IE7 displays login box on any page with advertising

[HappyAndyK]

Also try this:

Go in safe mode.
Run your anti-malware (av and anti-spyware). Schedule a boot-time scan of your Spybot.
Replace your hosts file with a good one as mentioned above. (which you appear to have have done)
Run CCleaner portable lite version (available on Majorgeeks) and use it.

Open IE > Internet Options > Security tab. Check in Trusted Sites/ Local Intranet/ Restricted sites, if you see any entries - delete them.

You could also try ZonedOut utility to Add, Delete, Import, Export, Build a Black/WhiteList of websites . It includes Restricted, Trusted and Intranet Zones. It is an excellent too just 185kb.

Best to always create a system restore point before making any changes to the system.

[saab340b]

Well, Kaspersky caught two that 4 other scanners missed.

kasp.html

info.txt

log.txt

I've also found on the web: "Personal Web Servers and HOSTS file
If you are running Microsoft's web server software (IIS), and you are getting "Login" pop-up prompts while using a HOSTS file, the solution is to use 0.0.0.0 instead of 127.0.0.1 for all entries except for the first entry: 127.0.0.1 localhost"

Now how do I delete this thing?

[leofelix]

Hi+your system is infected
please take a look at your HOSTS file

======Hosts File======

127.0.0.1 localhost

127.0.0.1 gannett.gcion.com
127.0.0.1 usatoday1.112.2o7.net
127.0.0.1 ads.revsci.net
127.0.0.1 pix04.revsci.net
127.0.0.1 ads.adsonar.com
127.0.0.1 an.tacoda.net
127.0.0.1 acestats.com
127.0.0.1 www. acestats.com
127.0.0.1 www .activesearch.com #[Adware.ActiveSearch]

----


-------
According to Kaspersky on line you catched
File name Threat Threats count C:\0temp\dvd6070.zipInfected: Trojan.Win32.Agent.danz1

C:\0temp\fix.zipInfected: Trojan.Win32.Buzus.cifn----------------

Now please visit this page

SUPERAntiSpyware.com - Online Scanner

Download the scanner (is stand alone), double click it, update it than run a full scan.
Let SuperAntiSpyware remove all threats found

Please copy the log file in your reply
Thank you

[EDIT to say] Your SUN Java JRE is outdated, please uninstall it immediately and install SUN Java JRE 1.6.0.17
http://www.filehippo.com/download_java_runtime/

[saab340b]

I am a little leary of purchasing using a credit card online right now. Does this program require a purchase to fix the problem?

[leofelix]

I am a little leary of purchasing using a credit card online right now. Does this program require a purchase to fix the problem?

No it is completely free, morevover it doesn't need to be installed, since is stand alone

http://www.superantispyware.com/sassaferun.php

[saab340b]

I've pointed the program to the folder that contains the virus files (thinking i won't have to wait for another 2 hour scan) and all it found was a few advertising cookies to quarantine. Should I let it go ahead and do a full scan?]

[leofelix]

Run a full scan please

[saab340b]

the full scan resulted in 14 adware.tracking cookies. i fixed those and cleaned my hosts file, rebooted, and no popups.

I'm going to delete those two infected zip files and check my registry for any entries with that name.

Thanks for all of your help. It was really appreciated.
Eric

[leofelix]

You're welcome
I'm glad you could solve and thank you for making me know

I hope you uninstalled your old SUN Java JRE (which is vulnerable) and installed the latest JRE 1.6.0.17 version in the mean while

[rkonit]

You're welcome
I'm glad you could solve and thank you for making me know

I hope you uninstalled your old SUN Java JRE (which is vulnerable) and installed the latest JRE 1.6.0.17 version in the mean while

+ Update to Internet Explorer 8