεπτό(ά), 6 δευτερόλεπτο(α)

Εντοπίστηκαν διεργασίες στη μνήμη: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Εντοπίστηκαν στοιχεία στη μνήμη: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Εντοπίστηκαν κλειδιά στο μητρώο: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Εντοπίστηκαν τιμές στο μητρώο: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Εντοπίστηκαν αντικείμενα δεδομένων στο μητρώο: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Εντοπίστηκαν φάκελοι: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Εντοπίστηκαν αρχεία: 0
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

(τέλος)

4

@ colleenscranton
@vito26

hi,

If you feel you need assistance, please start a new thread here just for you. Otherwise, the original poster will be serviced first, and your request for help will likely be lost in the shuffle. You will get the individual attention you require if you start a new post and you can link back to this one if needed.

5

Thank you mchain…This is why i started this topic here…What else should i do?because it is the first time i am using this forum
thx for the advice anyway

6

Hi Vito the following log will give me the information I need

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
/md5stop
%systemdrive%$Recycle.Bin|@;true;true;true
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

7

Here it is…
Thx a lot

8

Let me know if this fixes it ;D

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=adbartrp&affID=100474&mntrId=204dec69000000000000000000000000&q="
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_ss&affID=100474&mntrId=204dec69000000000000000000000000"
[2012/05/07 08:57:56 | 000,000,000 | ---D | M] ("Vid-Saver") -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\f4lhd0eg.default\extensions\crossriderapp3491@crossrider.com
[2011/10/08 18:33:58 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\f4lhd0eg.default\extensions\ffxtlbr@babylon.com


:Files
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

9

and the last one…

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-18 21:57:04

21:57:04.949 OS Version: Windows x64 6.1.7601 Service Pack 1
21:57:04.949 Number of processors: 4 586 0x2505
21:57:04.949 ComputerName: USER-HP UserName: User
21:57:07.148 Initialize success
21:57:08.069 AVAST engine defs: 12091801
21:57:17.444 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IAAStorageDevice-1
21:57:17.444 Disk 0 Vendor: TOSHIBA_ GJ00 Size: 476940MB BusType: 3
21:57:17.475 Disk 0 MBR read successfully
21:57:17.491 Disk 0 MBR scan
21:57:17.491 Disk 0 Windows 7 default MBR code
21:57:17.507 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
21:57:17.522 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 462153 MB offset 409600
21:57:17.553 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 14483 MB offset 946898944
21:57:17.585 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 976560128
21:57:17.616 Disk 0 scanning C:\Windows\system32\drivers
21:57:33.946 Service scanning
21:58:20.886 Modules scanning
21:58:20.896 Disk 0 trace - called modules:
21:58:21.244 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:58:21.252 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa800525d060]
21:58:21.260 3 CLASSPNP.SYS[fffff8800120143f] → nt!IofCallDriver → \Device\Ide\IAAStorageDevice-1[0xfffffa8004ff7050]
21:58:22.897 AVAST engine scan C:\Windows
21:58:26.454 AVAST engine scan C:\Windows\system32
22:01:33.246 AVAST engine scan C:\Windows\system32\drivers
22:02:03.933 AVAST engine scan C:\Users\User
22:11:47.535 AVAST engine scan C:\ProgramData
22:14:13.599 Scan finished successfully
22:15:24.095 Disk 0 MBR has been saved successfully to “C:\Users\User\Desktop\MBR.dat”
22:15:24.095 The log file has been saved successfully to “C:\Users\User\Desktop\aswMBR.txt”

10

aswMBR looks good but I did not anticipate a problem there, the OTL fix should clear the problem

11

It seems that everything is running smoothly now…let’s see…
thank you very much essexboy…i really appreciate it!!!

p.s. by the way do you any idea (i am sure u do :P) how i can get rid of the stupid advertisements that keep popping up at every site?even fb???
thx!!!

12

I gather that noscript is good for that http://noscript.net/

13

You could try AdBlock Plus add-on for Firefox or Chrome here: http://adblockplus.org/en/ Should make web browsing faster as well, as the ads are prevented from loading on the page in the first place. Safer too, as malicious ads cannot load.