Over 1 million tech questions and answers.

Having Major pop unders from Top-banners!

Q: Having Major pop unders from Top-banners!

Hello,
***(Here is a duplicate of a message sent to a member - FYI)

I'm posting here because I see the extensive help you've provided your members and would like to ask for assistance in removing 'top-banners' pop unders from my PC. I have installed and ran over 7 anti-spyware/adware/malware programs, with a few removed malicious files, without a cure for the pop unders... Please help!! I have BitDefender, Panda ActiveScan and HJT log files as well as the previously mentioned programs still installed (Webroot SpySweeper, Spyware Nuker XT, Spybot S&D, TrendMicro Antispyware, SpyRemover, Spyware BeGone and Lavasoft Ad-Aware 6 - I also have CCleaner, Windows Malicious Software removal tool, Microsoft defender, CWS Shredder and Kill2Me)

Needless to say I have been trying EVERYTHING! I understand programs, etc. fairly well but cannot seem to isolate where these programs are either located or respwaning from...

Here is the HJT log from today.. just after running Webroot Spy Sweeper. Also, please include how to donate to your site. I have searched high and low and think that the assistance you've given to the other posters I've read is excellent and should be compensated for.

********************HJT LOG START*****************************
Logfile of HijackThis v1.99.1
Scan saved at 11:53:56 AM, on 6/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe
C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgttry.exe
C:\Program Files\UltraVNC\winvnc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
E:\PROGRAMS\Hijack This\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://vs.mcafeeasap.com/SW/ENU/VS40/bin/myCioAgt.20060504183849.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = usfundinggrp.local
O17 - HKLM\Software\..\Telephony: DomainName = usfundinggrp.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = usfundinggrp.local
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt4.0.0.358.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: Media Center - C:\WINDOWS\system32\kvdes.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: EIVCJ - Unknown owner - C:\DOCUME~1\PASSAN~1\LOCALS~1\Temp\EIVCJ.exe (file missing)
O23 - Service: GYK - Unknown owner - C:\DOCUME~1\PASSAN~1\LOCALS~1\Temp\GYK.exe (file missing)
O23 - Service: IQVAYAYLFVV - Unknown owner - C:\DOCUME~1\PASSAN~1\LOCALS~1\Temp\IQVAYAYLFVV.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LGHFX - Unknown owner - C:\DOCUME~1\PASSAN~1\LOCALS~1\Temp\LGHFX.exe (file missing)
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: McAfee Total Protection Agent Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SonicWALL Agent Service (SWAGENT) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: ZUQI - Unknown owner - C:\DOCUME~1\PASSAN~1\LOCALS~1\Temp\ZUQI.exe (file missing)

********************END HJT LOG***********************************

Thanks again,
J. Matlock
Passani Electronics, Inc.

RELEVANCY SCORE 200
Preferred Solution: Having Major pop unders from Top-banners!

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: Having Major pop unders from Top-banners!

Read other 16 answers
RELEVANCY SCORE 43.2

Pop ups and unders in mozilla firefox have tried various anti virus and malware scans nothing picks it up Any help appreciated. Thanks

Also ran gmer.exe and when scan is finished it says nothing found and the page stays blank


DDS (Ver_09-07-30.01) - NTFSx86
Run by ajmorno at 18:49:28.45 on 15/09/2009
Internet Explorer: 7.0.6001.18000
Microsoft? Windows Vista? Home Premium 6.0.6001.1.1252.353.1033.18.984.281 [GMT 1:00]

SP: SmitFraudFixTool *disabled* (Updated) {5A1CDE3C-1D07-4BF3-9EA6-224E9A019DE6}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\W... Read more

Read other answers
RELEVANCY SCORE 43.2

I keep getting popunders from tribalfusion..How do I stop this
I'm using FF 1.5.0.8.
windows XP

thanks
 

A:Pop Unders

Read other 11 answers
RELEVANCY SCORE 43.2

While waching videos my Avast anti virus went off and could not actually remove the virus but continuedto create alerts. I ran adaware and it showed a malware to delete. I did and I am still getting the pop ups.I downloaded HJT and ran it but i cannot use the analyse feature. It causes an error repot to show to sent o MS>Here is the lof file..please help!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 7:31:55 PM, on 12/26/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16574)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\ACS.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\dla\tfswctrl.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics&#... Read more

A:Pop Ups And Pop Unders

Hello there and welcome to BleepingComputer. My name is Charles and I will be dealing with your log today.Using My Computer, navigate to where you have HijackThis saved. Right-click on the HijackThis.exe file. Select "Rename", call it fluffybunny and press enter. Use fluffybunny.exe from now on.Please then post back a new HijackThis log using the renamed file.

Read other 18 answers
RELEVANCY SCORE 43.2

When in IE8 I get pop-up adds or pop-under adds, whatever term you want to use to describe them.

In safe mode I have scaned numerous times with Malwarebytes and Spybot, while they do pick up some adware trojans the pop-ups keep on coming and I do not know what else to do so I am trying this.

I do not know if it matters, but I have three hard drives; C: with the OS and everthing else, D: that is the HP backup drive with all the software that came on this PC and G: that only has Flight Simulator X and related Flight Simulator X software. When running RootRepeal as soon as it starts to scan G: I get a blue screen that probably says something about a hardware problem and then the PC reboots so the attached RootRepeal log is only for C: and D:.

Thanks in advance for the help.

DDS Log

DDS (Ver_09-10-26.01) - NTFSx86 NETWORK
Run by HP_Administrator at 10:20:02.65 on Sun 11/22/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2917 [GMT -6:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\... Read more

A:Can not get rid of pop-ups/pop-unders

Problem solved, I renamed all files in the following folders as ".bak" and my pop-ups and pop-unders are now gone.

2009-11-16 02:18:31 0 d-----w- c:\program files\Automated Content Enhancer
2009-11-16 02:18:26 0 d-----w- c:\program files\Web Search Operator
Like an idiot in a very stupid momentary lack of judgement I agreed to download this stupid toolbar

2009-11-16 02:18:16 0 d-----w- c:\program files\HottieStar Toolbar

Right after I did it I deleted the toolbar, but to late.

To let everyone know the files in these folders appear to be so new that even with updated virus definitions scans by Malwarebytes, Spybot, ESET NOD 32 and Windows Defender do not even pick them up.

Rod

Read other 3 answers
RELEVANCY SCORE 43.2

I keep getting pop ups or should i say pop unders since thats what the one window says when it opens, I tried scanning for malware, virus's, got 2 different pop up blockers, switched to firefox, and i still get I.E. pop ups while im on firefox, i tried to block the sites and that still does not stop the same sites from popping up here is my hijackthis log any help?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:27:52 PM, on 9/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://flashline.kent.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http... Read more

Read other answers
RELEVANCY SCORE 43.2

Just in the last few days I'm getting pop unders if that's the correct term. Haven't had those for what seems like years. Most are those "lower my utilities" that I remember getting long ago. I don't know where to go to see if something has changed that is now allowing them.

A:Getting 'pop-unders'

We'll need more info. Is this using IE9 listed in your specs? Happens randomly, or at startup, on certain sites, etc? Happens on other browsers as well? Try running AdwCleaner and see if it can find the culprit.

AdwCleaner Download

Choose the Download Now @BleepingComputer link

How To Use AdwCleaner [Manual]

Report back with the log file if you are unsure what to delete. A Guy

Read other 1 answers
RELEVANCY SCORE 43.2

I have two popup blockers and still get popups and pop unders,some from microsoft saying page can't be displayed.I have windows XP with servise pack 3 and the new brouser.I have used Ad-Aware and have AVG and Filseclad firewall.Need help before I go nutts...lol
 

Read other answers
RELEVANCY SCORE 43.2

the last few days i've been invaded with pop unders from all different web sites a few are login.tracking101: ads.aedgency.com: playeronly.com ect I just downloaded hijack this and not sure if you want it here or not
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:54 PM, on 3/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
C:\Program Files\Sony\Sony TV Tuner Library\SMceMan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
C:\Program Files\C... Read more

Read other answers
RELEVANCY SCORE 43.2

Hi there,
Keep getting popups and unders in firefox when I open a new page or click on links have tried a few different virus stuff but nothing works HELP PLEASE!

A:Pop up and Pop unders everywhere!

Hello and welcome to TSF.

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Read other 1 answers
RELEVANCY SCORE 42.8

I am experiencing several very annoying po-ups and pop-unders, can you help please?Log is as follows:Logfile of HijackThis v1.99.1Scan saved at 17:30:59, on 19/11/2006Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\BT Yahoo! Internet\ModemLock.exeC:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCCserv.exeC:\WINNT\System32\svchost.exeC:\PROGRA~1\Iomega\System32\AppServices.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\WINNT\system32\regsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system32\stisvc.exeC:\WINNT\Explorer.EXEC:\WINNT\System32\WBEM\WinMgmt.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINNT\system32\svchost.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Iomega\AutoDisk\ADService.exeC:\Program Files\Iomega\AutoDisk\ADUserMon.exeC:\Program Files�... Read more

A:Annoying Pop-ups & Unders

You may want to print this or save it to notepad as we will go to safe mode.Fix these with HiJackThis ? mark them, close IE, click fix checkedO16 - DPF: {33331111-1111-1111-1111-611111193423} ? O16 - DPF: {33331111-1111-1111-1111-615111193427} ? O16 - DPF: {CT id=e codeBase=http://www.www2.p0rt2.com/files/epl29bf2.cab classid=clsid:33331111-1111-1111-1111-615111193427} ? O16 - DPF: {CT id=e codeBase=http://www.www2.p0rt2.com/files/epl85bf2.cab classid=clsid:33331111-1111-1111-1111-615111193427} ? O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINNT\system32\vbsys2.dllDownLoad http://www.downloads.subratam.org/KillBox.zip orhttp://www.thespykiller.co.uk/files/killbox.exeRestart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box. C:\WINNT\system32\vbsys2.dllNote: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the... Read more

Read other 1 answers
RELEVANCY SCORE 42.8

Help!! Im not a techy etc, but Im hoping you can help. Since I got my new laptop I have been inundated with pop under ads such as acaiberry, date.com, prizedb and tons more. I have norton antivirus software installed, I have all the pop up blockers enabled, I deleted all the cookies of these websites and I have tried increasing the security settings, but nothing will stop these ads. I have downloaded numerous different spyware programs and scanned my computer several times, occasionally it finds a few files it wants to delete, but again the adds keep coming. I even downloaded a pop up blocker, but this doesnt stop them either. One thing I have noticed is that they usually pop under when I click on things, especially when Im looking at friends photos on facebook. I thought perhaps its was specific to firefox, but it happens in IE as well.

Im just about at my wits end with these things, they are extremely annoying. Im thinking perhaps there is some kind of infection of my computer that the software I downloaded isnt picking up.
 

A:Persistent pop unders!!

Read other 13 answers
RELEVANCY SCORE 42.8

i have not had this problem in a very very long time. i use spysweeper and norton and have been free of this kind of problem for a year until i took my notebook out of town...

i have been getting pop-ups from partypoker, hostreview, ad.yieldmanager, etc...

i spyswept, antivirused, and registry cleaned but i cant stop my problem.

help please...

here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 3:41:09 AM, on 1/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
... Read more

A:unstoppable pop-ups and unders did everything i could...

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.


* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *


Download & install CleanUp.exe (not recommended for WinXP64)

Download and install Ewido Security SuiteWhen installing, under "Additional Options",uncheck - Install background guard

Have Ewido update itself & then exit the program.
If you are having problems with the updater, you can use this link to manually update Ewido

'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding.
It is IMPORTANT that you don't miss a step & perform everything in the correct order.


Please disable Webroot SpySweeper, as it hinders the removal of some entries. You can re-enable it after you're clean.
To disable Webroot SpySweeper:Go to the Options>Program Options
Uncheck Load at Windows Startup
Click Shields & uncheck all items there
Uncheck Home page shield.
Automaticly restore default without notification

* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * ... Read more

Read other 19 answers
RELEVANCY SCORE 42.8

Please check for me what I'm doing wrong. I have XP. Running behind Zone Alarm Pro, E Trust Antivirus, also regularly us Ad Aware and Spybot. Recently added Spy Hunter (don't know if its actually got spyware in it). Pretty sure I have Smithfraud and SSK.

I've tried everything including unchecking things msconfig start up and add remove.

The popups just keep coming back!

Any help would be deeply appreciated.

Thank you,
Steve
Logfile of HijackThis v1.99.1
Scan saved at 7:17:25 AM, on 9/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\ps2.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe
C:\Program Files\C... Read more

A:Pop ups and unders no matter what I do. Log

Read other 12 answers
RELEVANCY SCORE 42.8

Any help will be greatly appreciated. I use these forums all the time to look up solutions to problems that I or clients are experiencing.

Some help with this one would be great.

I have a WinXP Pro comp running firefox 3.0.6. Computer is not running sluggish, but when using the browser online I am getting popups like:

http://hornymatches.com/geolist18_35.php
http://fxclub.com/adon-en-exp
etc.

I have experienced two while typing this message. I have run Kaspersky's online scanner, I have AVG currently running on the computer and it is up to date, as it was when I was infected with this malware or whatever. Here is a Hijack this log.

Help is greatly appreciated!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:30:38 PM, on 1/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\... Read more

A:horymatches.com and other pop ups(unders)

Please do not create multiple threads for the same problem.
Continue here: http://forums.techguy.org/web-email/792580-horymatches-com-other-pop-ups.html
 

Read other 1 answers
RELEVANCY SCORE 42.4

Hello... I apologize now if this has been covered, but I have tried to look, which is tough while trying to get all these pop-ups and unders to stop. I recently bought Norton Internet Security, with the Anti-Virus, and the Anti-Spyware. When I first installed and ran it, it did find a heck of a lot of things which were in turn deleted. But still, even when my IE browser is not open, I'm getting pop-ups like madness. If I walk away from my PC, with nothing running, when I return 20 mins later, I have 65-100 pop-ups on my PC. I also have Spybot-S&D and it finds nothing. I really don't know what to do to stop this. Where am I going wrong??
 

A:Solved: ??-virus,pop-ups,pop-unders....

Read other 16 answers
RELEVANCY SCORE 42.4

horymatches.com and other pop ups(unders)
Any help will be greatly appreciated. I use these forums all the time to look up solutions to problems that I or clients are experiencing.

Some help with this one would be great.

I have a WinXP Pro comp running firefox 3.0.6. Computer is not running sluggish, but when using the browser online I am getting popups like:

http://hornymatches.com/geolist18_35.php
http://fxclub.com/adon-en-exp
etc.

I have experienced two while typing this message. I have run Kaspersky's online scanner, I have AVG currently running on the computer and it is up to date, as it was when I was infected with this malware or whatever. Here is a Hijack this log.

Help is greatly appreciated!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:30:38 PM, on 1/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPan... Read more

Read other answers
RELEVANCY SCORE 42.4

I checked for updates for Adaware and Spybot. Then DISCONNECTED from internet. I ran Adaware and Spybot. Adaware had some cookies which I removed, no other threats. Spybot had ONLY 3 malware (usually I find a dozen or so. Removed and immunized for them. Then I reconnected to internet. Looked at one gmail account and within less than TWO Minutes, there was Horny. something or other and Mevee.annoyme ALL OVER AGAIN.Can someone suggest a fix for me?XP home, compaq desktopTIARobertaEdit: Moved topic from AntiVirus, Firewall and Privacy Products and Protection Methods to the more appropriate forum. ~ Animal

A:Pop-unders Are Making Me Crazy!

Download Super Anti Spyware and run it. It's much more effective than either Spybot or Ad Aware.http://www.superantispyware.com/

Read other 3 answers
RELEVANCY SCORE 42.4

I have had recentproblems with annoying pop ups/ unders and web pages appearing when i am on line.
A persistent one i from AVSystemCare, requesting that i do a spyware scan, others are from free offers sites for cellphones, gambling and other junk.
I have run spybot and AVG Systemcare but they are still there.

I recently installed a free discburning programme from AVS media. Would this be a source of the problems?
An HJT log is attached. Any help would be appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 15:11:01, on 25/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\Gtwatch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Sca... Read more

A:Solved: annoying pop ups &unders

Read other 16 answers
RELEVANCY SCORE 42.4

Hi!

Im having this malware problem with IE popups..
Ive tried a bunch of removal tools with no luck. Can you help me?
Here's th hijackthis log:
Code:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:22:34, on 2008-02-12
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\CTHELPER.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\Explorer.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\OBroker.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Wi... Read more

Read other answers
RELEVANCY SCORE 42.4

I also have them coming on the side. I am afraid i'm going to get RSI trying to get rid of them all the time. I want to do it the safe way however, as I don't want to get rid of one problem and latch on to another.

Also my sticky notes seem to have disappeared and when i try and install new ones there are always problems, is there any solution without the problems?

thanks in advance.

A:How do i get rid of pop unders that keep coming on my comp

Hello RituAnand51 , whew.. long name.. sounds as if you may have malware.. and may not use free addon's , like adblock plus.. check your antivirus.. use free of these two programs.. Malwarebytes. and SuperAntiSpyware . and if clean.. run your SFC program from the tutorial section. If you need links.. I can get them for you..

Read other 6 answers
RELEVANCY SCORE 42

Last night I downloaded a zip file that immediately ran a virus. My Avast! virus program kept finding files in system32 folder. I'd delete them and it would be a never ending supply of them that would be in there. It also did changed my desktop to a type of HTML page where it was a thing saying "Your computer is infected with spyware. Click here to find programs to clean your computer of spyware". All black with red text. (something lik ethat) Here is the log for that:

12/24/2005 11:01:40 PM SYSTEM 808 Sign of "Win32:Trojano-3173 [Trj]" has been found in "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll" file.
12/24/2005 11:01:54 PM SYSTEM 808 Sign of "Win32:Trojano-3173 [Trj]" has been found in "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll" file.
12/24/2005 11:02:33 PM SYSTEM 808 Sign of "Win32:Startpage-145 [Trj]" has been found in "C:\WINDOWS\system32\paytime.exe" file.
12/24/2005 11:02:39 PM SYSTEM 808 Sign of "Win32:Startpage-145 [Trj]" has been found in "C:\WINDOWS\system32\paytime.exe" file.
12/24/2005 11:02:44 PM SYSTEM 808 Sign of "Win32:Startpage-145 [Trj]" has been found in "C:\WINDOWS\system32\paytime.exe" file.
12/24/2005 11:02:54 PM SYSTEM 808 Sign of "Win32:Startpage-145 [Trj]" has been found in "C:\WINDOWS\system32\paytime.exe" file.
12/24/2005 11:02:59 PM SYSTEM 808 Sign... Read more

A:Solved: Tons of pop-ups, pop-unders and desktop ads.

Read other 12 answers
RELEVANCY SCORE 42

Can I please ask for your help?
Over the past 2 weeks my computer has been running incredibly slowly and I was having several pop-unders esp from cellorado and other companies. I got rid of IE as a browser and am now using Firefox, and the popunders have decreased, actually haven't seen any today!. However computer still running really slowly despite running different scans eg adaware etc. I saw that update could have been linked to Spy Doctor which I have since uninstalled, but there could still be traces.
Please find below my Hijack Log, I would be so grateful if anybody could help. I had to just kill the update exe in order to use the PC, otherwise it has this huge noise. But I guess it will come back when I reboot.
HELP PLEASE but many thanks in advance for the job you wonderful people are doing.
Dee

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:43:49, on 16/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENG... Read more

A:Pop unders, Update.exe taking over my machine!!

2nd Message.
I thought as well to post an updated Hijack Log and perhaps someone can tell me what I have missed. Surpried there are still references to IE even though removed.
Here it is and thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:54, on 16/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\WebProxy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsCtrls.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.ex... Read more

Read other 1 answers
RELEVANCY SCORE 42

I'm pretty sure I have some sort of infection going on. While avast keeps blocking connections to some pop-ups (labeling them trojan warnings), I'm still getting 2-3 pop-ups visiting many sites, and will frequently get pop-unders that require dialog box clicks to navigate away from them. The latter are typically the ones from which I get trojan warnings.

I seem to be getting blocked from downloading certain malware removal programs, and if I can download them -- there is an issue updating them (error messages and installation failures).
A lot of the popups seem to be coming from mtn3. I don't know where the pop-unders are coming from. At first it was just a bit of a nuisance, but it is starting to become unbearable.

Scans I have run: avast, avira AntiVir personal, an outdated malwarebytes anti-malware scan, and ad-aware.
these have come up with cookies, but nothing I quarantine or remove appears to make any difference.

Any help with this problem would be greatly appreciated.

Edit:
Some added information.
I'm running Vista on a Dell Laptop.
Also, the ads I get on sites really don't belong there -- as in don't match up with the subject matter of the site, or target demographic. They don't match up with the subject matter I used to get just a few months back.

A:Pop-ups, Pop-unders, and avast trojan warnings

hello and welcome..Some types of malware will disable MBAM (MalwareBytes) and other security tools. If MBAM will not install, try renaming it.Before saving any of your security programs, rename them first. For example, before you save Malwarebytes', rename it to something like MBblah.exe and then click on Save and save it to your desktop. Same thing after you install it. Before running it, rename the main executable file first***Right-click on the mbam-setup.exe file and change the .exe extension to .bat, .com, .pif, or .scr and then double-click on it to run.If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files, right-click on mbam.exe and change the .exe as noted above. Then double-click on it to run..***Another work around is by not using the mouse to install it, Just use the arrow keys, tab, and enter keys.***Open up command prompt, type in following commands: XP >> click the Start menu at the lower-left of your computer's desktop and select "Run". Type cmd into the Run box and click "OK".Vista >> click the Start menu at the lower-left of your computer's desktop and Type cmd in the search box.regsvr32 mbamext.dllregsvr32 ssubtmr6.dll regsvr32 vbalsgrid6.ocxregsvr32 zlib.dll ****If you cannot use the Internet,you will need access to another computer that has a connection.From there save mbam-setup.exe to a flash,usb,jump drive or CD. Now transfer it to the infected machine, the... Read more

Read other 17 answers
RELEVANCY SCORE 42

Hi there, Recently I have been getting internet explorer(v.7) popups and pop-unders and i have 2 different types of blockers. Im running xp pro v.2002 service pack 2. I have tried using multiple spyware software like spyware doctor and spybot, but im am still getting popups like searchstt and reditty, to name a couple. I have also been getting security connection warnings with mcafee for wuaclt.exe and 17pholmes572.exe. Recently I have updated my java runtime to V6 update 4 and that seemed to cut down a little bit of the popups but it did not fix it completely. Please help, I would really apreciate it.

A:Internet Explorer Many Popups/pop-unders

Hi there, Recently I have been getting internet explorer(v.7) popups and pop-unders and i have 2 different types of blockers. Im running xp pro v.2002 service pack 2. I have tried using multiple spyware software like spyware doctor and spybot, but im am still getting popups like searchstt and reditty, to name a couple. I have also been getting security connection warnings with mcafee for wuaclt.exe and 17pholmes572.exe. Recently I have updated my java runtime to V6 update 4 and that seemed to cut down a little bit of the popups but it did not fix it completely. Please help, I would really apreciate it.you have also posted this in the HJT log section http://www.bleepingcomputer.com/forums/t/129520/uncontrollable-ie-popups/

Read other 2 answers
RELEVANCY SCORE 42

HELP HELP HELP!!!

I'm wondering if it's the newfrn.exe and oura.exe that's causing these pop-under ads. In addition to pop-under, I also get ads at the top of my webpages randomly.

I've tried Ad-Aware, Spybot S&D, and Spyware Doctor.

This is my last hope... I have attached the HijackThis log. I don't know if there is something else needed to rid of this.

Also, should I be concern about using my PC to access my bank account, paypal, and such? Am I at risk of exposing my information?

Many thanks ahead of time...
Logfile of HijackThis v1.98.2
Scan saved at 11:57:06 PM, on 12/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\w?nword.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\nv... Read more

A:HELP! Pop-unders and Ads at the top of pages (HijackThis log included)

Hi and welcome to TSG,
You definitely have some infections there so caution with financial transactions is advised.
Download Cleanup from Here

A window will open and choose SAVE, then DESKTOP as the destination.
On your Desktop, click on Cleanup40.exe icon.
Then, click RUN and place a checkmark beside "I Agree"
Then click NEXT followed by START and OK.
A window will appear with many choices, keep all the defaults as set when the Slide Bar to the left is set to Standard Quality.
Click OK
DO NOT RUN IT YET
Download the trial version of Ewido Security Suite here.
Install ewido.
During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch ewido
It will prompt you to update click the OK button and it will go to the main screen
On the left side of the main screen click update
Click on Start and let it update.
DO NOT run a scan yet. You will do that later in safe mode.

Click here for info on how to boot to safe mode if you don't already know how.
Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.
Restart your computer into safe mode now. Perform the following steps in safe mode:
Run Ewido:
Click on scanner
Click Complete System Scan and the scan will begin.
During the scan it will prompt you to clean files, click OK
When the scan is finished, look at the bottom of the screen and click ... Read more

Read other 1 answers
RELEVANCY SCORE 42

Im new to this site and i have a few problems with my pc. While I'm browsing the internet I always get pop unders and I can't get rid of them. I've scanned with Ad aware and spybot search and destroy and cleared all of the found items and no luck with the pop unders. And another thing is that my pc is running like 80 processes and I don't know which ones I need or what to do to speed up the performance of my pc. Can someone please help. Below is my HJT log if it will do you any good! Thanks


 hijackthis.log   12.95KB
  15 downloads

 DDS.txt   16.61KB
  15 downloads

 Attach.txt   9.99KB
  16 downloads

A:Pop unders and slow pc!! About 80 processes running!!

Hello daftevans and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the re... Read more

Read other 34 answers
RELEVANCY SCORE 42

Hello expert malware fighters,
 
My name is Jacob and i am a freelance computer tech. I have run in to something i cannot solve (which is unusual ;)). I am fixing 3 computers on the same network with the same behaviour. Occasional new tabs with questionable websites in Chrome browser running on Windows 7. I have run scans with Combofix, ADWCleaner, Malwarebytes, Avast Internet Security, Hijack This, Trend Micro Anti-threat toolkit, and removed all extensions and reset Chrome settings. Also checked proxy settings etc. The ads are still coming through. Any ideas?
 
Thanks
Jacob

A:After in depth clean still getting pop ups/unders in Chrome

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/545012 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

Read other 8 answers
RELEVANCY SCORE 41.6

I have been getting a large amount of pop ups and pop unders on my computer, probably found by my brother from some dodgy site. They happen all the time, regardless of whether IE is open.

Warning! It is likely that there is a lot of weird stuff on this computer due to my brother!!
There are a wide variety of annoying popups, including this one, from "registry defender":

http://www.registrydefender.com/l/i..._term=partnerid_keyword&kwd=partnerid_keyword
Click to expand...
Before this, the URL of the popup window shifts several times, causing weird refreshing and slowing the computer. One of the URLs it goes through is:
http://angleinteractive.directtrack.com/sw/112/CD92/partnerid_keywordClick to expand...

There are also a lot of random search pop ups that search whatever website I am currently using, and some are powered by Zedo. One of the more common ones is a dialogue box that reads:

Attention! If your computer is struck by spyware, you could suffer data loss, erratic PC behaviour, PC freezes and creahes [sic].
Detect and remove viruses before they damage your computer!
Antivirus 2009 will perform a [sic] 100% FREE and quick scan of your computer for Viruses, Spyware, and Adware.
Do you want to install Antivirus 2009 to scan your computer for malware now? (Recommended)
OK Cancel
Click to expand...

I haven't clicked "OK" for obvious reasons, but clicking "cancel" takes you to:
http://antivirus-computer-scan.com/2009/1/en/_... Read more

A:Evil popups/ unders - vundo related

Read other 13 answers
RELEVANCY SCORE 41.6

Is there a way to block pop-unders in Mozilla suite? I know how to block pop-ups, but it seems like an awful lot of sites lately are using pop-unders.

Mozilla suite is NOT firefox. Don't be confused. Mozilla is the grand-daddy of firefox. I'm not interested in firefox answers.
thanks!
 

A:Blocking pop-unders in Mozilla Suite (not firefox)

Turn off JAVA script in the Browser

No longer supported, Proxomitron The Universal Web Filter might help.
http://www.proxomitron.info/

http://www.geocities.com/u82011729/prox/filter.html
http://www.geocities.com/u82011729/prox/js.html
 

Read other 3 answers
RELEVANCY SCORE 41.6

To the experts:

Spybot keeps finding smitfraud-c.toolbar888
So far I have tried every remedy outlined in this forum and nothing has worked (including running smitfraud fix in safe mode).

I am getting popunders that relate to google searches and clicked on links.

AVG antispyware with latest update does not detect any problems.

PC-Cillin does not detect any problems.

Windows Defender does not detect any problems.

Yet I still get the smitfraud-c.toolbar888 in spybot and the popunders.

I'm on the verge of reformatting and reinstalling.
Any suggestions please?

A:"search Engine" Pop Unders Smitfraud Detected

If your still having problems after following the self-help guides, then please read and follow all instructions in the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". You may have performed some of these steps already. About half way down are instructions for downloading HijackThis and creating a log.When you have done that, post a log in the HijackThis Logs and Analysis Forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. Please include the top portion of the HijackThis log that lists version information. An expert will analyze your log and reply with instructions advising you what to fix.Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the s... Read more

Read other 1 answers
RELEVANCY SCORE 41.6

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 8.1, 64 bit
Processor: HP Hexa-Core 2.0GHz, AMD64 Family 22 Model 48 Stepping 1
Processor Count: 4
RAM: 7103 Mb
Graphics Card: AMD Radeon(TM) R5 Graphics, 1024 Mb
Hard Drives: C: Total - 929221 MB, Free - 847664 MB; D: Total - 23602 MB, Free - 2615 MB; F: Total - 476937 MB, Free - 129234 MB;
Motherboard: Hewlett-Packard, 2266
Antivirus: Bitdefender Antivirus, Updated: Yes, On-Demand Scanner: Enabled

I've run scans with Spybot, MalwareBytes, Bitdefender, and SuperAntiSpyware

I remove stuff, I go into regedit, and yet the darn thing keeps popping up! Mostly the problem seems to be linked to Total Ad Performace et al, so I'm hoping it can easily be smushed, or that I finally got it and maybe something is lingering SOMEWHERE. But... I'm about to pitch a fit. I got this as a late Christmas gift and yeah I stream a lot and everything, but I know my sites and I'd like to think I'm pretty safe...

*huffs*

Help?
 

A:HALP! Total Ad Performace takeover, serious lag, and pop unders

Read other 10 answers
RELEVANCY SCORE 41.6

A few automatic updates ago, Firefox stopped swatting down my pop-unders and I got bombarded with them. They all look like I opened a website in another window, but they're annoying ads. My homepage also keeps opening the main tab as "theprizeday.com" or "hotebar.com", with my actual homepage in a secondary tab. I have an older Toshiba Satellite laptop with Windows XP. If this issue has been solved elsewhere, feel free to link me to that thread and tell me to lurk more. :D Here's my DDS:
DDS (Ver_09-12-01.01) - NTFSx86
Run by Markki at 14:43:49.71 on Wed 12/23/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1246.694 [GMT -7:00]

AV: AVG 7.5.503 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.ex... Read more

A:Firefox Update pop-unders, homepage hijack.

Hello,My name is Syler and I will be helping you to solve your Malware issues. If you have since resolved your issues I would appreciate if youwould let me no so I can close this topic, if you still need help please let me no what issues you are still having, in your next reply.We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up.Download random's system information tool (RSIT) by random/random from here and save it to your desktop.Double click on RSIT.exe to run RSIT.Click Continue at the disclaimer screen.Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)Please download GMER from one of the following locations, and save it to your desktop:Main Mirror
This version will download a randomly named file (Recommended)Zip Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.Disconnect from the Internet and close all running programs, as this process may crash your computer.Temporarily disable any real-time active protection so your security program drivers will not conflict with gmer's driver.Double click on Gmer to run it.Allow the gmer.sys driver to load if asked.You may see a rootkit warning window, If you do, click No.Untick the following boxes on the right side of the Gmer screen.
... Read more

Read other 2 answers
RELEVANCY SCORE 41.2

Hello all.

I'm using a HP Pavilion dv9000 laptop 1.6Ghz dual core, 3Gb RAM running Windows Vista.

1) I use Windows Vista, and for the last few months I have been unable to update it, with the error code 80072EE4 coming back every single time. It hasn't had a new update listed since October. The same happens with other programs like AVG or Spybot. They constantly come back with "error connecting to server" messages.

2) I use Firefox (but have had the same results if I use IE), and find that certain sites (especially Microsoft, but also anti-spyware/viral sites) will be blocked, telling me that 'The connection to the server was reset while the page was loading.' Example: I can load the Microsoft front page, but if I try to go to the update/security pages, those won't connect.

3) Firefox will redirect to other pages if it takes too long to find the page I've clicked on, like something 'jumps in' to take its place. I click on a blog, it takes too long, and suddenly it has been redirected to some other search engine's results for the word 'job'.

4) I get pop-unders for search.gugle.com sometimes when pages are loading, which also bring up random ad sites and nonsene results.

I'd like my PC back please! Running viral or spyware scans bring back nothing, and it's frustrating me.

Thanks

A:Can't update my PC, Sites getting blocked and Gugle pop-unders all the time.

Hello and welcome. lets's start here as I do not know what you ran.Please download TFC by Old Timer and save it to your desktop. alternate download linkSave any unsaved work. TFC will close ALL open programs including your browser! Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator. Click the Start button to begin the cleaning process and let it run uninterrupted to completion. Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.Next run MBAM (MalwareBytes):NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop.Please download Malwarebytes Anti-Malware and save it to your desktop.alternate download link MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.Make sure you are connected to the Internet.Double-click on mbam-setup.exe to install the application.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-MalwareThen click Finish.MBAM will automatically start and you will be asked to update the program be... Read more

Read other 1 answers
RELEVANCY SCORE 41.2

Hey guys,

I have some kind of spyware on my PC that is driving me crazy. Everytime I open IE a pop-under window shows up. They sure are't pop-ups because I havea pop-up blocker installed. Tryed spybot and adaware but nothing helped. With a help of HijackThis I got rid of some strange processes and files but apparently that wasn't it.

These are the pop-unders:

The first is titled AdultFriend finder, but the window is always empty;
The second shows some thumbnails of screensavers and says paid Popup
And sometymes i get Is your computer running slow? message. Of course it's running slow - due to these nasty pop-unders.

Please help me

Sara

----------------

Logfile of HijackThis v1.99.1
Scan saved at 13:31:06, on 30.9.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\WinPortrait\wpctrl.exe
C:\WINDOWS\System32\rundll32.exe
C:\WIND... Read more

A:pop-unders when IE is started / SpybotSD & AdAware aren't helping

Hi stusar and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please be patient with me during this time.

Read other 6 answers
RELEVANCY SCORE 41.2

I'm on Windows 8 x64 Pro and have MalwareBytes and Windows Defender running.
 
In IE10, I noticed I get the "Show All Content" button on every page. When I click it, I noticed shortly after I receive a ad.yieldmanager popup most of the time, sometimes other popups.
I reset internet explorer to default, still same problem.
In Firefox, if I click on the sign-in button on the Google Analytics page, I get a pop up. 
In SalesForce, I click a link and get a random popup in Chrome.
 
So I know these ad popups arent from these reputable sites.
 
Done so far with no success:
I used CCleaner to delete all cookies, temp file, cache of all browsers
Ran full scan with most updated malwarebytes
Ran Full scan with Spybot Search and Destroy
Ran Trend TDDSKiller and didnt find anything
CombFix doesnt work on Windows 8
Ran Scan with Windows Defender
Did a System Restore (Apparently not far back enough)
 
Just wondering what to do next. Thanks for the help on this one!

A:All browsers - Random Pop-Unders/Popup after clicking anywhere - Ad.Yieldmanager

Welcome aboard   Download Security Check from here or here and save it to your Desktop. Double-click SecurityCheck.exe Follow the onscreen instructions inside of the black box. A Notepad document should open automatically called checkup.txt; please post the contents of that document.NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.Make sure the following options are checked:
Internet ServicesWindows FirewallSystem RestoreSecurity Center/Action CenterWindows UpdateWindows DefenderOther ServicesPress "Scan".It will create a log (FSS.txt) in the same directory the tool is run.Please copy and paste the log to your reply. Please download MiniToolBox and run it.Checkmark following boxes:Report IE Proxy SettingsReport FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList last 10 Event Viewer logList Installed ProgramsList Devices (do NOT change any settings here)List Users, Partitions and Memory sizeClick Go and post the result. Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.* Double-click mbam-setup.exe and follow the prompts to install the program.* At the end, be sure a checkmark is placed next to Up... Read more

Read other 7 answers
RELEVANCY SCORE 41.2

I haven't been here for a while but every time I come here I've had my problems solved so I'm back with a weird one and I'm hoping someone can help me out.

My father's computer has worked fantastically for quite a while but recently he's had an issue that seems to be growing.

A couple days ago, he was just surfing around with IE and got an installation window that popped up saying that something named "winfix" was installing. He clicked the X to close it about midway through and everything seemed okay until a little later on in the day when he started seeing pop-unders appear with ads every so often when he was viewing something in IE that were related to whatever he was viewing. For example, if he goes to a .edu address, an education ad appeared.

Having dealt with popups often, I figured it was a good idea to give the computer a thorough cleaning so did all of the following:

- Cleared the cache/cookies/temporary internet files
- Ran Ad-aware (found a few things and deleted them)
- Ran Spybot Search & Destroy (found a few things and deleted them)
- Ran HijackThis (found a few things and deleted them)
- Cleaned up the startups in the System Configuration Utility (Start > Run > msconfig > Startups tab)
- Ran Norton AntiVirus (found one thing and deleted it)
- Ran Microsoft AntiSpyware (found a few things and deleted them)

After all that, he was still having the pop-unders appear and after performing all the scans again, ... Read more

A:Solved: Pop-unders, dead address bar, and scans reveal nothing

Read other 8 answers
RELEVANCY SCORE 40.8

Hello all, I would like to borrow some of your great knowledge to help me combat my computer problem.
I downloaded a couple of spyware programs. They scanned and indicated that I had some bad files.
For a fee, they would correct. I did not have the money so I erased both. One of them left me a nasty
desktop icon that gives me a nastygram banner every 20 seconds. Can someone help me get rid of it???

A:Bad Banners

I suspect to have been infected with rogue antispyware, which in it's self is malware.
Please post what the name of the software is, and the nastygram states word for word. I have no doubt we will be able to help.

Read other 5 answers
RELEVANCY SCORE 40.8

i keep getting millions of popups and have scanned with everything i can find to scan with but they just keep coming back also my comp sometimes will play random music that i cant shut off and its not coming fom any of my media playersplease any help would be greatly appreciatedAd-Aware SE Build 1.06r1Logfile Created on:Wednesday, July 25, 2007 2:15:02 PMCreated with Ad-Aware SE Personal, free for private use.Using definitions file:SE1R182 23.07.2007???????????????????????????????????????????????????References detected during the scan:???????????????????????????????????????MRU List(TAC index:0):15 total referencesTracking Cookie(TAC index:3):14 total references???????????????????????????????????????Ad-Aware SE Settings===========================Set : Search for negligible risk entriesSet : Safe mode (always request confirmation)Set : Scan active processesSet : Scan registrySet : Deep-scan registrySet : Scan my IE Favorites for banned URLsSet : Scan my Hosts fileExtended Ad-Aware SE Settings===========================Set : Unload recognized processes & modules during scanSet : Scan registry for all users instead of current user onlySet : Always try to unload modules before deletionSet : During removal, unload Explorer and IE if necessarySet : Let Windows remove files in use at next rebootSet : Delete quarantined objects after restoringSet : Include basic Ad-Aware settings in log fileSet : Include additional Ad-Aware settings in log fileSet : Include reference summary in lo... Read more

A:Top-banners.com +

Welcome to the BleepingComputer HijackThis Logs and Analysis forum mikeybrainless My name is Richie and i'll be helping you to fix your problems.Please download Combofix and save to your desktop:Note: It is important that it is saved directly to your desktop Close any open browsers. Double click on combofix.exe and follow the prompts. When it's finished it will produce a log. Post the entire contents of C:\ComboFix.txt into your next reply. Note: Do not mouseclick combofix's window while it's running. That may cause the program to freeze/hang. Also post a fresh Hijackthis log please.

Read other 9 answers
RELEVANCY SCORE 40.8

Can someone help in getting rid of ad banners when I am surfing on the net. Thank you.
Much appreciate your help.

A:ad banners

See Seven Forums Rules: Windows 7 Help Forums - Forum Rules






Quote:
13) No ad blocking discussions. This site depends on ads to pay for the costs of running and maintaining it.


Kari

Read other 2 answers
RELEVANCY SCORE 40.8

Ever notice that no matter where you go there are banners and ads everywhere...and I believe that they are at the root cause of malware and spyware development. I'm sik of bannars and ads. The day a mcdonalds add appears below the mound is the day I stop watchin ball. Hockey is already ruined. Well hockeys another issue...its actually a twice baked potatoe now...and I wouldnt watch it if some one paid me. But a few years back at least the Ice was clear of adds...boards to for most part. Look at a hockey rink now...well last years pics...mcdonalds and beer ads all over the ice.

Anyway...can I make my computer block bannars? Can it be done??? When I wuz a college boy I knew a kid that had linux setup so he never got bannars. But can this be done on windows? Thanks. -joe

A:Banners and ads

Two simple steps will help:
- Install Pop-Up-Stopper
- Click into IE Tools/Internet Options/Privacy Tab/Advanced and click on 'Block Third-Party Cookies'

Hope this helps!

Read other 4 answers
RELEVANCY SCORE 40.8

My mother's computer has something on it where she is constantly getting pop-ups. Mostly from top-banner.com. Below is her hijack this log:Logfile of HijackThis v1.97.7Scan saved at 9:55:32 PM, on 12/4/2004Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeC:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\WINDOWS\System32\nvsvc32.exeC:\Program Files\Softex\OmniPass\Omniserv.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Softex\OmniPass\OPXPApp.exeC:\WINDOW... Read more

A:top-banners pop-ups

HiYou have Wild Tangent installed. Wild Tangent collects information about you and your usage. The advertisements may also contain pornographic or other material that you might find inappropriate. You can follow these instructions to uninstall it: No. 8 - Uninstallation .Please print or copy these instructions because you are not able to access the Internet in SafeMode.Make sure you are set to show hidden files and folders: A. On the Tools menu in Windows Explorer, click Folder Options.B. Click the View tab.C. Under Hidden files and folders, click Show hidden files and folders.D. Uncheck Hide extensions for known filetypes and Hide protected operating system files.How to see hidden files in WindowsREBOOT into SafeMode by tapping F8 key repeatedly at bootup: Starting your computer in Safe modeRun HijackThis!, press Scan, and put a check mark next to all these:O2 - BHO: (no name) - {08227B4B-54FE-4C4D-809F-BCA46292FC5B} - C:\WINDOWS\System32\AANTX.dllO4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exeO4 - HKLM\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exeO4 - HKLM\..\Run: [svrrun] C:\WINDOWS\svrrun.exeO4 - HKCU\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exeClose all other windows and browsers, and press the Fix Checked button.Search for these files and delete them if found:C:\WINDOWS\System32\AANTX.dll <-- this fileC:\WINDOWS\Ashlt.exe <-- this fileC:\WINDOWS ... Read more

Read other 3 answers
RELEVANCY SCORE 40.8

I wonder if someone could point me in the right direction.

I dont have the normal ads and banners appear on some sites in vista. I know its a security thing, but I feel like some websites are incomplete.

My example is www.nme.com. If you see the ads on the right hand colum and on the top, well i receive them on my xp machine, but on my vista laptop they are just white blank.

Is there a setting I need to switch on? I dont think I have flash installed either.

A:No Banners / Ads

Go to Adobe link http://www.adobe.com/shockwave/download/do..._getflashplayerAlso in IE under tools go to>internet options>advanced>under multimedia see if show pictures is ticked.

Read other 3 answers
RELEVANCY SCORE 40.8
Q: banners

hi, copied and pasted the link jus like they said but it's not showing up as banner, neone know y?
 

RELEVANCY SCORE 40.8

For some reason i cant se any banners...i think the internet explorer desconfigurate somehow...is there anyway i can configurate it again?

A:Can;t see banners

Download WinsockFix and unzip it. Then double-click on it to run it.

Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Double click on the program to run it.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless.

Read other 1 answers
RELEVANCY SCORE 40.8

I'm running XP Pro and I cannot see the banners in programs like Emailcash. How can I allow Windows to display these banners.
 

Read other answers