5 replies to this topic

[Mammoth]

I need help removing the "media.fastclick.net" and "ad.doubleclick.net" spyware crap from my PC. A lot of the sites I go to (not all of them, about 40%...however, it's ALWAYS the same sites everytime), when I hit my browser's back button, the page doesn't move. I have to hit it 2 or 3 times before it actually takes me backwards. If I select the pulldown menu next to the back button, this is what I see:



and


As you can see, the "media.fastclick.net" and "ad.doubleclick.net" ads are clearly displayed.

I want to point out that no popups occur, nor does my page get redirected. Other than having to hit the back button multiple times, nothing else happens.

Over the past 24 hours I have run the following spyware programs on my computer & none of them have reported a single piece of spyware. But as you can see from the pictures above, somethings wrong.

• Ad-Aware
• Ewido (sorry, I forgot to keep the log)
• Spybot Search & Destroy
• Hitman Pro

(all the above programs are fully updated)

I also did a full virus scan of my computer as well. And as I mentioned before, not a single solitary piece of malicious software/files were found.

So, if my PC is Spyware & Virus free, what is causing the "media.fastclick.net" and "ad.doubleclick.net" URL's to show up and how can I fix it?



Note - it's not cookies or temp. internet files either. Cookies are set to "BLOCK" and my Temp. Internet Files clear every time I close the browser.







Here is my HijackThis log:


Logfile of HijackThis v1.98.2
Scan saved at 10:55:37 PM, on 10/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Security Task Manager\SpyProtector.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\NMSSvc.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Me\Desktop\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....cid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;local
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com"); (C:\Documents and Settings\Me\Application Data\Mozilla\Profiles\default\1lx1ycus.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Me\Application Data\Mozilla\Profiles\default\1lx1ycus.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Spy Protector] C:\Program Files\Security Task Manager\SpyProtector.exe /autostart
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Me\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Lookup Meaning - res://C:\Program Files\ieSpell\iespell.dll/LOOKUPMEANING.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Program Files\Opanda\IExif 2.0\IExifCom.htm
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM (file missing)
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM (file missing)
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab

[SWI Support Robot]

Welcome to SWI. We apologize for the delay; our helpers have been very busy.
If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Thank you for your patience.

[this is an automated reply]

[miekiemoes]

Hello,

There's actually nothing you can do about this though... It's not your computer, but the sites you visit. Some do have these cookies present (mediafastclick.net and ad.doubleclick.net)
You can't change anything about these sites.
What you *can do however, is blocking these cookies. A nice program is Cookiewall:
http://www.analogx.c...work/cookie.htm
With this program you can decide what cookies to block and which ones to allow.

[Mammoth]

Hello,

There's actually nothing you can do about this though... It's not your computer, but the sites you visit. Some do have these cookies present (mediafastclick.net and ad.doubleclick.net)
You can't change anything about these sites.
What you *can do however, is blocking these cookies. A nice program is Cookiewall:
http://www.analogx.c...work/cookie.htm
With this program you can decide what cookies to block and which ones to allow.

Thanks for the reply. I'm glad there's nothing wrong with my PC. However, I still have one question to ask please.

I visit these same sites @ work. I use the same web browser @ work too, and yet, I don't have the same problem. At work, the "ad.doubleclick" and the "media.fastclick" don't show up like they do in the pictures posted above. Furthermore, when I use Firefox (at home or at work) I don't have any problems. Do you know why that may be? Just asking.

[miekiemoes]

Yes, that's because Firefox is another browser as Internet Explorer 7. It doesn't show that option in your menu on top.
Maybe at work, you are still having the Internet Explorer 6 version.

When I go to one of the sites you visit, for example http://www.themoviespoiler.com/, my firefox doesn't display these cookies in a menu either... But I know they are present. It also shows very clearly at the end of the page.
It says there: "Poster and photos provided by : Yahoo! movies
FastClick Ad Network"

Also, when I look in the source of that page, I see a lot of references to valueclick and Fastclick.

So, really don't worry about the fact that your computer is infected, because it isn't. I have the same here.

[miekiemoes]

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened, please tell the moderating team by replying here
This applies only to the original topic starter.

Everyone else please begin a New Topic.