The pop-ups that WOULD NOT DIE!

G

Guest

Running WinXP Home Edition over DSL network. Have Panicware Pop-Up Stopper,
Ad-Aware SE, Spybot, SpySubtract and CWShredder. Firewall up and running.
Explorer set to block all pop-ups. I have browsed all past threads here
regarding pop-up problems, and have followed advice of most everyone. I ran
Ad-Aware 3x in a row (after I had disconnected cable) and was getting pop-ups
while it was running! Each time I ran program there was additional "critical
objects" listed that needed to be deleted.

I still have persistent pop-ups that just won't go away, particularly from
Aurora-Part of the ABI Network (home of the famous PartyPoker.com), and
others such as US Immigration wanting to know if I need a Green Card (I
don't).

I did not have this problem before I had to reinstall WinXP and all
associated programs. Even downloaded SP2 and all updates. What more can I do?
 
P

pcbutts1

Please download ewido security suite it is a free version of the program.
http://www.pcbutts1.com/downloads/ewidosetup.exe
Install ewido security suite
When installing, under "Additional Options" uncheck..
Install background guard
Install scan via context menu
Launch ewido, there should be an icon on your desktop, double-click it.
The program will now open to the main screen.
You will need to update ewido to the latest definition files.
On the left hand side of the main screen click update.
Then click on Start Update.
The update will start and a progress bar will show the updates being
installed.
(the status bar at the bottom will display "Update successful")
Exit ewido. DO NOT SCAN YET.

Download CCleaner and install it, but do not run it yet.
http://www.pcbutts1.com/downloads/ccsetup123.exe

Download HijackThis unzip it but do not run it yet.
http://www.pcbutts1.com/downloads/HijackThis.zip

Please download this file: Revised Installer for the Nailfix Utility
http://www.pcbutts1.com/downloads/nailfix1.exe
Save it to your desktop.
DO NOT RUN IT YET.

Next configure Windows to show all files

Do one of the following:
In Windows XP, on the taskbar, click Start > My Computer.
In Windows 2000/Me/98, on the Windows desktop, double-click the My Computer
icon.
Do one of the following:
In Windows XP/2000/Me, on the Tools menu, click Folder Options.
In Windows 98, on the View menu, click Folder Options.
On the View tab, uncheck Hide file extensions for known file types.
Do one of the following:
In Windows XP/2000/Me, uncheck Hide protected operating system files. Then,
under the "Hidden files" folder, click Show hidden files and folders.
In Windows 98, in the Advanced Settings box, under the "Hidden files"
folder, click Show all files.
If you see a warning message, click Yes.
Click Apply.
Click OK.

Next, please reboot your computer in SafeMode by doing the following:
Restart your computer.After hearing your computer beep once during startup,
but before the Windows icon appears, press F8.Instead of Windows loading as
normal, a menu should appear
Select the first option, to run Windows in Safe Mode.
Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup
Make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open
and close very quickly --- this is normal.

Now open ewido and do a scan of your system.
Click on scanner
Click on Complete System Scan and the scan will begin.
NOTE: During some scans with ewido it may find cases of false positives.
You will need to step through the process of cleaning files one-by-one.
If ewido detects a file you KNOW to be legitimate, select none as the
action.
DO NOT select "Perform action on all infections"
If you are unsure of any entry found select none for now as the action.
Once the scan has completed, there will be a button located on the bottom of
the screen named Save report
Click Save report.
Save the report .txt file to your desktop or a location where you can find
it easily.


Now run HijackThis, click Scan, and place a checkmark next to each of the
following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HJT, then click the Fix Checked button.
Close HJT.

Locate and delete the following File
C:\WINDOWS\Nail.exe
For Windows NT or 2000 it would be
C:\winnt\Nail.exe

Now run CCleaner
Uncheck "Cookies" under "Internet Explorer".
If running Firefox: click on the "Applications" tab and uncheck "Cookies"
under "Firefox".
Click on Run Cleaner in the lower right-hand corner. This can take quite a
while to run.

Finally, restart your computer in normal mode and please post a new
HijackThis log, as well as the report log from the Ewido scan by using Add
Reply.

If IE is not working, the links I gave you are direct download links and
should work. If they don't then paste them into another browser or explorer
window. If you have no other browser then email me with a valid email
address and I will send you one. We will fix IE after all the spyware is
gone.



--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com
 
L

Leythos

pcbutts1 said:
Please download ewido security suite it is a free version of the program.
Click to expand...

Only download software you can validate as uncompromised - in the case
of non-vendor site you have no guarantee that the files are unmodified
or uncompromised. Anyone providing a link to a non-vendors site with a
direct download should not be trusted, the vendors sites are the safest
place to download their application.

All applications can be found directly at the vendors sites and don't
have to be downloaded from private unverified sites.
 
L

Leythos

Running WinXP Home Edition over DSL network. Have Panicware Pop-Up Stopper,
Ad-Aware SE, Spybot, SpySubtract and CWShredder. Firewall up and running.
Explorer set to block all pop-ups. I have browsed all past threads here
regarding pop-up problems, and have followed advice of most everyone. I ran
Ad-Aware 3x in a row (after I had disconnected cable) and was getting pop-ups
while it was running! Each time I ran program there was additional "critical
objects" listed that needed to be deleted.

I still have persistent pop-ups that just won't go away, particularly from
Aurora-Part of the ABI Network (home of the famous PartyPoker.com), and
others such as US Immigration wanting to know if I need a Green Card (I
don't).

I did not have this problem before I had to reinstall WinXP and all
associated programs. Even downloaded SP2 and all updates. What more can I do?
Click to expand...

First, your machine is compromised, that means you need to disconnect
from the Internet and you need to get some form of NAT Router between
your PC and the Internet or it's going to happen again - after you fix
it.

I just cleaned another 28 systems today, all were University Doorm room
computers, we used AVG and Symantec Trial Edition AV and AdAwareSE and
SpyBot Search & Destroy - the combination of the AV and the two anti-
spyware cleaned everything in a short amount of time.

The key is to run them in SAFE MODE.

If you run in safe mode it's a lot harder for the apps to hide and
protect themselves - run the AV and Spyware tools a couple times, reboot
into normal mode, then reboot in safe mode and do it again.

If you don't have the NAT Router you're going to get it again - as
you've learned you can't trust your skills with a software firewall.

Only download software you can validate as uncompromised - in the case
of non-vendor site you have no guarantee that the files are unmodified
or uncompromised. Anyone providing a link to a non-vendors site with a
direct download should not be trusted, the vendors sites are the safest
place to download their application.

Also, do not post HiJack log files here - there are HiJack groups for
just that purpose, not to mention all the web based forums setup for
looking at them.

Always remember - only download files from Trusted Sites.

These sites are for downloading Anti-Spyware tools, in order that I
would use them myself:

AdAwareSE can be found here:
http://www.lavasoft.de/support/download/

SpyBot Search and Destroy can be found here:
http://www.safer-networking.org/en/download/index.html

Ewido Security Suite Trial can be found here:
http://www.ewido.net/en/download/

CrapCleaner can be found at the vendors site here:
http://www.ccleaner.com/ccdownload.asp

CleanUp can be found at the vendors site here:
http://www.stevengould.org/software/cleanup/download.html
or from another reputable source:
http://www.tucows.com/get/405276_152071

The following are two links to Antivirus software in order that I would
use them:

You can also download Symantec Trial version of their Antivirus software
from here:
http://www.symantec.com/downloads/

Download AVG Personal Free edition from here:
http://free.grisoft.com/freeweb.php/doc/2/

These are the actual vendors sites, not some unknown or authorized no-
name site. They also don't artificially increase the hits for sites that
get paid for the amount of traffic they can generate like one poster has
admitted to in this group.
 
P

pcbutts1

Search all you want idiot you won't find nailfix1.exe except on my website.
There are only 2 versions available, mine is the only one that works. You
cannot thoroughly fix Aurora/nail without it. You see what your obsessed,
know nothing, stalking ass has done. You are so obsessed with me you are
giving out bad, wrong, way off topic posts, not only in this post but others
as well.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com
 
L

Leythos

pcbutts1 said:
Search all you want idiot you won't find nailfix1.exe except on my website.
There are only 2 versions available, mine is the only one that works. You
cannot thoroughly fix Aurora/nail without it. You see what your obsessed,
know nothing, stalking ass has done. You are so obsessed with me you are
giving out bad, wrong, way off topic posts, not only in this post but others
as well.
Click to expand...

http://www.techspot.com/vb/topic27710.html

http://forums.maddoktor2.com/index.php?showtopic=5104

You might want to search the net before you head swells any more.
 
P

pcbutts1

Like I said before, there are only 2 versions available mine is the only one
that works. What you posted is not the same file. The instructions they give
have been modified from my original but I don't care about petty stuff like
that.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com
 
L

Leythos

pcbutts1 said:
Like I said before, there are only 2 versions available mine is the only one
that works. What you posted is not the same file. The instructions they give
have been modified from my original but I don't care about petty stuff like
that.
Click to expand...

What, specifically, does yours do that the ones written my the vendor
doesn't do? Go ahead, tell us if you can.
 
L

Leythos

pcbutts1 said:
There you go with that vendor crap again. There is no vendor for this file.
It' a batch file. If you want to know the difference then download it and
compare it, which I know you probably already did. I'll just check my logs.
Click to expand...

So you don't really want to show how yours is different, don't really
have anything that shows it's different, and were just blowing smoke
when you posted that yours was the only one that worked.

As for vendor, there is a chap the wrote it, has his site for it, and
appears to support it - all you provide is a download for it and not
support for it on your personal website.
 
L

Leythos

pcbutts1 said:
That's a bunch of BS. When are you going to realize that I have nothing to
prove to you Stalker.
Click to expand...

You made the claim that yours was the only one that worked, then claimed
that is just a batch file, then claimed that the chap the wrote it
doesn't have any rights....

You are the one making claims you can't back up.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

How To Stop Pop Ups? 4
pop ups? 2
troublesome pop ups 3
Sort of OT: UPS battery protection? 6
These Pop-ups are killing me! 5
pop-ups 3
pop ups help. 2
pop ups and registry problems 20

Top