Slow Browsing and many Popups

[W T Allen]

My XP Pro (all latest patches, cleared by Spybot S&D, Adaware 6, and Norton)
seems to be browsing extremely slow lately (last 2-3 days) and I've been
getting popup ads where I don't believe I should be (places like Google and
Bank One)

I don't see anything fishy in my running processes, and scans by the above
mentioned applications gave me a clean bill of health. AdAware found Gator
the other day, but removed it and the problem persists.

Is there something going around that gives these symptoms that I'm missing?
I even ran a Sasser detection and removal app just in case, it found
nothing.

Process list:


Idle
System
smss
CSRSS
winlogon
SERVICES
lsass
SVCHOST
SVCHOST
SVCHOST
SVCHOST
SPOOLSV
ati2evxx
gearsec
FormatM
NAVAPSVC
snmp
SVCHOST
explorer
atiptaxx
pctspk
SynTPLpr
SynTPEnh
DadApp
NAVAPW32
Directcd
NclConf
DataLayer
NclTray
siService
iTunesHelpe
ServiceLaye
siSpamFilte
acrotray
iPodService
pow
HOTSYNC
ListProAlar
OUTLOOK
siMain
iexplore
MSIMN

 

[Sadie]

For starters,don't ever be tempted to click on a link in
messenger spam-or any pop-up that harrasses you when
you're in your mail account.

There is something of a divide in opinion here over
disabling the messenger service-this will put a stop to
so-called "messenger spam",but some camps argue that it
serves as a warning that your security is slack...in
other words,disabling it removes a useful alert system.

Javacool's Spyware Blaster is excellent at "killing" any
pop-up generating active x that might be lurking in the
registry,in addition to affording protection against
2,000 or so net nasties.

There are free pop-up blockers aplenty out
there.Panicware offers a very effective one.Ditto
firewalls-if you would rather have a more hands-
on,configurable alternative to XP's inbuilt.Check out
Sygate,Tiny,Kerio,Zone Alarm.

This very morning,Shenan posted an excellent reference
guide,listing the URLs of all the applicable
sites.Indeed,many others have listed the URLs for Spybot
Search and Destroy,Ad Aware,et al.

-----Original Message-----
I am having almost exactly the same problem with XP

Pro. I've done all the same things you have to try to
get rid of the pop-ups, such as Norton Anti Virus,
Spybot, and even Lavasoft Adware cleanups. I've
downloaded the Sasser fix but it turned out that wasn't a
problem. And strangely enough, the popup I'm getting is
a yellow box that says "Alert! Spyware Activity Detected
on your Computer. Click here to find out how to
remove..."

Mostly I get this when I'm navigating in my Yahoo

Email. Any new message I click on or new window, the
yellow box pops up.

In addition, I'm getting Runtime Error dialog boxes

popping up, asking me to debug the problem. If I say
Yes, it launches a "Just In Time Debugging" window, which
then tells me it can't fix the problem. I don't know
what else to do.

 

[W T Allen]

My problem isn't "Messenger Spam." It's not that kind of popup. It's a
plain old IE popup window, except it's popping up in front of sites that
don't have popup ads: Internal company web site, Google, Bank One, etc.

A popup blocker isn't the solution because these aren't popups that should
be there in the first place, it's indicative of something else going wrong.
If someone can cause popups to show up on my computer, than they can likely
cause something worse and I'd like to figure out how it's happening and how
to fix it.

 

[Stro]

I am also experiencing slow PC performance (very jerky
streaming video on a XP Home, 512 MB RAM, 2.17 GHz PC)and
I'm getting the exact same pop-up "Alert" window as
Reez1972. Norton Anti-Virus 2004 found two adware files
on my PC (Dc1.dll and Imgcboa.dll, both Adware:Main.Search)
which I suspect is causing the problem. NAV cannot delete
either one. And when I use Search in Windows Explorer I
cannot find them even though I clicked on the search for
hidden files/folders option in the advanced search options
settings.

I'd love to hear from someone who has had this problem and
resolved it, too.

-----Original Message-----
I am having almost exactly the same problem with XP Pro.

I've done all the same things you have to try to get rid
of the pop-ups, such as Norton Anti Virus, Spybot, and
even Lavasoft Adware cleanups. I've downloaded the Sasser
fix but it turned out that wasn't a problem. And
strangely enough, the popup I'm getting is a yellow box
that says "Alert! Spyware Activity Detected on your
Computer. Click here to find out how to remove..."

Mostly I get this when I'm navigating in my Yahoo Email.

Any new message I click on or new window, the yellow box
pops up.

In addition, I'm getting Runtime Error dialog boxes

popping up, asking me to debug the problem. If I say Yes,
it launches a "Just In Time Debugging" window, which then
tells me it can't fix the problem. I don't know what else
to do.

 

[Sadie]

O.K.,Sorry,I was just incorporating an answer to a
subsequent posting.Clearly,you know eactly what you're
talking about,and probably run Javacools Spyware Blaster
already,so,perhaps it isn't active x related.
It could be an ad generating trojan such as Dyfuka,or
equivalent.If your latest A.V definitions are not picking
up anything,and neither is your dedicated trojan-scanning
software,then it is hard to advise.
I certainly did not mean any offence-a lot of people post
here,and not all are advanced users,so I try to keep it
simple,before suggesting more daunting alternatives.

 

[Sadie]

Stro,try posting a HijackThis! log on http://cexx.org
The guys there will walk you through deleting all the
tricky componants.
Good Luck

 

[W T Allen]

No offense, taken. Sorry if my message seemed to indicate that it was.

it is hard to advise

You're telling me!

I deleted a few ActiveX controls per someone else's advice in this thread
and it seems like it may be working. I;m at a loss as to why
Norton/Spybot/Adaware wouldn't find these, though.

Thanks for the help.

 

[W T Allen]

I spoke too soon, still doing it despite deleting every ActiveX object I
couldn't confirm was legit (either from MS or Autodesk)

 

[Sadie]

O.K,mate,you'll want to get this sorted asap,so,I'd
suggest you post a Hijackthis log on http://cexx.org
Let them have a proper look at all the running processes
etc.
Hope it works out alright,
Sadie