I have a problem I’ve not encountered before and can’t find a solution. I’m hoping someone out there can help…
There is some irritating program on my system that opens pop-up browser ads at random intervals. These ads are not being initiated from websites. For example, I have my homepage set to aboutblank. When I open Internet Explorer, I’ll get a popup. Then, it seems that every so many clicks the same happens. I also know it’s not the websites since it happens when I browse my own websites…
I run the microsoft recommended adaware and also spybot search and destroy. Neither seem to be able to fix this problem…
i thing that page name “about.htm” anyway, you search these links in registery and delete them, may be this will solve your problem.
This happens due to worms.
Yes, devorem is right. Use HijackThis. It will show you all the suspicious registry entries. The only trick is that YOU have to know which ones need to be removed. It will show all BHOs (browser helper objects) such as Yahoo or Google toolbars, download managers, iTunes, etc.
If you run HijackThis and are not sure what to delete, post a copy of the results here and maybe we can help you. There are also several forums that specialize in helping with it.
I just got done removing the same kind of pop-ups from my daughter’s computer a couple of days ago. Somewhere along the line something you think is harmless gets downloaded and it installs this browser-hijacking crap. The folks who build this kind of software should be tortured publicly in the worst way imaginable. They should be sentenced to life with only a 386 computer, 14K modem, and AOL. And no local access number. But that’s just my opinion.
I ran Hijackthis and deleted the ones I could definately identify as rouge - it seems to have cured my problem… for now! Thanks guys! If it comes back, I’ll definately post the results…
Just one other tip, Yahoo Toolbar now has “yahoo anti-spy” which is pestpatrol. It find a LOT of items and in my experience rmoves better than adaware and spybot, however using all 3 is my recommendation.
oh but the yahoo one seems to dig deeper in registry to remove root problems.
[QUOTE=Stephen]
Just one other tip, Yahoo Toolbar now has “yahoo anti-spy” which is pestpatrol. It find a LOT of items and in my experience rmoves better than adaware and spybot, however using all 3 is my recommendation.
oh but the yahoo one seems to dig deeper in registry to remove root problems.
[/QUOTE]
I’m a bit sceptical about these add-on toolbars… I wouldn’t be suprised if they had their own little spyware programs included… whatcha think?
Another thing to consider is if you are using a windows xp or above os you may want to kill the system restore function while cleaning the system off. This will call all removed files to be restored at next reboot if it thinks they are system files.
as far as toolbars, I only trust the google or yahoo. Or the firefox ones since they are open source and I can see what they do, others, very VERY skeptical of.
I have the same adware problem that LegalAlien had experienced, and (as recommended) ran Hijackthis in an effort to eradicate this evil little program. However, I’m not quite as savvy as LegalAlien in identifying what appears to me as a needle in a haystack. Could someone please review my output and help me to identify what (all) needs to go?
Thanks!
[QUOTE=enuf_alrdy]
I have the same adware problem that LegalAlien had experienced, and (as recommended) ran Hijackthis in an effort to eradicate this evil little program. However, I’m not quite as savvy as LegalAlien in identifying what appears to me as a needle in a haystack. Could someone please review my output and help me to identify what (all) needs to go?
Thanks!
[/QUOTE]
not that i don’t trust you, but please paste the contents of that output file?
I totally understand… here it is:
Logfile of HijackThis v1.99.0
Scan saved at 9:06:42 PM, on 1/15/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
[QUOTE=devorem]
I can fix this. I charge $45/hr.
[/QUOTE]
That’s not very nice hmm - apparently I’m not as savy as you though ‘enuf’.
I would probably hazard a guess or two and fix it, but I’m not going to speculate and mess up your machine further. Maybe you should take devorem up on his offer?
Well, maybe I’ll just back everything up that I care about, and start tinkering. Worst case is that I jack the whole thing up and am forced to re-format and start over. Sometimes a reset is good. In fact, you could just look at my HighjackThis output and see all of the crap that has accumulated on my system. And if I’m able to fix it… then I could offer to fix some other person’s system for $45/hr. :]
Thanks for the input, and devorem, I haven’t totally ruled out your offer yet…
sits.exe is a major problem, nothing needs to run out of that folder.
Go to my computer, first make sure your my cmoputer is set to show hidden files, (tools, options if I am not mistaken) (oh and while you are there set it to show file extensions for known file types)
Then click your address bar and paste this in:
C:\Documents and Settings\Administrator\Application Data\
find the sits.exe, rename it sits.exebad
use hijack this to remove it from your auto startup and reboot. That will fix a lot of your problem right there, nothing legit runs in that folder, NOTHING.
(I have removed over 170k spyware infections in the last 10 weeks or so, some PCs with 2000+ infections, I became a pro at manual removal since even the best anti-spyware apps didn’t get them)
I am trying to work with webroot software now becasue I found a site hosting many spyware apps that auto downloaders would download and install. I am hoping webroot will work to stop all of these malicous spyware apps.
They are a bigger concern to me than the worst of viruses. I have seen numerous spyware apps that are keyloggers and log your KB input to send to ad agencies. These companies are already using unethical means to advertise, what will prevent them from using info you type against you.
Edit: And for the curious, that was prior to the new year, and at an educational institution. Just to clarify
Wow! Thanks for the heads-up Stephen. I actually always have my systems configured so that I can see both hidden files and extensions but I still couldn’t see sits.exe. However, your suggestion caused me to look at other possible viewing options, and I spotted the option to disable hiding protected operating system files. With this option, I not only was able to see sits.exe but also imsu.exe, which is something Sygate has been blocking for me. I think imsu.exe is related to that evil clickspring spyware. I kept going to this directory path with hidden files enabled but could never spot it. Thanks again.
hmm - apparently I’m not as savy as you though ‘enuf’.