ExitthePig
01-21-2009, 02:56 PM
Why does my computer still get pop ups even with the pop blocker on, and even after doing both virus and spy ware scans...also...why won't my automatic updates stay on even though I turn them on...some times it just refuses to do it all together...
so...so...so pissed right now. I can't type for more than a minute or two before one springs up.
Grey Area
01-22-2009, 09:53 AM
Sorry about your frustration, but I don't know myself. John is the expert in this case....
John L
01-22-2009, 09:59 AM
It's going to depend on a few things before I can give advice.
Which OS are you using?
What web browser are you using?
What is the content of the pop-ups you're getting? Are they shilling some stupid antivirus or various advertisements?
ExitthePig
01-22-2009, 03:56 PM
Which OS are you using?
Windows XP.
What web browser are you using?
Firefox.
What is the content of the pop-ups you're getting? Are they shilling some stupid antivirus or various advertisements?
[/LIST]
Yes, it is mostly adverts for anti virus and...strangley...horneymatches.com ....so I don't have a clue. Overwhelmingly it is ads for anti virus shit. Although a lot of the time it just ends up being a blank page.
Typically if I open firefox I get 3 extra pages instantly and then after that, one every couple of minutes
John L
01-24-2009, 02:29 AM
How familiar are you with fidgeting a little bit in your registry?
ExitthePig
01-25-2009, 01:42 PM
How familiar are you with fidgeting a little bit in your registry?
I am not familiar at all...not even really sure what you mean?
GreNME
01-25-2009, 11:17 PM
Okay, the registry inside of Windows is basically a place where a lot of program and Windows settings reside. More often than not I typically recommend that people avoid fiddling around with their registry, because a bad mistake could result in an uncoverable situation that would hose your Windows install. However, what I think the problem that you're having might be isn't going to put you at risk of damaging your operating system. If you're able to boot Windows into 'Safe Mode'-- this involves hitting the F8 key on your keyboard before the Windows logo appears while the computer is booting up-- I would suggest doing that to perform this fix, because it best ensures that you'll be able to remove the offending software without problems.
I'll try to list these in steps, but some of this is going to take some intuitive sense on your part.
Start in Safe Mode (if possible).
Go to your Start menu, select the Run option.
In the text box that opens up, type Regedit. A new window will open up with My Computer as the root and five branch options: HKEY_CLASSES_ROOT; HKEY_CURRENT_USER; HKEY_LOCAL_MACHINE; HKEY_USERS; and HKEY_CURRENT_CONFIG. For this, you will NOT be doing anything with HKEY_CLASSES_ROOT, HKEY_USERS, or HKEY_CURRENT_CONFIG. Consider those off-limits for the scope of this walk-through.
Highlight (using a mouse click) HKEY_CURRENT_USER, click the plus sign (+) and a list will open under it. Select Software and again click the plus sign (another list will open under that). Select Microsoft and again click the plus sign (yet another list under it). Select Windows (just Windows, not 'Windows <any other word>) and click the plus sign (yes, this is a pattern). Select Current Version and click the plus sign. Select to highlight Run. You should see some stuff in the frame of the window on the right.
Within this right-hand frame, there may be several entries. The default entry is labeled (Default) and should be left alone. The other entries are links to software that is designated to run when your user name signs into Windows. If there are a few entries there this isn't necessarily a bad thing. I will try to help you determine whether one or more of them is one you can remove, however.
Entries on the right should have three columns: one is the name of the entry, which should be meaningful (as in signifying what it's for or the executable name); the second is the type, which for the purposes of this I won't get into explaining; the third is the data within the entry, which in this case should be a pointer to a file or a command (like C:\Program Files\ProgramName.exe or something similar). What you want to look for are entries with non-sensical names that are essentially alpha-numerics like '6HK4IL7', both all capitalized or completely uncapitalized (I've never seen this contain caps and lowercase [yet]) and typically consisting of about seven alpha-numerics (not less than six, not more than nine). Offending entries will consist of this kind of name and will have something similar to 'C:\DOCUMENT~1\<your username>\LOC~1\TEMP\<filename>.exe' within the data field, where '<your username> is the username you use to log into Windows and with '<filename>.exe' being basically the same as the name of the entry (so, in this case, it would be 6HK4IL7.exe).
Right-click this entry in the name column, select 'Delete', then confirm the delete for this entry.
You will also want to look for entries containing within the Data column the value of 'rundll32.exe 6HK4IL7.DLL' or 'C:\Windows\System32\rundll32.exe 6HK4IL7.DLL' or even 'C:\Windows\System32\svchost.exe 6HK4IL7.DLL'. If you find these, delete them as well. If you feel uncomfortable or question whether they need to be deleted, copy the name and data text to notepad, save the notepad file, and copy the contents into a post in this thread. I can verify for you whether to get rid of them or not.
After deleting the offending entries, highlight Run in the left frame of the window and them use the left arrow on your keyboard to minimize the lists until you see the original five listed above.
Follow the exact steps and path listed above for the HKEY_LOCAL_MACHINE list on the left under My Computer. Be aware that the alpha-numeric name designation will probably not be the same as I used here. This is going to require a bit of intuitiveness on your part to see if the names used are suspicious. Never at any point make a deletion unless you feel they meet the descriptions I've given above, or otherwise copy them to a txt file and let me know what they are showing.
After completing that process, close Regedit. You are not finished yet.
Open an Explorer (My Computer) window. Select the Tools menu, then click Folder Options. Select the View tab. Find "Show hidden files and folders." and make sure that it's selected. Un-check "Hide extensions for known file types." just to be sure. You may or may not wish to also temporarily un-check "Hide protected operating system files" for the sake of this task, but I don't recall it being necessary (and it will prompt you to be sure if you un-check it). Click OK when done.
Navigate to C:\Documents and Settings\<YourUserName>\Local Settings\Temp, where '<YourUserName>' equals the user name you use to log into Windows. This is your Temp directory where a number of programs deposit temporary files for use while running. You should probably notice a large number of files in (and possibly folders under) this folder.
Highlight any of the files in this folder by clicking once on it, select Edit from the menu at the top of the window, then Select All. Alternatively, after highlighting you can also press CTRL+A on your keyboard for the same effect. Press the Delete key on your keyboard. WARNING: This will delete all the files in this folder and send them to the recycle bin. You should not necessarily have any files in this folder that you should need, but if you had any unsaved data in a Word document or some other file before doing this please save that data first and then proceed with the deletion.
After confirming the file deletion and emptying your Recycle Bin, restart the computer.
And that, my friend, is a very quick-n-dirty version of the process that you can follow to clean out the problem I think you have. Most of that is from memory having dealt with it before on other computers, but this covers the basics of the information you'll need to perform the cleaning. This problem is tricky because the stupid adware sets itself up to run in your RAM and will continually rename itself on the fly if you start trying to delete it. The way to get around that persistent little bugger is to start in Safe Mode, where programs like that don't get started and can thus be shut down without them meddling with your attempts to remove it. You can further improve your chances by performing this process with the computer disconnected from the network (unplug the network cable)-- without the ability to 'phone home' its effectiveness is lowered.
Good luck, man, and let me know if you have any questions at all for any of the steps I outlined. I'd rather explain better if necessary than leave you confused about any step along the way. Also, don't worry about asking me questions about this, because this is a pretty persistent bugger and it's not lightweight in its attempts to remain on your system. Definitely save a copy of this page as a guide for following the directions.
ExitthePig
01-26-2009, 01:23 PM
Whoa!
Thanks for the run down. My next day off I will attempt to not screw up my computer more than usual.
SJConsultant
01-27-2009, 04:35 PM
If you don't mind downloading and installing software, http://www.malwarebytes.org/ has been pretty good at detecting and removing spyware.
vBulletin® v3.6.8, Copyright ©2000-2012, Jelsoft Enterprises Ltd.