Need help getting rid of pop-ups

A co-worker recomended that I try to post my problem here to see if there might be anyone that could lend me a hand. For the past week I've been having a problem with an obscene amount of pop-ups on my home machine and they are to the point of driving me batty.

Some info:
I'm using Windows XP Pro - fully updated
I use IE, NS7.2, and Mozilla Firefox as my browsers.
I have to use IE for work I do at home as this is the only browser that the web applications I'm testing perform in properly. For my personal use I prefer the other two. I also have to have pop-ups enabled in IE because of the web application I'm testing for work - it relies heavily on them (I didn't design it - I'm only QAing it).
I've run AdAware and SpyBot both multiple times and each and everytime I run them they seem to find more to remove but the pop-ups don't ever go away.
I thought that perhaps they came from spyware I might have gotten while downloading Sims2 files, however my attempt at a restore (which is what someone else had suggested I try to do) was before I'd even downloaded anything, the 5th of Feb, and the problems are still present.
These are most definatly NOT Messenger pop-ups.
The pop-ups are not restricted to IE. I get them both in IE and Netscape.
As I'm having to do work on a borrowed laptop currently, my home PC is not connected to the internet - this has not stopped or even slowed the pop-ups.
The pop-ups do not appear to be for any one specific site, but are each and every one of them an ad for something or another - including but not limited to car insurance.
Running SpyBot and AdAware in Safe Mode seemed to remove the most problem files, but again did not clear the problem away completely.

Any assistance with this matter would be greatly appreciated. Thank you in advance.

Welcome to AntiOnline :D

If I'm not mistaken, Netscape has a popup blocker extension much like that of Firefox - if so, you can select which sites you don't want popups from, so that's 2 of 3 browsers fixed.

Spybot and AdAware might kill certain spyware programs that may or may not cause popups, but I seriously doubt they'll fix your popup problems completely. More than likely it's the sites you're visiting calling up popups and not spyware/adware on your machine.

Unfortunately I know of no such aids for MSIE since I haven't used it in many years now. I hope the little help I provided works for you, and that someone else has a fix for MSIE!

Quote:

---

As I'm having to do work on a borrowed laptop currently, my home PC is not connected to the internet - this has not stopped or even slowed the pop-ups.

---

Ok, you're getting pop-ups when you aren't on-line and don't have an open brower? Is that right?
Have you installed any sottware lately?

Well, the problem is I visit some pretty run of the mill sites for the most part, but these are happening when I'm off line not visiting any sites. Right now my roadrunner connection is plugging to the laptop I'm sending this post from, while my PC sits on the desk behind me, more and more pop-ups showing up on the screen.

I mean, I do know of one sure fire way to get rid of them, but I'd really rather not resort to a drive format if I don't have to. I also have the NS pop-up blocker on with no accepted sites on my list (there aren't any sites I visit on NS that use pop-ups) at this time.

I also just checked (and closed out even MORE pop-ups) and some of these pop-ups link up to some site; amaena.com that starts mentioning the Black Worm virus (which my virus scan indicates is not on my system) and some happysomethingorother.com site. I'll check again when another pop-up shows up (I'm sure there will be more by morning).

And some of the ads don't show a broswer bar - they look like those new ads that some sites use that lay over the page you're visiting (man those are annoying) and are just kinda hanging out there on my screen.

Quote:

---

Originally posted here by preacherman481
Ok, you're getting pop-ups when you aren't on-line and don't have an open brower? Is that right?
Have you installed any sottware lately?

---

Exactly correct yes.
The only software I've installed was The Sims 2 (and the Nightlife expansion), and a few objects I downloaded from the Maxis website and from SimSlice's website. Beyond that, the only other thing I installed was the program that lets me connect to my workplace's network from home.

You may want to try this.
http://hijack-this.net/

I got Browser Hijack on my work pc also. It gets annoying real fast. http://hijack-this.net/ works good but im not ready to pay outta my own pocket for spyAlert for a computer that isn't mine.

Know any free removal's that can recognize it

And my lovely browser hijack is brought to me by the fine people of websponsers.

Might want to look at MyIE2. IIRC it does do pop-up blocking amongst other things. And I believe it is free.

Quote:

---

and from SimSlice's website.

---

Well there's your problem, the simslice site is pack filled with extra goodies ;)
grab some Highjack this. also AdAware and also Spybot Search And Destroy
Update all definition files, including your antivirus software. reboot into safemode and scan with the above software, then copy and paste a copy of the log file from hijack this once you have done the scans..

f2b

Ive used spybot and adAware on mine and niether can pick it up.

I don't think spybot is designed for safemode.

Hi Chelle,

IMHO you are definitely on the right track.

Read this Cleaning a pest infected computer to give you some structure with your cleaning.

In addition, get the latest version of this CCleaner

and run it just before you reboot into safe mode and then again before you go back online again

Then get the free version of this ewido

and run in safe mode while you are doing all your safe mode stuff ie adaware. It may prompt you for action during the scan and just oblige, don't wait till the end of the scan. Keep the end log too. Don't bother running spybot in safe mode it is not designed for it as far as I know, and no-one here has yet told me otherwise. reboot into safe mode after each scan and keep scanning untill you get two consecutive clean scans for both ewidow and adaware.

I would recomend an online scan too, there are quite a few good ones, these were the ones I used, though any scanners recommended by the fine dudes on this site are likely to be winners:

http://www.kaspersky.com/af/globalstore
http://www.pandasoftware.com/products/activescan.htm
Keep the logs for these too.

Make Hijack this the last thing you do!!!

Then after you have done everything, post ewido log, online scan logs and hijack this log on here and the knowing folk can help you clean the last bits for you.

Then finally, I would recomend thisHosts file though read what it does if you don't already know, and install it manually (easy) so that you know how to put the original host file back if it doesn't agree with your work. If you get a message pop up saying "the connection was refused...." that is the host file has blocked the site due to known malware.

I think this should cover it.

The ever very Frondification of the world

Sounds like Spyaxe or CoolWebSearch. You might try an online scan. I much prefer Panda software's scanner which will pickup both viruses and spyware. Panda's not going to remove much, but it's probably the best of the online scans. When you get badly infected with either spyware or viruses, you need to break it down to a two-step process. The first step is finding what you have in there, the second step is removing it. Panda will help you find it.

http://www.pandasoftware.com/product...ACHEHINT=Guest

As for pop-up blockers, both the Yahoo and the Google toolbars for Internet Explorer have built-in blockers. But they're not going to do you much good against pernicious spyware.

http://antionline.com/showthread.php...ighlight=zones

Thanks all, I'll switch my net connection later when I'm done with work and give a few things a try and will definatly report back on the status of things.

A couple things...
I used SpyBot in safe mode yesterday and it picked up a large list of spyware and in fact removed some things that it hadn't been able to in normal mode. I'm unsure if it's designed to run in safe mode as I'd used it or not, but it seemed to have an impact.

Also, I ONLY use IE for work, nothing more. I never do ANY browsing through it (I personally lothe IE). The web applications that I test in IE require that I have pop-ups enabled as well as ActiveX and a many other features that most would turn off as security measures (which is why I really don't like the site design - they should have taken this into consideration when building it). Most of the web apps I work with I have to use VPN to connect to the office network because they are intranet systems currently and not live; thus they are very secure (or at least should be). Other then these tasks I wouldn't even DREAM of touching IE... it's like a portal into direct evil... at least, from my perspective.

Hi Chelle

Quote:

---

I used SpyBot in safe mode yesterday and it picked up a large list of spyware and in fact removed some things that it hadn't been able to in normal mode. I'm unsure if it's designed to run in safe mode as I'd used it or not, but it seemed to have an impact.

---

Interesting, if it works go with it, I could not get it to close down, and it did not pick anything up for me, so i assumed it was not really designed for safemode.

Fronny

Quote:

---

"I got Browser Hijack on my work pc also. It gets annoying real fast. http://hijack-this.net/ works good but im not ready to pay outta my own pocket for spyAlert for a computer that isn't mine. "

---

i use Hj this as well as adaware and spybot and dont have many probs there isn't much they cant fix pls post a log i am interested also. Dunno if i'll be any help but- many hands as they say make lite work.

Please note that hijack-this.net has nothing to do with the Hijack This application. It is owned by altertspy, a company listed as possible rogue antispyware :

Quote:

---

false positives work as goad to purchase; uses inadequate ref database; exploits name "hijack this" (1); exploits name "spybot" (1, 2); same app as AdwareDeluxe, AdwarePatrol, AdwareRemover, AdwareSafety, AdwareTools, Doctor Adware, Doctor Adware Pro, PestBot, PestProtector, SpyDestroy Pro, SpywareRemoval, & SpywareRemover; same company as MicroAntivirus; same company as MicroAntivirus

---

http://www.spywarewarrior.com/rogue_anti-spyware.htm

The correct link is http://216.180.233.162/~merijn/index.html.

And a great parser can be found at http://www.hijackthis.de/. Both have been mentioned, but there seems to be some confusion.

What it sound like to me, is that you D/L'd something that came with a [clandestine] downloader... At least that is what I suspect.
Do you use kazaa, morpheus (if it is even still around) or maybe even some bit torrent ? Any type of P2P ? What about cursor or screen saver packs (as I've seen them to be some of the most common offenders) ? I think that could narrow it down a little. Just a thought.

Quote:

---

Originally posted here by dmorgan
What it sound like to me, is that you D/L'd something that came with a [clandestine] downloader... At least that is what I suspect.
Do you use kazaa, morpheus (if it is even still around) or maybe even some bit torrent ? Any type of P2P ? What about cursor or screen saver packs (as I've seen them to be some of the most common offenders) ? I think that could narrow it down a little. Just a thought.

---

No, the last time I used a P2P was when WinMX was still around - and the hard drive I have is brand new since then :D I also refuse to download things like screen savers or cursors or those horrid smilie packs that I constantly get ads for in my inbox. I've ultra careful about downloads and only use sites I know for a fact to be safe. This is why I'm so frustrated about this problem. I cannot for the life of me figure out where this might have come from. The only thing I can possibly think of is some files a friend of mine sent me a few weeks back with some stuff that she'd made for Sims2. Is it possible that these archives became infected during compression on her machine without her realizing it?

Quote:

---

Originally posted here by .:front2back:.
Well there's your problem, the simslice site is pack filled with extra goodies ;)
grab some Highjack this. also AdAware and also Spybot Search And Destroy
Update all definition files, including your antivirus software. reboot into safemode and scan with the above software, then copy and paste a copy of the log file from hijack this once you have done the scans..

f2b

---

I'm sorry for not responding to this, I totally missed this post before though. I'm 100% positive that this did NOT come from SS's site. I've used his site for a VERY long time now and have never once had a problem. I'm even a paying member of his site (again, have been for a while now).

Now, I've run AdAware and SpyBot multiple times each since this started (as I previously stated) and each time they find more and more new "goodies" to remove. As for hijack, I have yet to be able to get it to work.

Quote:

---

As for hijack, I have yet to be able to get it to work.

---

Did you download from the link I provided ? What happens when you try to use it ?

Note on the download page :

Quote:

---

CWShredder or HijackThis closes immediately after opening?

There is a variant of the Coolwebsearch trojan spreading that closes several anti-spyware apps when you try to open them.
If this is happening to you, download PepiMK's CoolWWWSearch.SmartKiller removal tool first and run it. After it does its job, CWShredder and HijackThis will run properly (as well Spybot S&D, Ad-aware and several anti-spyware forums).

---

Quote:

---

Originally posted here by hesperus
Did you download from the link I provided ? What happens when you try to use it ?

Note on the download page :

---

Yes, and saved it, extracted it into it's own folder.
It closes the moment I try to run it.
I tried to run... the smartkiller thing to see if that would work.
But the only link I keep finding to download it from leads me to a progam that also errors telling me that it cannot find CoolWWWSearch.SmartKiller (v1/v2) on my system.

As an added note, after running all the various programs and such, the IE pop-ups seem to have completely disappeared. It's only the NS ones and the floating ones that I'm still getting.

Quote:

---

Originally posted here by Chelle
Yes, and saved it, extracted it into it's own folder.
It closes the moment I try to run it.
I tried to run... the smartkiller thing to see if that would work.
But the only link I keep finding to download it from leads me to a progam that also errors telling me that it cannot find CoolWWWSearch.SmartKiller (v1/v2) on my system.

---

That is not an error. Its telling you it can't find it. Right. So something is keeping you from running hijack this. Either you have to keep throwing scanners at it or start from scratch. Have a look at this tutorial for a good list of scanners and detailed instructions. If you choose this route, follow them carefully. Check out Itty Bitty Process manager in particular.

Good luck.

Quote:

---

Originally posted here by hesperus
That is not an error. Its telling you it can't find it. Right. So something is keeping you from running hijack this. Either you have to keep throwing scanners at it or start from scratch. Have a look at this tutorial for a good list of scanners and detailed instructions. If you choose this route, follow them carefully. Check out Itty Bitty Process manager in particular.

Good luck.

---

Thanks, I'm willing to try pretty much anything to avoid having to format at this point. I'll read through that carefully.

Well, I thought I'd post a little bit of an update. I ran this problem by my NetOps guy at work to see what he thought too and he thought it sounded like whatever was causing the pop-ups was a latent program that reinstalled them every time I removed them. He also said finding these programs can be difficult without the right tools, as they can have names that are strikingly similar to Windows components... and unfortunately I simply cannot afford the tools to do such a search. So, after all the advice from everyone here that's tried to help and from my NetOps guy I made the decision to simply format the blasted thing. He burned a CD for me which I have to run tonight, he said it will check to make sure that nothing was left behind and that it was a clean format (I cannot remember the program name at this time).

Anyway, thank you to everyone that tried to help me figure this one out...

You know...sometimes that is the fastest easiest and surest way to clean a computer.

I have spent days trying to fix stuff....and end up formatting anyway.

Always like a nice clean install..........so much fun to try and break it again :D

MLF

Hi I am obviously late as you are going to do a reformat, but for future reference, you might want to try disabling/turn off system restore, do all of your scans in safe mode, unhide all files and folders and delete all temp files, then reboot into normal mode, with system restore off, this will flush out your system restore points.

Sometimes .exe's will reside in a system restore point and each time you reboot will try to open, such as popups and repopulate your pc, even though you tried removing, as the scanners will not remove what's left behind in your systemvolumeinformation restore points.

Kelly's Corner has some useful info on system restore's.

Luck... ;)

Quote:

---

Originally posted here by morganlefay
You know...sometimes that is the fastest easiest and surest way to clean a computer.

I have spent days trying to fix stuff....and end up formatting anyway.

Always like a nice clean install..........so much fun to try and break it again :D

MLF

---

I tend to agree with you there. I've never had a trojan on my computer (that I know of :) ), but I think if I found one, I would incline toward just backing up everything and reinstalling. I know there are trojan removers out there (don't know if such a thing exists for *nix) but I would always be wondering if somehow they missed something. I think I tend toward the paranoid school when it comes to such things.

Quote:

---

Originally posted here by morganlefay
You know...sometimes that is the fastest easiest and surest way to clean a computer.

I have spent days trying to fix stuff....and end up formatting anyway.

Always like a nice clean install..........so much fun to try and break it again :D

MLF

---

I agree 100%... I feel so much better now that I've formated and gotten everything up and running smoothly again.

And I do know what ya mean! ;) I break software for a living actually...

Quote:

---

Originally posted here by dalek
Hi I am obviously late as you are going to do a reformat, but for future reference, you might want to try disabling/turn off system restore, do all of your scans in safe mode, unhide all files and folders and delete all temp files, then reboot into normal mode, with system restore off, this will flush out your system restore points.

Sometimes .exe's will reside in a system restore point and each time you reboot will try to open, such as popups and repopulate your pc, even though you tried removing, as the scanners will not remove what's left behind in your systemvolumeinformation restore points.

Kelly's Corner has some useful info on system restore's.

Luck... ;)

---

Well, there's no way of knowing if this would have worked on my problem this specific time, though I was doing scans in safe mode, my files and folders are unhidden (not that I would recognize each and every file by sight anyway)... As for the system restore, I have no idea if it was on or off to be honest, I've never used that particular feature of XP.

However, I'm pretty sure I DID figure out where my little problem came from. There is a browser based, text run RPG that I play. Like most, this game has the vote links that you can use and get in game rewards for. Well, just recently a notice was posted up...

Quote:

---

There is a Virus Issue with the Sweet Online Vote Link! I suggest you NOT use that one until further notice.

Vote Master

---

After talking to a few of the people that are in charge of the site the initial reports of a problem coincide to the time I started having problems with my PC. I'm not sure how the virus was launched from their site, but I will from now on be more careful about those vote links AND will be putting a better virus guard on my home computer (I'm pretty sure that's what's protected my work machine).

Quote:

---

As for the system restore, I have no idea if it was on or off to be honest, I've never used that particular feature of XP.

---

Just started playing with it myself...with laptops and remote users...as a quick reset of the system....

Here is more info on it
http://www.microsoft.com/windowsxp/u...w_03may19.mspx

Malware tends to hide in there too...so you shut it down and scan in safe mode.

Then you can re-enable once you feel the machine is clean...you can also create a restore point.

Quote:

---

And I do know what ya mean! I break software for a living actually...

---

thats part of my job too....... :(
dll conflicts

Anyway...

welcome to AO

Good to hear your system is all fixed.........and ready to break again :)

MLF