Popups! Help!

HotDog-Cart · Post by **HotDog-Cart** » Sat Jun 02, 2007 3:17 pm

Hey, I think I got some adware. Its VERY annoying.

I've scanned my HDD for "ads" and deepscanned it using adware Away SE Personal.

I deleted the registry for the popup program, but I keep getting pop ups still.

I need a way to get rid of this. Sometime it pops up and says "Oh your computer may be infected, click here to scan it for free (recommended)"

I click Cancel or "X" and I get a popup that tries to install something, but it wont allow thanks to my Google toolbar <3.

Help.

Post by **bicostp** » Sat Jun 02, 2007 3:38 pm

Write this stuff down because you won't have internet connectivity during this procedure!

Install the latest versions of Ad-Aware and Spybot, then update them. Also download and install <a href="http://ccleaner.com/download/builds.aspx">CCleaner Slim</a> (The regular version is basically a Yahoo Toolbar installer with CCleaner thrown in as a bonus.)

Now unplug your ethernet cord and reboot into safe mode. Run both anti-spyware programs, deleting all the nasty stuff they find. Run CCleaner and have it remove all the junk it normally looks for.

Open the system restore properties tab and reduce the size until only one restore point exists.

Now shut down the computer. Plug your ethernet cord back in. Wait a couple seconds, then turn the computer back on. Don't just select restart from the start menu. We want a cold boot.

This should fix the problem.

vskid · Post by **vskid** » Sat Jun 02, 2007 4:15 pm

I have that same freakin adware. I've done a few full scans with Ad-Aware, Windows Defender, Avast, and Spybot S&D, none of them got it completely (reduced amount of pop-ups a ton). I didn't do it in safe-mode, though, so I'm going to have to have it do that overnight tonight.

HotDog-Cart · Post by **HotDog-Cart** » Sat Jun 02, 2007 4:53 pm

I'm running on wireless internet. So I cant disconnect the ethernet cord. What do I do?

Also wheres the system restore properties tab?

Post by **bicostp** » Sat Jun 02, 2007 4:59 pm

Oh yeah also stop using Internet Explorer and switch to Firefox, or stop clicking on car insurance ads. (I know it's fun to taser gnomes but if you want fun go play flash games on Newgrounds.)

Don't worry about disconnecting. When you boot into safe mode it won't load the wireless driver software.

Right-click My Computer, select Properties, and click the System Restore tab.

Kurt_ · Post by **Kurt_** » Sat Jun 02, 2007 6:24 pm

I believe what you guys have is called Vundo. It's very hard to get rid of. I tried very hard, and it just slowed down a bit, never stopped. The computer was soon formatted. Is one of the ads for Win-Anti-virus Pro?

http://www.symantec.com/security_respon ... 11-3912-99

vskid · Post by **vskid** » Sat Jun 02, 2007 6:49 pm

Kurt_ wrote:I believe what you guys have is called Vundo. It's very hard to get rid of. I tried very hard, and it just slowed down a bit, never stopped. The computer was soon formatted. Is one of the ads for Win-Anti-virus Pro?

http://www.symantec.com/security_respon ... 11-3912-99

Thats what I have, its a mother to try to remove. I think I'll have to reformat, been needing to reinstall anyways.

Bic: I got it and I use Firefox. I think I got it from a fake key gen (my friend lost a key for a game, he really owns it). Google told me the site was bad but I went anyways, so listen to Google, it knows all.

HotDog-Cart · Post by **HotDog-Cart** » Sat Jun 02, 2007 7:58 pm

I think its gone now. A system restore to 2 weeks ago, and regscrub xp, and cc cleaner, and spybot fixed it

Post by **Skyone** » Sat Jun 02, 2007 9:11 pm

Most people don't recognize that this can be solved extremely easily.

Start > Run > regedit > HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Run

Look for any suspicious keys and simply delete them.

HotDog-Cart · Post by **HotDog-Cart** » Sat Jun 02, 2007 9:19 pm

Too bad there isnt a microsoft tab under my HKEY_LOCAL_MACHINE

Post by **Skyone** » Sat Jun 02, 2007 9:31 pm

HotDog-Cart wrote:Too bad there isnt a microsoft tab under my HKEY_LOCAL_MACHINE

Er... open SOFTWARE first.

vskid · Post by **vskid** » Sat Jun 02, 2007 10:43 pm

Skyone wrote:Most people don't recognize that this can be solved extremely easily.

Start > Run > regedit > HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Run

Look for any suspicious keys and simply delete them.

I hope it does, I just deleted anything thats wasn't part of a program I installed. I still need to format and reinstall, though, this install is junked up.