Pop ups

[Guest McGrady]

I don't know when i started getting these pop ups...but they just come out of no where...and i've tried using ad adware, spy sweeper, spysubtract and hijackthis....and none helps getting rid of these annoying pop ups away permanately....it helps limit them but still they keep coming...

 

also i think this is related to why i get pop ups...

when i go into task manager, it no longer shows explorer but only shows rundll32...

 

anyone know how to solve my pop up problem or know what is wrong with my comP?

[5614]

Well, it sounds asthough it is some kind of malware... the fact that the anti-malware programs used produced little results make me think that somewhere on the computer there's an "instal malware" program, so what happens is is that adaware removes the "make pop-up" program and then because you didnt remove the actual source (the "instal malware" program) it will just reinstal itself.

 

If adware and the like do not remove the instal program it can be hard to find. Try getting avast (there's a free trial) and run the boot time scan, it may work.

 

rundll16 and ruxdll32 are malware, remember, when you say it shows rundll32 make sure you get the spelling correct, for example, explore.exe is a virus, whereas explorer.exe is not.

 

Use http://www.liutilities.com/products/wintaskspro/processlibrary/ to check processes, it's a great site.

 

Also, if you are getting pop-ups then the pop up program is running, which means it should be traceable, use a program like process viewer http://www.teamcti.com/pview/ and check through your processes.

 

Also remember this could be a virus and not standard spyware, that's a second reason for doing an AV scan, I like the avast boot time scan because once running some malware can avoid scans, boot time scan runs before the program can start, thus it cannot avoid the scan, set all scans to highest level.

[Primarygun]

Does it still happen even you disconnect your wire? Is that every time when you use IE, pop ups come out?

[5614]

When (s)he said they come "out of nowhere" I made the assumption it was not necessarily when (s)he was on the internet, it sounded as though it happened whenever, which made me assume there was some type of program installed on their computer.

 

And you wouldn't use adware if you had popups from websites.

[Dave]

You might also want to try disabling the Messenger service; they can cause some popups, too (although they're purely text based).

[Dak]

rundll32 is a legit running program, but ONLY if the ll part of the name is two lower-case 'L's (annoyingly, capital 'I's look identical in some fonts). if you use hijackthis and post ONLY the top bit that shows the running prosesses (ie, all of the stuff above the 'R' entries) we can check it out for you if you want.

 

the fact that the anti-malware programs used produced little results make me think that somewhere on the computer there's an "instal malware" program,

hmm, if there was a trojan, then the anti-slyware programs would find something and remove it, only for it to come back next time the computer was switched on.

 

it still might be worth running an anti-virus/anti-trojan to be on the safe side. id reccomend either AVG or Avast if you dont already have an AV (both are free)

 

just out of interest, how were you using hijackthis?

[Dak]

You might also want to try disabling the Messenger service; they can cause some popups, too (although they're purely text based).

I'm pretty sure that spysweeper does this for you, but yeah, McGrady: are the pop-ups opened in a browser window (like internet explorer), or are they the annoying yellowy ones that pop up in the bottom right-hand corner of the screen above the clock?

 

also, did you update all of your anti-malware programs just before scanning?

[Sayonara]

Shoot the messenger.

[5614]

Dude... just do it yourself!!!

 

Start menu > run > services.msc > scroll down and find messenger > right click on messenger > properties > general tab > startup type: disabled > apply/ok > also click on messenger and press 'stop' (near the top left)

 

The 'stop' stops is from running at the moment and the startup type thing will stop it from starting itself automatically.

 

It's probably advised not to play with many of the settings in services.msc unless you know what you are doing, at which point you can safely reduce background processes and thus speed up your computer, but really, don't do it unless you are certain!

[radiohead]

What kind of pop-ups are they? Like colored ones with gif's and everything, or do they llok like a net send prompt? If it is net send, then it is probably a trojan. Ms Messenger does send pop-ups, but more than likely it is a trojan. It is connecting you to a server that is sending you those pop-ups.

[5614]

What kind of pop-ups are they? Like colored ones with gif's and everything, or do they llok like a net send prompt? If it is net send, then it is probably a trojan. Ms Messenger does send pop-ups, but more than likely it is a trojan. It is connecting you to a server that is sending you those pop-ups.

Huh???

 

Messenger doesn't send the pop-ups itself, it is a background process which allows them to be sent/recieved, you can use DOS to send a net send popup, not messenger.exe, and I say "can" because there are programs which abuse the messenger service and allow you to remotely send net send messages via the messenger service without actually being part of a LAN with the computer.

 

These programs are not trojans, if you are receiving net send style popups then it can be fixed by disabling messenger, the cause will either be these programs which abuse the messenger service or someone else on your LAN, not a trojan.

 

Whilst it is possible for a trojan to cause popups it is far more likely to be more standard spyware issue.

[Dave]

I wouldn't call Messenger a spyware. It's just a useless piece of rubbish that MS (for some reason) enables by default on 2000/XP installs.

[5614]

Messenger is a network utility that has its uses but is widely missused... it is now disable by defaults on XP SP2 as MS realised that they, well, to put it nicely, made a mistake!

[Primarygun]

Online Msn Messenger has been available for a long time, if you think a destop messenger causes lots of problems, try this:

http://www.e-messenger.net

[5614]

No no, messenger as in windows messenger service: http://www.itc.virginia.edu/desktop/docs/messagepopup/ it is not the same as an IM (instant messenger) such as MSN or AIM or windows messenger... we're talking about windows messenger service, not program, there's a big difference!

[Douglas]

http://www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx

[c dawg]

if i leave my computer sitting there for 10 minutes or so i get a whole bunch of popups but it says the page is unavailable at this time or something along those lines. I did get a pop up stopper and i have an anti virus program and a spyware program but they still keep popping up. Does anyone know why or how i can get it to stop?

[5614]

So these pop-ups are actually websites?

[Dak]

if i leave my computer sitting there for 10 minutes or so i get a whole bunch of popups but it says the page is unavailable at this time or something along those lines. I did get a pop up stopper and i have an anti virus program and a spyware program but they still keep popping up. Does anyone know why or how i can get it to stop?

which anti-malware programs do you have? if you have one like spyware-guard (i think) or possibly spybot-S&D -- basically one which adds malware-related websites to your block list -- would this result in pop-ups which then kant actually open the site and just display 'site unnavailable'?

 

or an ad-ware which points to a downed site? either way, have you tried updating your anti-spyware definitions and then scanning your pc?

[c dawg]

i have microsoft antispyware and i update it regularely. if forget which pop up blocker i had. it wasn't working so i uninstalled it.

[5614]

Have you been through all the steps I said in post #2 of this thread?

 

If you have and it hasn't helped then can you give me a bit more detail on the problem?

 

Also it could be a program you installed has installed it... so for example when you instal MSN messenger it tries to set msn.com (or wtvr) as your homepage as well as instal I think it's the MSN toolbar or something, I can't remember, but similarly a random program could instal any advertising stuff and it wouldn't be caught by an anti-spyware program because, well, it's part of a genuine program!