Endless unwanted pop ups. Anti-spy programs don't recognize.

[Guest]

Every morning I get unwanted pop ups from "clickwwwsearch.com"
"bestsearchnet.com", "breastgain.com", and one that tries to scan (install
itself) on my computer. Ad-aware and Microsoft anti-spy do not detect these
sites. What can I do to stop these from happening. I can't block the sites
from my browser. Please tell me where to start.

 

[Guest]

Hey Will

Just Noticed you had already had tried Ad-Aware SE before posting, Sorry I
overlooked that part, Go with Ewido, Ccleaner and Panda Activescan and let us
know if you need more help, There's alot of options once we know whats on
your system

Andy

 

[Guest]

Are you running XP?

If so, SP2 has pop-up blocking capabilities. Use this feature, as MSAS was
never designed to block pop-ups, which are NOT related to spyware since they
are HTML tags to call up a new (slave) window.

Alan

 

[Guest]

I did everything suggested (correctly, i hope). Unfortunately I still
encountered unwanted pop up windows from one of the sites. These problems
usually occur in the morning when I first get on the computer. I'll let you
know if anything "pops up" in the morning.

 

[Frank Saunders, MS-MVP OE]

I did everything suggested (correctly, i hope). Unfortunately I still
encountered unwanted pop up windows from one of the sites. These
problems usually occur in the morning when I first get on the
computer. I'll let you know if anything "pops up" in the morning.

run HijackThis; http://aumha.org/downloads/hijackthis.zip
HijackThis - Tutorial & FAQ;
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Register here: http://aumha.net/profile.php?mode=register
Once you have received your registration confirmation, post your HJT
log here: *(for expert analysis)*
http://aumha.net/viewforum.php?f=30

HijackThis tutorial:
http://aumha.org/a/hjttutor.htm

 

[Guest]

Hey Will

Did any scanner find any problems ? If these pop-ups come when you are using
a specific site they could be genuine and written into the pages you are
viewing but if they just appear no matter what site you are on or appear when
you don't have any IE browser windows open then it would mean you have some
form of malware on your system, Some malware can write thier URL addresses
into the Pop-up blockers allowed list to prevent you being able to block
them,

If these pop ups continue, Download Hijack This

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Save to C:\drive, Extract and run hijack this, Choose to run a system scan
and save the log, when its finished scanning it will open the results in
notepad, you can then post that back or post it at one of these sites and
receive more help in removing the problems as Hijack This should make it alot
clearer.

( Note most of what Hijack This lists is harmless or even essential to your
system so dont fix anything using Hijack This at this stage )

http://forum.aumha.org/viewforum.php?f=30
http://forums.spywareinfo.com/
http://www.geekstogo.com/forum/
http://forums.tomcoyote.org/
http://spywarewarrior.com/index.php
http://forums.maddoktor2.com/index.php

All The Best

Andy

 

[Guest]

The problem seems to be getting worse (more different pop ups on sites that
don't have them usually) and winfixer and clickwwwsearch are still
trying/succeeding at doing there thing. I'm not getting any response from
some of the forums you listed for me. Should I start fresh on all the scans?
Are there any other routes I can take to help eliminate this problem?

Thanks for the help so far.

 

[Guest]

Hi Will

With you having some infection on your system its hard to comment without
seeing a hijack this log as that will show what you have been infected with,
The use of Hijack This isnt appreciated on here as MVP's have made that very
clear in thier posts but in my opinion it makes things alot easier as you can
see the problems and then give a easy solution based on the log results,

With us not being able to use it on these groups it means we can only give
very basic advise to people as tools like Hijack This should be the first
step when antispy programs are failing, all we are able to say on here is 1.
Try Safe Mode 2. Try Another Remover or 3. Try Another Site

With the Hijack This sites I gave links for you will get a response on them
but you may have to wait a day or two as some get swamped with requests for
help, Once they see the log its then very easy to help you get the system
clean but at this stage its difficult to give any advise as we don't know
what is on your system, I still think it may be Trojan Vundo or Look2me but
without seeing a log its impossible to be sure.

If you don't get a response on the Hijack This sites and need any help send
me the log in an email to (e-mail address removed) and I will get back to
you after checking the log and let you know whats causing the problems.

Regards

Andy

 

[Guest]

Thanks for the help. I'll run everything as you advised two days ago and
send you a log if I don't get any replies in a couple of days.

 

[Guest]

Thanks for the log Will,

I'm sorry to hear you still havent had a reply on the Hijack This sites,
Your log is very clear and the problem is obvious so I cannot see why they
are not helping you out with this especially if you had posted it to more
than one forum, Its Trojan Vundo so Ive sent a detailed fix back to you via
email and included all the optional fixes about having two versions of
messenger starting up plus quicktime and realplayer and gave instructions on
creating a new restore and removing the old points once you get clean, You
should let the forums know you have received help once your happy its
resolved so other people do not review the log and spend time getting fixes
together or researching entries,

Im sure my reply will keep you busy for a couple of hours but let me know if
you have any problems

Regards Andy