I have installed and run Adaware and Spybot and I am still getting
annoying popups pretty much everywhere I go (even on pages that don't
have popups). Obviously, something is installed on my PC that is
causing these but I have no idea what. Anyone have any other
suggestions to try go get rid of these (reinstalling Windows is not
really an option). Someone once suggested toolbarcop.exe but I'm not
exactly sure how to use that.

LVIII

A Search site has downloaded something into your computer.

1. If you have Windows Messenger Service, disable it. The Messenger service
is typically not needed for home users.

Right-click My Computer and click Manage.
Fold out the Services and Applications option and click Services.
Right-click the Messenger entry, select Properties, and choose Disable under
Startup Type.
Click OK.

You should no longer receive messages sent via the messenger service.

2. Use the following scanners to find and remove the website.

SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/
or
CWShredder
http://www.spychecker.com/program/cwshredder.html

3. Some porn websites redirects links to their websites using your HOSTS
file. Do a search for the HOSTS (without extension) file and remove the
entry.

4. If still no joy, download HijackThis from Spywareinfo download page

http://www.spywareinfo.com/downloads.php

Run the program and you will find many entries. Most are OK. Post the log. I
will find the problem for you.

5. For future preventive maintenance, make sure programs cannot just
download on your computer without your permission. From the Internet
Toolbar, go to Tools > Internet Options > Advanced. Make sure "Enable
Install On Demand (Internet Explorer)" and "Enable Install On Demand
(Other)" are unchecked.

--
Warren
For additional help, post in
http://groups.msn.com/HelpforInterne...owsME/homepage

"Lord Vader III" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I have installed and run Adaware and Spybot and I am still getting
> annoying popups pretty much everywhere I go (even on pages that don't
> have popups). Obviously, something is installed on my PC that is
> causing these but I have no idea what. Anyone have any other
> suggestions to try go get rid of these (reinstalling Windows is not
> really an option). Someone once suggested toolbarcop.exe but I'm not
> exactly sure how to use that.
>
> LVIII

war17 wrote:
>
> A Search site has downloaded something into your computer.
>
> 1. If you have Windows Messenger Service, disable it. The Messenger service
> is typically not needed for home users.
>
> Right-click My Computer and click Manage.
> Fold out the Services and Applications option and click Services.
> Right-click the Messenger entry, select Properties, and choose Disable under
> Startup Type.
> Click OK.
>
> You should no longer receive messages sent via the messenger service.
>
> 2. Use the following scanners to find and remove the website.
>
> SpyBot S&D searches your harddisk for so-called spy- or adbots;
> http://security.kolla.de/
> or
> Adaware
> http://www.lavasoftusa.com/software/adaware/
> or
> CWShredder
> http://www.spychecker.com/program/cwshredder.html
>
> 3. Some porn websites redirects links to their websites using your HOSTS
> file. Do a search for the HOSTS (without extension) file and remove the
> entry.
>
> 4. If still no joy, download HijackThis from Spywareinfo download page
>
> http://www.spywareinfo.com/downloads.php
>
> Run the program and you will find many entries. Most are OK. Post the log. I
> will find the problem for you.

Its not messenger service and Spybot and Adaware didn't find anything.
CWShredder is all in Russian so I didn't know what to do. I ran
HijackThis and here is my log:

Logfile of HijackThis v1.97.7
Scan saved at 11:20:58 AM, on 1/22/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\NOVELL\CLIENT32\NWPOPUP.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\D-TOOLS\DAEMON.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SYMANTEC\PCANYWHERE\AWHOST32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\KC9XCR32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
C:\WINDOWS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://yahoo.com/
O2 - BHO: (no name) - {D183A0C1-7B9F-11D7-8333-0050DA6EDAC3} -
C:\WINDOWS\SYSTEM\HGDIRR.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program
Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE"
-atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\NORTON~1\defwatch.exe
O4 - Startup: Shortcut to MODEM.bhf.lnk = C:\WINDOWS\All
Users\Application Data\Symantec\pcAnywhere\MODEM.bhf
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page -
res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {A0777FF1-23AC-11D5-BA9B-00C04F753F09} (BridgeBC24) -
http://channel.bridge.com/bc/java/install.cab
O16 - DPF: {71CA4411-45EC-4608-B9D7-6D4B6A9D1BB4} (Attenza System
Profiler) - http://service.dell.com/dell/SystemProfiler.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX
Control) -
http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {F7DC2A2E-FC34-11D3-B1D9-00A0C99B41BB} (Zoom Class) -
http://www.zoomify.com/download/zoomify214.cab
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) -
http://support.gateway.com/support/s...vest/gwCID.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio
Conferencing) -
http://us.chat1.yimg.com/us.yimg.com...43/yacscom.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.co...804.2026273148
O16 - DPF: {0DD4833D-DFFA-11D3-94D7-0050DAC353B6} (DndCtrl Class) -
http://www.ofoto.com/OfotoDND.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software
XUpload) - http://www.walmartphotocenter.com/ph...ad/XUpload.ocx
O16 - DPF: Yahoo! Towers 2.0 -
http://download.games.yahoo.com/game...s/y/ywt0_x.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products
Installer Start) -
http://imgfarm.com/images/nocache/fu...tup1.0.0.5.cab
O16 - DPF: Yahoo! Pool 2 -
http://download.games.yahoo.com/game...s/y/potc_x.cab
O16 - DPF: Yahoo! NFL GameChannel StatTracker -
http://aud14.sports.yahoo.com/java/y/nflgcst1008_x.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object)
- http://antu.popcap.com/games/popcaploader_v5.cab

Thanks.

LVIII

I'm having exactly the same problem..
I did reinstall a new copy of winXp pro and still in pop
up hell..
when I use Norton Firewall ad trashcan repeatedly for
these ads IE 6 just crashes and stalls..
All the pop ups start with www.vgfe.com then redirect
somewhere..
>

A Search site has downloaded something into your computer.

1. If you have Windows Messenger Service, disable it. The Messenger service
is typically not needed for home users.

Right-click My Computer and click Manage.
Fold out the Services and Applications option and click Services.
Right-click the Messenger entry, select Properties, and choose Disable under
Startup Type.
Click OK.

You should no longer receive messages sent via the messenger service.

2. Use the following scanners to find and remove the website.

SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/
or
CWShredder
http://www.spychecker.com/program/cwshredder.html

3. Some porn websites redirects links to their websites using your HOSTS
file. Do a search for the HOSTS (without extension) file and remove the
entry.

4. If still no joy, download HijackThis from Spywareinfo download page

http://www.spywareinfo.com/downloads.php

Run the program and you will find many entries. Most are OK. Post the log. I
will find the problem for you.

5. For future preventive maintenance, make sure programs cannot just
download on your computer without your permission. From the Internet
Toolbar, go to Tools > Internet Options > Advanced. Make sure "Enable
Install On Demand (Internet Explorer)" and "Enable Install On Demand
(Other)" are unchecked.

--
Warren
For additional help, post in
http://groups.msn.com/HelpforInterne...owsME/homepage

<(E-Mail Removed)> wrote in message
news:2ae701c3e11c$9ee30d80$(E-Mail Removed)...
>
> I'm having exactly the same problem..
> I did reinstall a new copy of winXp pro and still in pop
> up hell..
> when I use Norton Firewall ad trashcan repeatedly for
> these ads IE 6 just crashes and stalls..
> All the pop ups start with www.vgfe.com then redirect
> somewhere..
> >

If you do not used the an international keyboard, check this out.
You have internat.exe running.
http://www.symantec.com/avcenter/ven...r.pointex.html
--

We do not have the expertise you will find on the forum. Suggest you post
your log it as suggested.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo....hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

--------

See this interesting site.
How To: Deal with Unwanted Pop-ups
http://www.mvps.org/winhelp2002/nopopups.htm


Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm


"Lord Vader III" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> war17 wrote:
> >
> > A Search site has downloaded something into your computer.
> >
> > 1. If you have Windows Messenger Service, disable it. The Messenger
service
> > is typically not needed for home users.
> >
> > Right-click My Computer and click Manage.
> > Fold out the Services and Applications option and click Services.
> > Right-click the Messenger entry, select Properties, and choose Disable
under
> > Startup Type.
> > Click OK.
> >
> > You should no longer receive messages sent via the messenger service.
> >
> > 2. Use the following scanners to find and remove the website.
> >
> > SpyBot S&D searches your harddisk for so-called spy- or adbots;
> > http://security.kolla.de/
> > or
> > Adaware
> > http://www.lavasoftusa.com/software/adaware/
> > or
> > CWShredder
> > http://www.spychecker.com/program/cwshredder.html
> >
> > 3. Some porn websites redirects links to their websites using your HOSTS
> > file. Do a search for the HOSTS (without extension) file and remove the
> > entry.
> >
> > 4. If still no joy, download HijackThis from Spywareinfo download page
> >
> > http://www.spywareinfo.com/downloads.php
> >
> > Run the program and you will find many entries. Most are OK. Post the
log. I
> > will find the problem for you.
>
> Its not messenger service and Spybot and Adaware didn't find anything.
> CWShredder is all in Russian so I didn't know what to do. I ran
> HijackThis and here is my log:
>
> Logfile of HijackThis v1.97.7
> Scan saved at 11:20:58 AM, on 1/22/04
> Platform: Windows 98 SE (Win9x 4.10.2222A)
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
>
> Running processes:
> C:\WINDOWS\SYSTEM\KERNEL32.DLL
> C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> C:\WINDOWS\SYSTEM\SPOOL32.EXE
> C:\WINDOWS\SYSTEM\MPREXE.EXE
> C:\NOVELL\CLIENT32\NWPOPUP.EXE
> C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
> C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
> C:\WINDOWS\SYSTEM\mmtask.tsk
> C:\WINDOWS\EXPLORER.EXE
> C:\WINDOWS\SYSTEM\RPCSS.EXE
> C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> C:\PROGRAM FILES\D-TOOLS\DAEMON.EXE
> C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
> C:\WINDOWS\SYSTEM\DDHELP.EXE
> C:\PROGRAM FILES\SYMANTEC\PCANYWHERE\AWHOST32.EXE
> C:\WINDOWS\SYSTEM\TAPISRV.EXE
> C:\WINDOWS\SYSTEM\WMIEXE.EXE
> C:\WINDOWS\SYSTEM\INTERNAT.EXE
> C:\WINDOWS\SYSTEM\KC9XCR32.EXE
> C:\WINDOWS\SYSTEM\PSTORES.EXE
> C:\WINDOWS\SYSTEM\MDM.EXE
> C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
> C:\WINDOWS\HIJACKTHIS.EXE
>
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://yahoo.com/
> O2 - BHO: (no name) - {D183A0C1-7B9F-11D7-8333-0050DA6EDAC3} -
> C:\WINDOWS\SYSTEM\HGDIRR.DLL
> O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
> c:\program files\google\googletoolbar1.dll
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
> C:\WINDOWS\SYSTEM\MSDXM.OCX
> O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
> c:\program files\google\googletoolbar1.dll
> O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
> O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
> O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program
> Files\D-Tools\daemon.exe" -lang 1033
> O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~1\vptray.exe
> O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
> Files\Real\Update_OB\evntsvc.exe -osboot
> O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE"
> -atboottime
> O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
> C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
> O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
> O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~1\rtvscn95.exe
> O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\NORTON~1\defwatch.exe
> O4 - Startup: Shortcut to MODEM.bhf.lnk = C:\WINDOWS\All
> Users\Application Data\Symantec\pcAnywhere\MODEM.bhf
> O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
> FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
> O8 - Extra context menu item: Cac&hed Snapshot of Page -
> res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
> O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM
> FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
> O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM
> FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
> O8 - Extra context menu item: Translate into English - res://C:\PROGRAM
> FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
> O9 - Extra button: AIM (HKLM)
> O9 - Extra button: Real.com (HKLM)
> O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
> Object) -
> http://download.macromedia.com/pub/s...sh/swflash.cab
> O16 - DPF: {A0777FF1-23AC-11D5-BA9B-00C04F753F09} (BridgeBC24) -
> http://channel.bridge.com/bc/java/install.cab
> O16 - DPF: {71CA4411-45EC-4608-B9D7-6D4B6A9D1BB4} (Attenza System
> Profiler) - http://service.dell.com/dell/SystemProfiler.cab
> O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX
> Control) -
> http://download.macromedia.com/pub/s...irector/sw.cab
> O16 - DPF: {F7DC2A2E-FC34-11D3-B1D9-00A0C99B41BB} (Zoom Class) -
> http://www.zoomify.com/download/zoomify214.cab
> O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) -
> http://support.gateway.com/support/s...vest/gwCID.CAB
> O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio
> Conferencing) -
> http://us.chat1.yimg.com/us.yimg.com...43/yacscom.cab
> O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
>
http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
> O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
>
http://v4.windowsupdate.microsoft.co...804.2026273148
> O16 - DPF: {0DD4833D-DFFA-11D3-94D7-0050DAC353B6} (DndCtrl Class) -
> http://www.ofoto.com/OfotoDND.cab
> O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software
> XUpload) - http://www.walmartphotocenter.com/ph...ad/XUpload.ocx
> O16 - DPF: Yahoo! Towers 2.0 -
> http://download.games.yahoo.com/game...s/y/ywt0_x.cab
> O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products
> Installer Start) -
>
http://imgfarm.com/images/nocache/fu...tup1.0.0.5.cab
> O16 - DPF: Yahoo! Pool 2 -
> http://download.games.yahoo.com/game...s/y/potc_x.cab
> O16 - DPF: Yahoo! NFL GameChannel StatTracker -
> http://aud14.sports.yahoo.com/java/y/nflgcst1008_x.cab
> O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object)
> - http://antu.popcap.com/games/popcaploader_v5.cab
>
> Thanks.
>
> LVIII