Anyone else have problems with these popups?

Zaph

For the last week or so I've been afflicted with a series of three popups that I just can't get rid of, no matter what I do. I've run Spybot, Ad-Aware and Spy Sweeper but they haven't managed to get rid of them. Has anyone else encountered any of these pests, and if so, how did you manage to get rid of them? (Sorry I have no idea how to post a screenprint on a thread, so text will have to do)

Caution: Spyware Trojan Horse ALERT!

The Following SPYWARE was detected on your computer:
IETray
IEAccess/IEDial
MoneyTree
Xrenoder
IEDll
Gator
SVAPlyer
You need to perform the FREE SPYWARE SCAN In oder to keep your computer functional!!!

Y/N
===============================

Internet explorer: Trojan Horse ALERT!

Your computer may be infected with Trojan Horse Virus!!! Do you wish to remove it?

Y/N
===============================

Internet Explorer: $1000000 Guaranteed Prize

The $1MILLION GUARANTEED PRIZE IS WITING FOR YOU!!! Do you wish to apply for it with our casinos? Note: by clicking YES you confirm that you are at least 21 yr. old.

Y/N


Any help anyone can give would be greatly appreciated.

Thanks

cmo

Hmm this is a biiiiiiiiiiiiiiig problem, how did the pc get this bad???

First of all where is the trojan message appearing???? The first one?

Secondly is your NAV (Norton) up to date virus defs? If there not please update to the most recent and run a full system scan.

Update ad-aware also....and scan again

Gator is the only program i recognize, its spyware as far as i know, it can be removed using as-aware. The rest of the stuff, is just crap by the looks of it.

- Go into control panel, and look in the ADD/REMOVE programs section for the programs which appeared e.g. IETray then unintall each one you find.

The virus alert is most probably a crappy program as well, just imitating.....

The last one, looks like another program, WHAT page is set as your home page in IE ? What happens when you click the home button.

Once you have all this sorted out - Use firefox to surf the web

---

ttp://www.mozilla.org/products/firefox/releases/0.8.html

So try these things, and let me know.,,,,,,,,,,,,,,

The Dr00g

zaph , first of all I must tell you that I earn a considerable crust by removing such nasties from PC's, so I know what I'm talking about. Secondly I must tell you that I'm not so mean that I wouldn't offer a fellow boards.ie user a dig out in a situation like this, but then I'm not so lacking of a life that I have time to talk you through a full solution. It can take a few hours work to get rid of these things.

The popup warnings you're getting ARE a result of the trojan/virus you have been infected with. I cleaned a similar infection on a friends PC (via remote control) a couple of days ago. That was a variant of the "Startpage.4x" browser hijack which included an obscure trojan component called "Backdoor.Agent.BA". She also had another virus infection but I've forgotten which one. Anyway...

The entire infection easily got in past her fully updated Norton Corporate Edition (take note cmo ) and her fully updated Windows XP Home Edition with firewall (Windows) activated. Actually, all readers take note - Norton AV products suck donkey balls. McAfee are just as bad. Anyone ever heard the expression "bloatware". Yeah. :rolleyes:

I use AVG free edition and it serves me well. Get a copy at www.grisoft.com and update it of course. Scan your system (zaph) and I can almost guarantee you that you'll find a trojan infection (That Norton can't see). But AVG might not be able to remove it. This is where things might get a bit labour intensive, and therefore kinda expensive.

Adaware is great, but if you don't update it AND configure it properly then you're kinda wasting your time.

Spybot is great as it is.

Spysweeper? Never used it. No comment.

CWShredder is another very useful tool. It kills a good few browser hijacks and affiliated trojans.

Hijackthis.exe is another one that I use regularly. It helps get rid of the modifications that some infections make to your registry and browser settings, etc. Thing is, you have to know exactly what you're doing with this tool. You can make things worse if you don't. However, some experts who try to help you will ask you to run this tool and give them a copy of the log file that it generates. From the log file they can identify certain problems and instruct you what to do next.

This is turning into a long story... Look, try the AVG thing first. Tell us what happens. Find and download CWShredder and Hijackthis for possible future use.

I'm not promising anything... Some of these infections can be a bitch to get rid of and I have my plate full with paying customers already. But I'll see what I can do.

Zaph

Dr00g, I really appreciate your help, I'm only on for a few minutes to check e-mail and don't have time to download anything tonight, but I'll definitely download AVG over the next couple of days. I think I have CWShredder on a backup disk somewhere so I'll reload it and give it a blast too.

Interesting what you say about Norton. On my PC I'm running Norton 2003, fully subscribed with automatic virus definition updates, Windows XP firewall activated and ZoneAlarm firewall on as well for good measure. I do my best to ensure my PC is as protected as I can get it, so it's a real pain in the ass for this to happen.

It'll probably be the weekend before I get a chance to do everything you suggested, but I'll let you know how I get on.

CMO, thanks also for your suggestions.

The Dr00g

You're welcome.

Your PC sounds as well protected as mine. This stuff can happen to the best. It's mostly down to weakness in Internet Explorer. Let me tell you the kind of sites where I've seen this kind of thing... #1 has to be Porn sites. I've seen them on warez sites, games cheats sites, and driver download sites, etc. Generally any type of site that is prone to a lot of ad popup traps (all of the above) is likely to be a candidate for browser hijack distribution. It's all about faking traffic ratings so they can get higher advertising revenue. Sick bastards.

Note on CWShredder - Make sure you download and use the latest version (1.59.1).

No need to have the XP firewall switched on if you have the latest ZoneAlarm.

cmo

No problem zaph, dr00g is right though, your pc sounds pretty fortified, the sites he suggested would be the ultimate source of this sort of thing. I am jus tusing firefox, or use mozilla,...

anyway hope it works out...

Zaph

I downloaded and ran the latest versions of CWShredder and AVG and they came up with some interesting results. CWShredder found and deleted a trojan while AVG detected two different viruses, one of which was deleted automatically and the other I was able to dump myself. None of these items were picked up by Norton when I ran a full scan last week. I've now been online for about an hour and haven't had a single pop-up (touch wood, fingers crossed, etc., etc...), so it's looking good.

CMO, I'm going to have a look at Mozilla and I might just switch browsers to see how I get on.

Dr00g, again many thanks for your help, I appreciate the professional help at such reasonable rates!

RicardoSmith

Have to say I've had the same experience of AVG finding things that the Norton and McAfee don't. So when anyone asks me to clear their PC's. These bloatware AV apps are the first thing I uninstall. They have a tendency to slow down a PC unless they are configured properly and most people don't do that.

Mac daddy

Originally posted by The Dr00g
It's mostly down to weakness in Internet Explorer.

Half true- most of the time it is user that do not have a clue what they are doing and just clicking on pop-ups. By doing this that is how it gets installed.

What i use most of the time is norton system works and hijack this- no need for cw shredder or AVG, trojan guard ect

LEARN HOW TO READ HIJACK THIS and you will be fine

kevin