I cant stop pop ups

KoolKid

Lads I need help. This is driving me potty. I am getting pop up while browsing & cant get rid of them.
What I've doe so far!
Turned on IE Pop up blocker... (obvious know but someone was going to suggest it)
Tried othe browsers , his is not an IE problem. Sometimes get them when not browsing at all
Ran every syware adware software I can think of
Spy sweeper
Ad aware
Pest patrol
Mc Afee
Spy bot
None of them find anything.... anyone any ideas

aidan_walsh

Sometimes get them when not browsing at all

Sounds like an adware. Are you using the most up-to-date version of the scanners?

Run a HiJack This! scan and post the log.

KoolKid

Yes, I have updated them all before scanning!

Jimmy365

Run your scans in safe mode.

Have you tried AVG Anti-spyware?

Jim:)

highlight100

did you delete your temporary internet files in case something is in there?

8T8

Download Hijack This, run it and save the log to a txt file then attach the txt file to your next post.

Hijack This will show everything loading at boot which may include some spyware apps that cannot always be removed by anti-spyware software.

Also make sure there are not multiple anti spyware programs running in the background (potential conflicts), uninstall them if necessary and leave Spybot installed and enable the resident tea timer function that program has.

KoolKid

I have tried deleting Tem internet files ,,, dont know yet if it worked
Here is the Hijack This log

Logfile of HijackThis v1.99.1
Scan saved at 10:09:20, on 29/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\Program Files\Windows Defender\MsMpEng.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Ahead\InCD\InCDsrv.exe
I:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
I:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\GEARSec.exe
i:\program files\mcafee.com\agent\mcdetect.exe
i:\PROGRA~1\mcafee.com\vso\mcshield.exe
i:\PROGRA~1\mcafee.com\agent\mctskshd.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
I:\WINDOWS\Explorer.EXE
I:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
I:\Program Files\McAfee.com\VSO\mcvsshld.exe
I:\PROGRA~1\mcafee.com\agent\mcagent.exe
i:\progra~1\mcafee.com\vso\mcvsescn.exe
I:\PROGRA~1\mcafee.com\mps\mscifapp.exe
I:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
I:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
I:\Program Files\Common Files\Symantec Shared\ccApp.exe
I:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
I:\Program Files\Norton Password Manager\AcctMgr.exe
I:\Program Files\PestPatrol\PPControl.exe
I:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
I:\PROGRA~1\PESTPA~1\PPMemCheck.exe
I:\PROGRA~1\PESTPA~1\CookiePatrol.exe
I:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
I:\WINDOWS\SOUNDMAN.EXE
I:\Program Files\McAfee.com\VSO\oasclnt.exe
I:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
I:\WINDOWS\SM1BG.EXE
I:\WINDOWS\system32\ATWTUSB.EXE
I:\Program Files\QuickTime\qttask.exe
I:\Program Files\Windows Defender\MSASCui.exe
I:\Program Files\McAfee\McAfee QuickClean\Plguni.exe
I:\WINDOWS\system32\ctfmon.exe
I:\WINDOWS\system32\TBLMOUSE.EXE
i:\progra~1\intern~1\iexplore.exe
I:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
I:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
i:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
I:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
I:\WINDOWS\system32\svchost.exe
I:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
I:\Program Files\MSN Messenger\msnmsgr.exe
i:\progra~1\mcafee.com\vso\mcvsftsn.exe
I:\Program Files\Messenger\msmsgs.exe
I:\WINDOWS\system32\svchost.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\Program Files\WinRAR\WinRAR.exe
L:\DL Programmes\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ie/0SEENIE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.ie/0SEENIE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ie/0SEENIE/SAOS01?FORM=TOOLBR
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - I:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - i:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - i:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - i:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - i:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - I:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O4 - HKLM\..\Run: [VSOCheckTask] "I:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] I:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] i:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] i:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPSExe] i:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] I:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] I:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [ccApp] "I:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] I:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [AcctMgr] I:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Norton PasswordManager] I:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {D1AFB197-5F24-49f4-9571-2F28A9798936}
O4 - HKLM\..\Run: [PestPatrol Control Center] I:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] I:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Atwtusb] RUNDLL32 FuncKey.DLL,ExtFuncCall AA
O4 - HKLM\..\Run: [PPMemCheck] I:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] I:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [C-Media Speaker Configuration] G:\CMI8738\Setup.exe /SPEAKER
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [OASClnt] I:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] I:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [SM1BG] I:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "I:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] I:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] i:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
O4 - HKCU\..\Run: [updateMgr] "I:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [Mags Rule] I:\DOCUME~1\colm\APPLIC~1\GREATM~1\Mode Build Scr.exe
O4 - Startup: Adobe Gamma.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = I:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Service Manager.lnk = I:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: StumbleUpon: &Blog This - res://StumbleUponIEBar.dll/blogimage
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - i:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - i:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: I:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126102139953
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - I:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - I:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - I:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - I:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - I:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - I:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - I:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - I:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - I:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - I:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - I:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - I:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - i:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - i:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - i:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - I:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - I:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - I:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Norton Ghost - Symantec Corporation - I:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - I:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - i:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Speed Disk service - Symantec Corporation - I:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - I:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Anti

looks clean to me.

But having mcaffe and symantec products installed at the same time is just a bad idea.

What is the pop-up yore getting ?

A screenshot would be nice.

KoolKid

I use McAfee for virus scan & security... Norton is just System Works.
It hasn't happened since I cleaned temp file so maybe that has sorted it.
If i get more I will post screen shots
Thanks for all the replys

8T8

Yeah nothing pop's out at me either though you do have a lot of background apps running.

If the problem is no longer happening then you may have nailed it with one of the apps your running.

KoolKid

No they are still there pic example attached....
Any Ideas?

8T8

Well from that screenshot I can see you have Limewire running which comes bundled with spyware and is often an entry point for spyware so uninstall it.

In IE7 click tools->manage add-ons and delete all the controls listed to be of the safe side (ones that are needed will be re-installed when you visit a site like Windows Update).

Finally uninstall Pest Patrol software and just use Spybot with it's tea timer running in the background to guard against spyware. To enabled the Tea Timer run Spybot and make sure it is up to date first by clicking the update button and downloading all the current updates.

Now click on tools and click on the resident shield icon, now tick the box for resident TeaTimer & SDHelper which is for IE, once done reboot the system.

When you get back in do another system scan with spybot.

KoolKid

Cheers for allthe advice.... Looking good so far..:)

delta_bravo

if its just that site you can try and block it specifically

Anti

Ah tha page, that is from limewire. I recently instaled it to track down a cd that i have that is scratched to bits. I had the same thing. remove limewire. and run spybot again. Sorted it for me.

KoolKid

Ok Still having a problem with these lads.
I have removed limewire
I have found the cookies responsible, they are from these sites
w w w.doubleclick. c o m
w w w.lop. c o m
I have never visited these sites, I delete the cookies but they keep reappearing. Any Ideas...Please

delta_bravo

block the sites

KoolKid

I could do that. But i am wondering where these cookies are actually coming from.
Is there any way of finding out if they are coming from another site ? Because if they are it must be somewhere I am visiting regularly.

DaSilva

Those sites are some of the biggest banner ad sites around. You could block the sites, but you would be denying webmasters income for the sites they are providing.

You are probably getting those cookies from a number of websites you visit, I know doubleclick is a ad provider for a ton of sites.

8T8

Those are tracking cookies which are relatively harmless not really spyware per say as others have mentioned you will get those on any web site.

Assuming IE is your browser of choice the best thing to do is load up Spybot & click on immunize shield icon then click the green immunize + button.

That will block harmful sites so IE wont connect to them.

KoolKid

Anyway lads got a pain trying to sort this problem so I upgraded to Vista..
Everything is good so far..