Browser hijack?

I've suddenly started getting popups every time I fire up Internet
Explorer and these coincide with the appearence in c:\windows\temp of
the file ll22.exe and dummy.htm. The latest updates from Pest Patrol
and Norton Antivorus don't find anything. Deleting these files results
in their reappearance when I rerun Internet Explorer. The ll22.exe is
from a www.abetterinternet.com. Any ideas what to do?

I recently had a similar problem that even Ad-Aware and
Spybot couldn't fix. I finally go frustrated enough that I
simply backed up (to CD or DVD) all my important files. I
then formatted my HD and reinstalled the operating system
and all my applications. That was after I'd been
troubleshooting the pop-up adware problem for about two
weeks. I'm no novice and everything I could think of and
tried didn't work. I honestly believe that there are some
things that fixes can't fix. So, like I said, if you have
a way of backing up all your important data, your best bet
might be to simply start with a new operating system. Hope
this helps.


-----Original Message-----
I've suddenly started getting popups every time I fire up
Internet
Explorer and these coincide with the appearence in
c:\windows\temp of
the file ll22.exe and dummy.htm. The latest updates from
Pest Patrol
and Norton Antivorus don't find anything. Deleting these
files results
in their reappearance when I rerun Internet Explorer. The
ll22.exe is
from a www.abetterinternet.com. Any ideas what to do?
.

On Fri, 23 Jul 2004 08:34:11 +0100, Tom Barkas
wrote:

I've suddenly started getting popups every time I fire up Internet
Explorer and these coincide with the appearence in c:\windows\temp of
the file ll22.exe and dummy.htm. The latest updates from Pest Patrol
and Norton Antivorus don't find anything. Deleting these files results
in their reappearance when I rerun Internet Explorer. The ll22.exe is
from a www.abetterinternet.com. Any ideas what to do?


Delete any cookies for such and also delete/change any
references for such in the registry.

Did you click to install something? That's the only thing I
can think as to how it wound up there. I checked the source
of the main page and there was no reference to "ll22.exe".

If you could tell us which link you clicked on, it may help.

--
Sincerely, | (©) (©)
| ------ooo--(_)--ooo------
Andrew H. Carter | /// \\\
d(-_-)b |

abetterinternet is adware and should be picked up by PestPatrol and other spyware
scans....you are apparently not keeping them updated.

ABetterInternet - Adware removal instructions
http://www.kephyr.com/spywarescanner...et/index.phtml

ABetterInternet.F - Adware removal instructions
http://www.kephyr.com/spywarescanner....f/index.phtml

http://www.pestpatrol.com/pestinfo/a...erinternet.asp

http://www.pestpatrol.com/PestInfo/v...erinternet.asp

UPDATE your anti-virus app and then run a full-system virus scan.

Use CWShredder, the CoolWeb removal tool, available he
http://www.majorgeeks.com/downloads31.html
http://www.spywareinfo.com/downloads...CWShredder.exe
http://aumha.org/downloads/cwshredder.zip

In addition, install Ad-Aware 6 free edition, start it, click its 'Check for
Updates' link in the app to install updates, then use it to scan your system, and
remove what it finds.
Ad-Awa
http://www.lavasoftusa.com/support/download/

Install the VX2 Cleaner plug-in for Ad-Aware, and run it per the instructions he
http://www.lavasoftusa.com/software/...2cleaner.shtml

Install, update and run SpyBot Search & Destroy, scan your system, and then remove
the items in RED only.
SpyBot S&D:
http://www.safer-networking.org/index.php?page=download

If you still have trouble, download, unzip, and run Hijack This from one of these
locations:
http://computercops.biz/downloads-cat-14.html
http://www.majorgeeks.com/downloads31.html
http://www.spywareinfo.com/downloads...HijackThis.exe
Unzip to a folder other than your Desktop or the Temp folder, doubleclick
HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log somewhere you can find it (Desktop, My Documents, or
similar).
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Copy the log files and paste them into a new post at one of these forums:
http://forum.aumha.org/viewforum.php?f=30
http://forums.net-integration.net/
http://computercops.biz/forums.html
http://forums.spywareinfo.com/index.php?showforum=30
http://tomcoyote.org/forums/
http://www.lavasoftsupport.com
http://boards.cexx.org/

In your post, please state your problem clearly and what you've done so far to fix
it.

The folks there will tell you what to remove.

See the "housekeeping" you should complete before you post your log:
http://aumha.org/forum/viewtopic.php?t=4075

A tutorial for using Hijack This is located he
http://tomcoyote.com/hjt/
and an in-depth tutorial is he
http://aumha.org/a/hjttutor.htm
--
Glen Ventura, MS MVP W95/98 Systems
http://dts-l.org/goodpost.htm


"Tom Barkas" wrote in message
...
I've suddenly started getting popups every time I fire up Internet
Explorer and these coincide with the appearence in c:\windows\temp of
the file ll22.exe and dummy.htm. The latest updates from Pest Patrol
and Norton Antivorus don't find anything. Deleting these files results
in their reappearance when I rerun Internet Explorer. The ll22.exe is
from a www.abetterinternet.com. Any ideas what to do?

Thanks for the message. I've added more information to the reply to
glee (which doesn't seem to turn up on my screen, so here it si:
My computer is infected with something that has come in either as
e-mail through 2 layers of antivirus software inlcuding the 21/7
Norton Ativirus signatures and not recognised by the 22/7 ones and
through Zoneaalrm Pro or via the Internet through Zonealarm Pro. It
kicks in when I run Internet Explorer and generated popups (mainly for
anti-spam and anti-virus software, but also porn and platnmum cards)
and installs My Daily Horoscope. It also manages to install various
things such as install for www.abetterinternet and ll22.exe into the
programs allowed by Zonealarm without Zonealarm questioing this. Often
or always ll22.exe is involved but this is often not on the computer
in a file scan, so seems to get generated - last night, it was in
C:/temp, but is not any more (the temp files is C:/windows/temp). Some
of the other files involved (icons etc) turn up in C:/windows/system
and c:/windows/temp/intenet files/content. There are lots of keys in
the registry for these underHKEY_CURRENT_USER\SOFTWARE\AAA_SOFT|kkkk,
pppp, and ssss and in the Internet explorer section. Ad-aware,
PestPatrol and NAV find nothing

Might have to follow your example


What sick *******s there are out there!

I recently had a similar problem that even Ad-Aware and
Spybot couldn't fix. I finally go frustrated enough that I
simply backed up (to CD or DVD) all my important files. I
then formatted my HD and reinstalled the operating system
and all my applications. That was after I'd been
troubleshooting the pop-up adware problem for about two
weeks. I'm no novice and everything I could think of and
tried didn't work. I honestly believe that there are some
things that fixes can't fix. So, like I said, if you have
a way of backing up all your important data, your best bet
might be to simply start with a new operating system. Hope
this helps.


-----Original Message-----
I've suddenly started getting popups every time I fire up
Internet
Explorer and these coincide with the appearence in
c:\windows\temp of
the file ll22.exe and dummy.htm. The latest updates from
Pest Patrol
and Norton Antivorus don't find anything. Deleting these
files results
in their reappearance when I rerun Internet Explorer. The
ll22.exe is
from a www.abetterinternet.com. Any ideas what to do?
.

I don't see a reply to my response yet, either, so I will reply to you here.
Please follow this procedure to get help:

Download, unzip, and run Hijack This from one of these locations:
http://computercops.biz/downloads-cat-14.html
http://www.majorgeeks.com/downloads31.html
http://www.spywareinfo.com/downloads...HijackThis.exe
Unzip to a folder other than your Desktop or the Temp folder, doubleclick
HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log somewhere you can find it (Desktop, My Documents, or
similar).
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Copy the log files and paste them into a new post at this forum:
http://forum.aumha.org/viewforum.php?f=30

In your post, please state your problem clearly and what you've done so far to fix
it.

The folks there will tell you what to remove.

See the "housekeeping" you should complete before you post your log:
http://aumha.org/forum/viewtopic.php?t=4075

A tutorial for using Hijack This is located he
http://tomcoyote.com/hjt/
--
Glen Ventura, MS MVP W95/98 Systems
http://dts-l.org/goodpost.htm


"Tom Barkas" wrote in message
news
Thanks for the message. I've added more information to the reply to
glee (which doesn't seem to turn up on my screen, so here it si:
My computer is infected with something that has come in either as
e-mail through 2 layers of antivirus software inlcuding the 21/7
Norton Ativirus signatures and not recognised by the 22/7 ones and
through Zoneaalrm Pro or via the Internet through Zonealarm Pro. It
kicks in when I run Internet Explorer and generated popups (mainly for
anti-spam and anti-virus software, but also porn and platnmum cards)
and installs My Daily Horoscope. It also manages to install various
things such as install for www.abetterinternet and ll22.exe into the
programs allowed by Zonealarm without Zonealarm questioing this. Often
or always ll22.exe is involved but this is often not on the computer
in a file scan, so seems to get generated - last night, it was in
C:/temp, but is not any more (the temp files is C:/windows/temp). Some
of the other files involved (icons etc) turn up in C:/windows/system
and c:/windows/temp/intenet files/content. There are lots of keys in
the registry for these underHKEY_CURRENT_USER\SOFTWARE\AAA_SOFT|kkkk,
pppp, and ssss and in the Internet explorer section. Ad-aware,
PestPatrol and NAV find nothing

Might have to follow your example


What sick *******s there are out there!

I recently had a similar problem that even Ad-Aware and
Spybot couldn't fix. I finally go frustrated enough that I
simply backed up (to CD or DVD) all my important files. I
then formatted my HD and reinstalled the operating system
and all my applications. That was after I'd been
troubleshooting the pop-up adware problem for about two
weeks. I'm no novice and everything I could think of and
tried didn't work. I honestly believe that there are some
things that fixes can't fix. So, like I said, if you have
a way of backing up all your important data, your best bet
might be to simply start with a new operating system. Hope
this helps.


-----Original Message-----
I've suddenly started getting popups every time I fire up
Internet
Explorer and these coincide with the appearence in
c:\windows\temp of
the file ll22.exe and dummy.htm. The latest updates from
Pest Patrol
and Norton Antivorus don't find anything. Deleting these
files results
in their reappearance when I rerun Internet Explorer. The
ll22.exe is
from a www.abetterinternet.com. Any ideas what to do?
.

Thanks - I'm in the process of doing this now but have to register
first. Don't know what happened to two previous messages to people
here - Free Agent claims to have sent them, but...

On Sat, 24 Jul 2004 07:09:34 -0400, "glee"
wrotg:

I don't see a reply to my response yet, either, so I will reply to you here.
Please follow this procedure to get help:

Download, unzip, and run Hijack This from one of these locations:
http://computercops.biz/downloads-cat-14.html
http://www.majorgeeks.com/downloads31.html
http://www.spywareinfo.com/downloads...HijackThis.exe
Unzip to a folder other than your Desktop or the Temp folder, doubleclick
HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log somewhere you can find it (Desktop, My Documents, or
similar).
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Copy the log files and paste them into a new post at this forum:
http://forum.aumha.org/viewforum.php?f=30

In your post, please state your problem clearly and what you've done so far to fix
it.

The folks there will tell you what to remove.

See the "housekeeping" you should complete before you post your log:
http://aumha.org/forum/viewtopic.php?t=4075

A tutorial for using Hijack This is located he
http://tomcoyote.com/hjt/

Hi, Glee,

The HijackThis people sorted it out for me. Thanks for the information
and thanks to everyone else.

On Sat, 24 Jul 2004 07:09:34 -0400, "glee"
wrotg:

I don't see a reply to my response yet, either, so I will reply to you here.
Please follow this procedure to get help:

Download, unzip, and run Hijack This from one of these locations:
http://computercops.biz/downloads-cat-14.html
http://www.majorgeeks.com/downloads31.html
http://www.spywareinfo.com/downloads...HijackThis.exe
Unzip to a folder other than your Desktop or the Temp folder, doubleclick
HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log somewhere you can find it (Desktop, My Documents, or
similar).
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Copy the log files and paste them into a new post at this forum:
http://forum.aumha.org/viewforum.php?f=30

In your post, please state your problem clearly and what you've done so far to fix
it.

The folks there will tell you what to remove.

See the "housekeeping" you should complete before you post your log:
http://aumha.org/forum/viewtopic.php?t=4075

A tutorial for using Hijack This is located he
http://tomcoyote.com/hjt/