Popup Ads

[MAK]

I am running Windows 2000 SP 4, with IE version 6.0 and I'm having a
lot of problems with pop-up ads and unsolicited invitations to install
software on my PC. They are not being spawned by a browser window I
already have open. They happen even if I have no browser or any other
program open at all, including MSN Messenger. All I have to be is
on-line. I'm getting a lot of them at one time. Something is also
periodically changing the browser homepage as well. Whatever it is
also spans user accounts. I found some suspicious software and
removed it. I am running McAfee VirusScan version 7.0.0, virus def
4290, scan engine 4.2.60, which found a trojan-type virus but the
McAfee report said it deleted the virus.



When I re-ran McAfee with "find potentially unwanted programs"
selected, it did find program called SpyBlast.exe, which I uninstalled
and and made sure that the executable was deleted. However, the
popups, which are becoming extremely annoying, continue to appear.



The Windows messenger service is disabled. I have uninstalled all of
the java programs that can be uninstalled (one java program will not
uninstall. I get errors when I try). I attempted to uninstall and
reinstall IE, but was unable to do so. I did, however, apply the
latest IE patch that I could find available. I applied all of the
latest patches available via windowsupdate.microsoft.com.



This problem has been evident for about a week or so, so it appears
that the PC was somehow infected/hacked/otherwise subverted around
that time. Not sure if this is a virus or something else. Any
suggestions? How can I get rid of this?



Thanks,



MAK

 

[Bill]

I just downloaded a free trial of Zone Alarm Pro, and it blocks 100% of all
the pop up ads.

In the 2 days I have tried it, not 1 pop up has appeared. It even tells me
how many it blocks, if like getting those little messages every time.

 

[David]

As far as the popups, if your homepage is being hijacked you have some kind
of spyware installed. Try adaware or spybot search and destroy and see what
they find. You do have some other issues you need to address as well. It
looks like you contracted the blaster worm. This is unrelated to your
initial query however shows that you need to do a couple of things. Get your
machine up to date as far as patches go, and get a firewall.

 

[W.S. Blevins]

I am running Windows 2000 SP 4, with IE version 6.0 and I'm having a
lot of problems with pop-up ads and unsolicited invitations to install
software on my PC. They are not being spawned by a browser window I
already have open.

Go to http://www.grc.com and check out the freeeware product called
"Shoot The Messenger". It explains it and stops it.

 

[MAK]

Go to http://www.grc.com and check out the freeeware product called
"Shoot The Messenger". It explains it and stops it.

Thanks for the response. The web page appears to be telling me to
disable the Windows messenger service. That service was and still is,
disabled.

 

[W.S. Blevins]

Thanks for the response. The web page appears to be telling me to
disable the Windows messenger service. That service was and still is,
disabled.

Then my guess is Spyware/Adware. Email me and I'll send you something
to cure it.

 

[jeroen]

I am running Windows 2000 SP 4, with IE version 6.0 and I'm having a
lot of problems with pop-up ads and unsolicited invitations to install
software on my PC. They are not being spawned by a browser window I
already have open. They happen even if I have no browser or any other
program open at all, including MSN Messenger. All I have to be is
on-line. I'm getting a lot of them at one time. Something is also
periodically changing the browser homepage as well. Whatever it is
also spans user accounts. I found some suspicious software and
removed it. I am running McAfee VirusScan version 7.0.0, virus def
4290, scan engine 4.2.60, which found a trojan-type virus but the
McAfee report said it deleted the virus.

MCafee is quite capable when it comes to handling virii. Browser
Hijackers, spyware and other net vermin are best left to the
specialists.

Download spybot, run a full scan with that. After that supplement your
mcafee with some sort of personal firewall.

 

[Bigfred]

http://www.auburn.edu/oit/security/messengerService.html


http://8help.ohio-state.edu/913.html


http://toolbar.google.com/

hope this of some help.

 

[Stuart Gray]

Thanks for the response. The web page appears to be telling me to
disable the Windows messenger service. That service was and still is,
disabled.

Sounds to me like spyware. Download and run both Ad Aware and spybot. Ad
Aware detects things that spybot doesn't and vice versa.This will get rid of
your problem

Stuart.

 

[discogail]

First please get Spybot S&D

Short tutorial and download link here:
http://tomcoyote.org/SPYBOT/

Fix everything SpybotSD labels in RED.

Then after reboot:
Download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log, load it in Notepad, and copy its contents Most of
what it lists will be harmless or even essential, don't fix anything yet.

and come on over to SpywareInfo: http://www.spywareinfo.com/forums/
You may post as a "guest" if you wish. Scroll down & click the "
Spyware and Hijackware Removal Support" category...then "New Topic"
".....& explain your problem....Paste the log into your post.....
& we'll nail the hijacker .

 

[Danny]

I was having the same problem and it was driving me crazy. I then got
a tip from a newsletter (Kim Kommando) that I subscribe to and it did
the trick. The problem was not with MSN Messenger. This solution was
for XP and I've never used Win 2000 so I don't know if it is similar.

Here is the tip as I received it:

"Q. I get pop-up advertisements even when I’m not connected to the
Internet. How can this be?

A. Windows XP includes a service called Messenger. It is an obscure
utility used by system administrators who run networks. For instance,
if an administrator needs to take a network down, he or she can warn
others on the network via this service.

Messenger service should not be confused with Windows Messenger, the
instant-messaging application in XP. They are not related, and
disabling Windows Messenger will have no effect on your spam problem.
Nor is Messenger service related to MSN Messenger, another
instant-messaging application.

Several software companies have found a way to access Messenger
service from the Internet. If you do not have a firewall, they can
shoot spam into your computer. It will appear as pop-ups, with the
window heading “Messenger Service.”

To block the pop-ups, install a firewall, such as ZoneAlarm or
Outpost. You can link to those programs from my best shareware
section. They will hide the port that spammers use to access your
computer. Windows XP includes a firewall, but it is much lower quality
than ZoneAlarm or Outpost. I don’t recommend it. But it will work in
this case.

You can also disable Messenger service. To do that, click
Start>>Control Panel. Double-click Administrative Tools. Double-click
Services. Scroll down to Messenger and double-click. Click the Stop
button. Under Startup Type, select Disabled. Click Apply>>OK.

There is an outside chance you will need Messenger service. For
example, some anti-virus programs use it to send messages to the user.
So long as you have a firewall, you should be protected, even if
Messenger service is enabled. "


I disabled the Messenger service and even though I use McAfee's like
you it does not affect it at all.

Hope this helps

Danny

I am running Windows 2000 SP 4, with IE version 6.0 and I'm having a
lot of problems with pop-up ads and unsolicited invitations to install
software on my PC. They are not being spawned by a browser window I
already have open. They happen even if I have no browser or any other
program open at all, including MSN Messenger. All I have to be is
on-line. I'm getting a lot of them at one time. Something is also
periodically changing the browser homepage as well. Whatever it is
also spans user accounts. I found some suspicious software and
removed it. I am running McAfee VirusScan version 7.0.0, virus def
4290, scan engine 4.2.60, which found a trojan-type virus but the
McAfee report said it deleted the virus.



When I re-ran McAfee with "find potentially unwanted programs"
selected, it did find program called SpyBlast.exe, which I uninstalled
and and made sure that the executable was deleted. However, the
popups, which are becoming extremely annoying, continue to appear.



The Windows messenger service is disabled. I have uninstalled all of
the java programs that can be uninstalled (one java program will not
uninstall. I get errors when I try). I attempted to uninstall and
reinstall IE, but was unable to do so. I did, however, apply the
latest IE patch that I could find available. I applied all of the
latest patches available via windowsupdate.microsoft.com.



This problem has been evident for about a week or so, so it appears
that the PC was somehow infected/hacked/otherwise subverted around
that time. Not sure if this is a virus or something else. Any
suggestions? How can I get rid of this?



Thanks,



MAK

Danny

 

[W.S.Blevins]

I disabled the Messenger service and even though I use McAfee's like
you it does not affect it at all.

Did you scan using a spyware/adware detector?

 

[Danny]

Yes...used AdAware. Once I disabled the messenger service as described
in the tip I posted the pop-ups disappeared

Did you scan using a spyware/adware detector?

Danny

 

[Guest]

I have MS ISA Server installed and this problem started after I had
installed it. Is there a particular port or protocol I should block to stop
this? TIA.

 

[Lucas Zieland]

I recomend you getting ad-aware: simply because it removes spyware. this
would be the best option unless you go to sites with automatic popup adds...
if this is the case get yourself a popu blocker, a good one to use is the
google toolbar: google.com, duh.

 

[d c]

I recomend you getting ad-aware: simply because it removes spyware. this
would be the best option unless you go to sites with automatic popup adds...
if this is the case get yourself a popu blocker, a good one to use is the
google toolbar: google.com, duh.

I would use the google bar popup blocking in combination with another popup
blocker... such as panicware's tool (free or pro version). In my
experience, both of the above can miss some popups alone... but in
combination the two are more effective.

 

[taff]

I would use the google bar popup blocking in combination with another popup
blocker... such as panicware's tool (free or pro version). In my
experience, both of the above can miss some popups alone... but in
combination the two are more effective.

That may stop the effects, but Do you have a decent firewall running.
It is possible that someone is hacking in through a trojan of some
sort. I run Adaware 6 and Spybot and find that spybot catches things
that Adaware misses completely. Both are free.

Taff....




www.sounds-pa.com | www.thecomputerworkshop.com

 

[David Tosi]

I would use the google bar popup blocking in combination with another popup
blocker... such as panicware's tool (free or pro version). In my
experience, both of the above can miss some popups alone... but in
combination the two are more effective.

I've had good luck with ToolbarX. It's free, does multiple web sites
searches, and blocks both popups and annoying animations. The web site
is www.toolbarx.com.

Good luck!
-David Tosi