Two issues with computer

Viruses and worms
1

When on the internet I am getting two pop ups on some web pages. One is in the lower right of the screen and one on the lower left.

The lower right is “chitka”

The lower left is had this url when I right clicked and checked properties:
http://cdnx.fhserve.com/www/images/a479c560531153f2c43a06bc6359fc65.jpg

Computer is Win7 Pro 64 bit. I am using IE 10

I am not familiar with all the “lingo” that is used on this site, so please bear with me.

TIA for any assistance.

2

Hi there, I know what this one is. But, just to confirm it is the same

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

3

I did not see an extras.txt log.

The OTL.txt file exceeds the 10000 characters allowed on here. Any suggestions?

4

Yes attach the file instructions are in this thread http://forum.avast.com/index.php?topic=53253.0 about a quarter of the way down

At this stage the extras is not important

5

otl.txt attached.

I should have seen the option to attach a file.

6

OK let me know if this kills it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

7

Attached is the log following the quick scan. I renamed it otl2.

Thank you

8

Could you confirm that it has now gone

9

It looks to be OK. If anything changes I will post back. Thank you so much for your assistance! Your knowledge is impressive.

10

Once you are happy run OTL and press the cleanup button to remove it and the associated folders

11

Hi
I have the same problem
otl.txt attached.
computer Win 7 enterprise 64 bit - IE 9
Pleas Help

12

This should cure it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD2.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKU\S-1-5-21-1556133238-1958997356-1220327562-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18826
IE - HKU\S-1-5-21-1556133238-1958997356-1220327562-1001\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT329536
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT329536&SearchSource=3&q={searchTerms}"
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD2.dll (Conduit Ltd.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD2.dll (Conduit Ltd.)

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

13

I run again OTL with code&commands.
Reboot the PC.
Run OTL - Quick Scan
and attached the new OTL.txt log. In the name OTLaf.txt
Does it look like its fix?

14

Check it out, it should be good ;D

15

OMG!!! you killed it. no F… add’s any more.
Thank you for your assistance. As “SUPERDUTY” said before “Your knowledge is impressive”
Thank again You " 8) " men.

Meir

16

OK run OTL and press the cleanup button to remove it and its associated files ;D

17

Thank x

18

essexboy, thank you again for your assistance. It is very frustrating when one encounters these “ads”. Your solution was spot on and your response to posts here on Avast is super quick. Amazing.

19

;D

20

Hello,
Seems as though I have the same issue. Would you be able to help me as well?
I am also using Win 7 enterprise 64 bit - IE 9
Thank you very much.
All the best,
Paul