Jump to content


Photo

new popup when I turn on my computer


  • Please log in to reply
8 replies to this topic

#1 LadyJ

LadyJ

    Member

  • Full Member
  • Pip
  • 6 posts

Posted 05 June 2004 - 01:31 PM

Just since yesterday, every time I turn on my computer, I get a popup message with the heading, "Motive SmartBridge Auto Update." The text underneath says, "Updates are available. Would you like to install them now?" I always click "no", because I'm not about to install something that I don't even know what it is. But then I get the pop-up again the next time I turn on my computer. The night before I was surfing a lot of different sites, mostly looking for an apartment and researching different communities. Normally when I go to new sites I block all cookies, instead of just third-party cookies. But I forgot to do it that time. I don't know if that's a factor or not. I did notice that one of the sites was trying to install the "Doubleclick" spy cookie. Anyways, what is this message? And how can I stop the message from popping up every time I start my computer?

I normally have very few problems with spyware. This computer is just two months old, and I have Spyware Blaster, Spybot Search & Destroy, and Norton antivirus software. Neither Spybot nor Norton have detected anything. I did read the FAQ's here, including the article about hijack removal. I couldn't download the HijackThis program because every time I click on the link I get a "page cannot be displayed" error message. I will keep trying, but I'm hoping there's something I can do in the meantime.

In the article about hijack removal, there's a list of control panel applet names. It's not clear to me whether everything in the list are all bad things to be deleted, or just the ones specifically mentioned as bad. The article said to delete "inetcpl.cpl" from the registry. (I have Windows XP.) It also said in the list that wtcpl.cpl is spyware, but it doesn't say anything about the other things in the list. Are they spyware, or things that belong there? In my registry, I have two applets on the list, "ncpa.cpl" and "odbccp32.cpl". What are they? Should I delete them?

Thanks for any help you can provide. This site is a great service to computer users.

#2 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 05 June 2004 - 05:04 PM

We need a closer look at what's happening.
Please download Hijack this
Copy it into its own folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, do Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum

#3 LadyJ

LadyJ

    Member

  • Full Member
  • Pip
  • 6 posts

Posted 06 June 2004 - 12:00 AM

Here is the log:

Logfile of HijackThis v1.97.7
Scan saved at 12:53:56 AM, on 6/6/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe
C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\POP-UP~1\PSFree.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.n....5&bm=ho_search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad (HKLM)
O9 - Extra 'Tools' menuitem: Control Pad (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yaho...mail/ymmapi.cab

#4 LadyJ

LadyJ

    Member

  • Full Member
  • Pip
  • 6 posts

Posted 06 June 2004 - 01:48 PM

One question about the log: can I fix the extra buttons and tools? I didn't put any of them there.

#5 LadyJ

LadyJ

    Member

  • Full Member
  • Pip
  • 6 posts

Posted 06 June 2004 - 01:58 PM

Another thing, I just realized that it only happens if I turn on my modem and computer at the same time (I have DSL), or if the modem is already on first. If I turn on the computer when the modem is off, I don't get the pop-up. Even after I turn it on to connect to the internet, I still don't get it (that time). But I still get it if the modem is on when I turn on the computer.

This may be a dumb idea, but if I hit "yes" (when it asks me to download whatever), might that (whatever gets downloaded) be easier to get rid of than the pop-up? I'm thinking Spyware Blaster might prevent it from downloading. If not, maybe SpyBot could just get it afterwards. But I guess that might be too risky. Has anyone else had problems with this particular pop-up?

#6 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 06 June 2004 - 02:22 PM

Have Hijack This fix all of the following by placing a check in the appropriate boxes and hitting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O9 - Extra button: Control Pad (HKLM)
O9 - Extra 'Tools' menuitem: Control Pad (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)

Reboot after fixing.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum

#7 LadyJ

LadyJ

    Member

  • Full Member
  • Pip
  • 6 posts

Posted 06 June 2004 - 03:27 PM

Dave,

I did all that. Unfortunately, I am still getting the pop-up. Any other ideas?

#8 LadyJ

LadyJ

    Member

  • Full Member
  • Pip
  • 6 posts

Posted 06 June 2004 - 09:15 PM

Well, I think I figured out what it might be. I know you didn't ask for this, but I got my StartupList (from hijackthis). The entry is:

C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe


"SMARTB" could be SmartBridge, and Verizon is my ISP. But if it is from Verizon, it's suspicious that the pop-up doesn't identify itself as being from Verizon. I have Verizon DSL; I've just had it for a couple of months, and it's the first time I've had anything other than a dial-up connection (which wasn't throught them). This seems like a weird way to notify their customers to update the software. Is this normal? Even if it is from Verizon, I don't know if I can trust them. After I first installed their software, SpyBot found some spyware from them. I had SpyBot fix it, and I had no problems with my connection. Whatever it was wasn't necessary to connect me. Anyways, can I just delete this?

#9 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 07 June 2004 - 04:59 PM

It is Smart bridge, and is used for tech support, instead of the phone. Fixing it with Hijack this is OK, as it can be started manually if it is needed.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button