Pop-ups cannot be eliminated
Help! What is the problem and how do I get rid of it?
Near the end of my wits after 15 hours trying to clean a Windows XP PC. I have uninstalled a huge chunk of software, deleted cookies, history & temp internet files, run updated Spybot, Norton & McAfee, combed the registry, emptied Windows Temp directory. All this, and my user still suffers from spontaneous combustion (7 Internet Explorer ad pop-ups open when the user does nothing and gets nowhere near any kind of Internet application or Explorer of any kind).
I am next going to have the user verify that Windows Messenger was not somehow re-activated.
I will also try installing Ad-Aware - once that is installed and updated (along with McAfee and SpyBot), I will restart and disconnect from the network. I will log in holding down the <Ctrl> key, and go through the whole deleting files business again. Once all the protection software has done checks and dealt with any problems I hope the PC will be clean.
Have I missed anything? If Ad-Aware does not finally get this thing, I am afraid it will be down to formatting the hard drive.
Here are the things commonly detected: eZula, WebSearch, ClientMan, Avenue A, Zesty-Find (they put a shortcut on user's desktop without permission or warning), gonna-search (all over the registry anywhere a URL is supposed to appear), AdGoblin, ILookup and more.
In three separate SpyBot sweeps in three consecutive days, an average of 40 items is detected, but the problem remains the same.
The most common things are an Internet Explorer session showing a Next Aisle ad for some kind of Shield (anti-virus) software, a session titled "about:blank", and one for "69.20.62.53 yyy.s.html". The IP address will tracert to a U.S. company called "Inter-Nic Technologies" (web1.nictechnetworks.com [69.20.62.53])... here is what Network Solutions says in their whois on this domain name:
"Registrant: Domains by Proxy, Inc.
Registered through: GoDaddy.com
Domain Name: NICTECHNETWORKS.COM
Domain servers in listed order:
NS1.PRIMARYDNS.COM
NS2.PRIMARYDNS.COM
For complete domain details go to:
http://whois.godaddy.com"
Late follow-up on resolution
Looks like much of the help was exactly that (unlike what is - in theory - provided by the BIG BUSINESS uber-corp establishment).
I did not install any toolbars - I am trying to discourage my network users from adding stuff to the software they use. A separate program that is visible to the user is not much better (since user might then reason that he/she is ALSO allowed to install stuff). Still... what worked? read on
- SpyBot and McAfee did a nice job of catching and ejecting most of the bad stuff AFTER the computer was already infected. These were already on the PC and were no help before I came to Anti-Online.
- The HOSTS file tweak was able to stop more than 50% of the new stuff from invading, since the immoral NicTechnologies IP was redirected to the user's PC.
- Ad-Aware cleaned up 95% of what was left on the machine.
Thank you everyone - my user is happy to have his PC back (mostly) in his control!!
- Credit goes to anyone who recommended the HOSTS file & Ad-Aware solutions.