Ads Are Driving Me Nuts

[WordMerchant]

Hi Guys,

New to posting but have been reading the posts here for some time. Hope this is a proper forum. If not, kindly re-direct me.

Got these ads that popup on my desktop after every boot. Don?t need to have a browser open to get the ads cause they open IE for me to show me their wares. Normally, I only use IE in the direst of circumstances when I can?t access a service any other way. Am hearing the telltale IE click in my sleep.

They do need an Internet Connection though. I can see the little buggers calling home about 10 sec. after I open my desktop unless I disconnect my broadband connection, which I do sometimes just to remind me that I can accomplish something with this computer without the constant interruption of the ads. Re-establish the connection and it?s like opening the fort gates to the barbarians. They rush in with a vengeance.

These guys are the Spawn of Satan!!

Have tried AdAware HijackThis, Spybot and lately NAV 2005 Beta, all with latest updates. No joy!

Prior to the current problem I was in the process transferring files to an external drive in preparation for formatting the internal drive for a clean install of XP Pro. While that is still the plan, I would like to rid myself of these demons for future reference. Seems to me that to format now is like retreating in the face of the enemy and I?ve never fancied myself as a coward or a quitter.

Anyone know of a program that will give me some relief? A way to fight back? A direction to turn to? This crap is really starting to tic me off.

Thanks for listing to my rant.

WordMerchant

 

[oldman420]

hello word welcome to the forums!
first off i would warn you that in all reality you are f=09ckd i had this and after fighting it for a day reinstalled xp however you need to supply more information the hijack this log and any result logs from spybot too there may be someone here that can help you with that info.

 

[mechBgon]

If you share the computer, set up a separate Restricted-User-class account for each person and enable Fast User Switching (presumes you have WinXP Pro or Win2000 Pro), and enable screensaver lock at 10 minutes to force the issue of using one's own account. Restricted Users accounts don't have the privilege level required to make that stuff work, so it's a preventive measure to keep kids/wife/pals from installing junk. Make one for yourself too, and use it for daily-driver stuff. You can still do Administrator tasks if you hold down the Shift key, right-click what you want to run (program, Control-Panel applet, etc) and choose Run As....

Other than that, keep the computer patched with Automatic Updates, make sure you have a hardware firewall (and preferably a software firewall like ZoneAlarm Basic too), and fully configure your antivirus software.

 

[prvteye2003]

I've also had this problem for the last 2 weeks. I made a new post about it before I saw this one. Basically, I've done the same things as the OP has done with no luck.

 

[moonsite]

Could it be messenger service? I don't remember if that message service popup in IE or has its own screen.

If it is, go to 1.Administrative Tools 2. Services 3. Find Messenger 4. Double Click 5. Stop and disable it.

 

[mechBgon]

Originally posted by: moonsite
Could it be messenger service? I don't remember if that message service popup in IE or has its own screen.

If it is, go to 1.Administrative Tools 2. Services 3. Find Messenger 4. Double Click 5. Stop and disable it.

If his computer can even be reached by someone sending Messenger windows, then there's a security hole in need of addressing.

 

[Psych]

Can you post a screenshot or tell us where these pop-ups are pointing to?

 

[AKA]

Like the Oldman said, you and others with this problem need to post the HiJackThis log for us to be able to pinpoint what the problem is.


Also check out this link

Another subject about this

 

[navo]

I've always had luck using the list on this site and checking my running processes and the msconfig startup list:

http://www.sysinfo.org/startuplist.php

 

[WordMerchant]

G?Day Gents

Thanks for the suggestions.

Live alone so onsite security not an issue. Have already created very restrictive access for the occasional guest. Am BellSouth employee with a VPN to Intranet and have a RSA Secure ID setup for my own access.

Have already disabled Messenger with no joy. Also ran WebRoot SpySweeper since original post. Found a high problem count and deleted all but then, after 18 hours and 3 boots with no ads??.they came back.

Regarding HijackThis. Downloaded the program at the suggestion of the AdAware R&D Admin folks. Scanned four or five times and sent the logs to them. Each time they advised me not to delete anything prior to next scan, so I didn?t. Spent a lot of time sending logs to them and downloading updates from them. Still trying.

Finnally ran a scan on my own and found I really didn?t know what was a threat and what wasn?t. Warning said to run the log by a knowledgeable friend before deleting files and since most of the friends I have are about the same level of experience as myself, I didn?t delete anything.

Have everything saved to external drive and am good to go for format and clean install, so I might as well give HijackThis a real go before I cash out.

Having said that, I?d gladly post HijackThis log but not sure of the procedure. Oh, I can copy and paste the log to a post but sure takes up a lot of forum space. If that?s the only way though, I?ll run a new one tonight and post tomorrow A.M.

Same reservations with ?Screen Shots.? I follow directions fairly well though.
Give me an idea of how to and I?ll try. Will ask if need additional direction.

NAVO: Downloaded the startuplist.php but haven?t had the time to run yet. Will next A.M. and get back to you. Will also hit link.

OLDMAN: You?re likely correct about formatting. Am ready to toss in towel when everything I do gets to be counterproductive but for now I want to beat the bas?ds down and send?em to another dimension, the same one that has all the baseballs I lost as a kid.

WordMerchant

 

[mechBgon]

Run the Symantec scan that's linked in my signature and tell me if it comes up with any problems on the Security Scan, which is looking for open ports on your connection among other things. If your system's visible to the Internet, that needs to be put to a stop.

Oh, and to post a screenshot, press ALT PrintScrn to capture an image of the current window, then open Paint and press CTRL V to paste. Now you can save the image, then upload it to an image-hosting site. Here's one we use a lot: http://pics.bbzzdd.com , which is free and pretty self-explanatory to use.