Popups locking me up can't cancel them!

[Guest]

This past week when visiting a few websites (one is Yankees.com) our IE6
window is suddenly jerked off to one side and in the center of screen is a
box telling us that Internet Explorer needs us to download some type of
security thing. The last one was something like LivePC. There is a cancel
button on this little box and a download button. Clicking it anywhere gives
you their web page which automatically starts doing something. What it does,
I haven't found out cause by that time we have done the only thing possible
which is to use task mgr and get rid of IE or to restart the computer. I use
popup blocker and I used to use popupcop but IE didn't seem to like it.
Obivously this isn't being recognized as a pop up. Is it adware maybe? I had
software for that but IE kept locking up when I used that too so I haven't
used it in a long time. What can we do?
Thanks.

 

[Jon Kennedy]

This may be caused by spyware/malware that's gotten installed on
your system. Use Ad-Aware, Windows Defender and/or Spybot Search & Destroy
to remove it.

Windows Defender
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Ad-Aware: http://www.lavasoftusa.com/
Spybot: http://www.safer-networking.org/en/index.html
Good sites on how to install and use Spybot -
http://www.safer-networking.org/en/tutorial/index.html
http://tomcoyote.com/SPYBOT/index1.php

Also download a winsock repair tool, to have just in case cleaning up
anything found breaks it -

Winsock repair tools:
LSPFix- all versions of Windows http://www.cexx.org/lspfix.zip
Winsock2 Fix- Win98, ME
http://www.bu.edu/pcsc/internetaccess/winsock2fix.html
LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip

More information here:
http://www.spywareinfo.com/
http://inetexplorer.mvps.org/tshoot.html
http://spywarewarrior.com/sww-help.htm

If no joy, in IE go to Tools...Internet Options...Advanced tab, Browsing
section, uncheck "Enable third-party browser extensions", click Apply, click
Okay, reboot. If that solves your problem, then more troubleshooting is
needed to find out exactly which program, or Browser Helper Object (BHO) is
causing this problem. You don't want to leave it at that, as some BHOs are
useful or necessary - like Adobe Acrobat for reading .pdf files or an
essential component of Norton AV. Get BHODemon -
http://www.definitivesolutions.com/bhodemon.htm - read all about BHOs.
Disable all items, and then gradually replace one or two at a time to narrow
down the culprit.

Or if you have IE 6 SP-2 you can do this within the browser:
How to manage Internet Explorer add-ons in Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?scid=kb;en-us;883256

If all the above fails, then the problem could be something new that the
spyware cleaners above don't have in their databases yet. In that case....
HijackThis direct download:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Tutorial on how to use HijackThis:
http://www.spywareinfo.com/~merijn/htlogtutorial.html
Then post it's output log to the forum here for analysis and feedback by the
parasite experts:
http://forums.spywareinfo.com/
http://aumha.net/viewforum.php?f=30
Or one of the other HijackThis Logs forums listed here:
http://www.spywareinfo.com/~merijn/forums.html

Or try this program to get some of the most nasty malware:
CWShredder direct download:
http://aumha.org/downloads/cwshredder.zip

An alternate resource for all of this and more:
http://www.aumha.org/secure.htm

 

[N. Miller]

This past week when visiting a few websites (one is Yankees.com) our IE6
window is suddenly jerked off to one side and in the center of screen is a
box telling us that Internet Explorer needs us to download some type of
security thing. The last one was something like LivePC. There is a cancel
button on this little box and a download button. Clicking it anywhere gives
you their web page which automatically starts doing something. What it does,
I haven't found out cause by that time we have done the only thing possible
which is to use task mgr and get rid of IE or to restart the computer. I use
popup blocker and I used to use popupcop but IE didn't seem to like it.
Obivously this isn't being recognized as a pop up. Is it adware maybe? I had
software for that but IE kept locking up when I used that too so I haven't
used it in a long time. What can we do?

Using Alt + F4 is faster, and kills the window with the focus. What you are
seeing is a common trick to infect an unsuspecting user. The whole pop-up is
an active button to start the download. Your first action should be to run
an AV check on the computer, and an ad-killer application, as well. Next is
to check your MSIE security settings; in this day and age, a browser should
*not* blindly start a download, or install process without user
intervention. And keep that Alt + F4 trick in mind; as I said, it kills the
window with the focus.

--
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.

 

[Guest]

So far I have not picked up anything from the various applications. I will
let you know when I find it.
Thanks to the person who told me I could use alt-F4

 

[Guest]

Webroot picked up nothing. My Virus Scan (Norman --not Norton it's not a
typeo) didn't pick up anything. WHen I got Windows LiveOneCare it said it
found something and got rid of it but didn't tell me what it found or where
it found it. For two days it was fine, then my husband went to Yankees.com
again and we again had the browser pushed to a small box in the lower right
and a gray box telling us our computer needs something called FixIt. Pressing
alt-F4 sent us to THEIR WEB PAGE. It did not appear anything was downloading
but I shut down the computer as soon as I could. What the.......

 

[N. Miller]

"N. Miller" wrote:

Webroot picked up nothing. My Virus Scan (Norman --not Norton it's not a
typeo) didn't pick up anything. WHen I got Windows LiveOneCare it said it
found something and got rid of it but didn't tell me what it found or where
it found it. For two days it was fine, then my husband went to Yankees.com
again and we again had the browser pushed to a small box in the lower right
and a gray box telling us our computer needs something called FixIt. Pressing
alt-F4 sent us to THEIR WEB PAGE. It did not appear anything was downloading
but I shut down the computer as soon as I could. What the.......

I started by using the Sam Spade safe browser. I use this when I am
uncertain what might be at a web site. I used, 'yankees.com'. I was
redirected to a site in the 'mlb.com' domain; presumably for "Major League
Baseball". The redirect site uses JavaScript, which isn't always a bad
thing, but can be used for bad things. I am not that good at reading the raw
code of a web page, though. But I didn't see anything which looked
dangerous, so next I tried MS Internet Explorer 7.

First thing that happened was a notice of a blocked pop-up. But I see that
you are still using MS Internet Explorer 6. I haven't had MSIE 6 on an XP
computer is some time, so I don't know how it works for blocking pop-ups.

Ordinarily, I would close the notice bar (a yellow bar just below the tabs),
but I decided to see what happens if I allowed the pop-up. Refreshing the
page did not bring a pop-up.

I just can't see anything at that site. So I can't test the Alt+F4 method on
the pop-ups you saw. Must be something along the lines of responding to user
clicks. It is apparently the latest sneaky trick, using the click to launch
the pop-up as it takes you to the linked site.

http://htmlfixit.com/?p=210

That was a result of trying to find something by searching on "fix it". The
search term is too generic to find something specific which matches your
description.

--
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.