IE6 pop-up blocker, security issue?

[Al]

lop.com, prosearching.com and www.prosearching.com keep
inserting themselves into the "Allowed Sites" window of
pop-up blocker in IE6. I (on advice on this forum)
deleted all files containing any reference to AOL
including files in the registry. I have deleted all files
that include the name prosearching or lop including
registry. But no matter what I do they keep coming back
up in the "Allowed Sites" window of the pop-up blocker. I
am beginning to believe this is a security issue with
IE6. If not how else would these sites keep inserting
themselves into the pop-up blocker. Does anyone know how
to correct this? Thanks Al

 

[Thomas Storm]

lop.com, prosearching.com and www.prosearching.com keep
inserting themselves into the "Allowed Sites" window of
pop-up blocker in IE6. I (on advice on this forum)
deleted all files containing any reference to AOL
including files in the registry. I have deleted all files
that include the name prosearching or lop including
registry. But no matter what I do they keep coming back
up in the "Allowed Sites" window of the pop-up blocker. I
am beginning to believe this is a security issue with
IE6. If not how else would these sites keep inserting
themselves into the pop-up blocker. Does anyone know how
to correct this? Thanks Al

First, there is no "pop-up blocker" included with Microsoft's official
version of IE6. I think you may be talking about the Security/Privacy
Settings options panels. The allowed and restricted sites on that list are
simply stored in a local DLL file which IE6 loads each time you launch a new
browser window. Malware has the ability to insert code into unrelated web
pages and create new text files (including your DLL file site lists). I
suggest you use some malware-scanning software to remove such programmes
from your HDD.

 

[Guest]

Thanks for responding Tom. I should have stated in my
initial post that I am using IE6 w/ xpsp2 which does have
a pop-up blocker included IE6. Since not very many people
are using xpsp2 yet I gyess I need to know how to tell
microsoft about this issue. With IE6 sp2 click on tools >
pop-up blocker > turn off pop-up blocker or pop-up
blocker settings. Under settings is a window that permits
you to enter sites that you wish to allow pop-ups. It is
this window that lop.com, porsearching.com and
www.prosearching.com keep inserting themselves. Al

 

[billy]

have you tried spybot to search for spyware?
safer-networking.org
and update before scan

 

[PA Bear]

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow all Removal steps.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then Disk Cleanup > More options > Delete all but the most
recent Restore Point.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Are You Ready for WinXP SP2?
http://www.microsoft.com/athome/security/protect/default.aspx

WinXP SP2 Release Notes
http://support.microsoft.com/default.aspx?scid=kb;en-us;835935

AumHa Forums
http://forum.aumha.org