Hi Hong - I'm posting some info about popups below, but you may also have
been hijacked. Try this first:
If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in
Zone Alarm 3.x, if present or any other Ad Blocking software which
interferes with Java Scripting for this scan to work. You should get a
message between the two lines of **** giving the results of the scan.
For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here:
http://www.lavasoftusa.com/support/download/.
Update and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others.
Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
Then for popups specifically, there are a variety of third party "Popup
Killers" available. I normally use AdShield, which, if you maintain its
Block List every now and then, almost totally stops this. In addition, it
stops a variety of ads/banners/etc. (particularly spyware like doubleclick)
on pages I access. This is probably all you'll need; however, I've also
investigated a program called Webwasher which appears to be very good, but
decided that AdShield was sufficient. At the bottom of this post, you'll
find a list provided courtesy of bc_acadia of a number of free popup
blockers with links.
****** NOTE: As of 28 Apr 03 AdShield appears to have partnered with a new
reseller, and AdShield is no longer free. There is a trial version of
AdShield3; however, IMO it is seriously crippled in not being able to import
or export block lists and I think for reasonable utility one would have to
go to the full version. While I don't normally recommend non-free software,
I personally will continue to use AdShield3, since I think it is the best
currently available combined Popup/Ad/Malware blocker, but you should be
aware of the fact that it now costs, ($29.95), whereas the earlier versions
upon which I based my original recommendation were free, although not nearly
as capable as the AdShield3 release. I've included below links to both the
older free version and the new paid version. You'll have to investigate and
make your own choice in the matter. *******
Here are a number of AdShield-related links:
http://www.fsd1.org/technology/Files/AdShield.exe - AdShield1.2 (free)
http://www.internettechs.net/utilities/AdShield.exe - AdShield1.2 (free)
http://ftp.ural.ru/home/index/windows/networking/utils/AdShield -
AdShield1.2 (free)
http://www.megalog.ru/info/utilz/AdShield.zip - AdShield1.2 (free)
http://www.allstarss.com/store/adshield.html - AdShield3
http://www.mvps.org/winhelp2002/block.txt - (Mike Burgess' .txt Block List
for AdShield)
http://www.mvps.org/winhelp2002/block.zip - Mike Burgess' Zipped Block List
for AdShield - Recommended)
http://adshield.briankass.com/blocklists.html (lists a number of
blocklists)
http://adshield.briankass.com/blocklist.abl (brian's blocklist in .abl
format)
http://adshield.briankass.com/blocklist.txt (brian's blocklist in .txt
format)
http://www.songwave.com/software/adshield_blocklist.txt (40,000 pornsites
blocked - *VERY* large list - use at your own risk)
http://www.chrismyden.com/temp/block.abl (chrismyden's blocklist in .abl
format)
http://www.staff.uiuc.edu/~ehowes/resource.htm#AdShield (Eric Howes AGNIS
for AdShield block list - Recommended) (BTW, Eric's site contains a wealth
of very valuable information about all aspects of net security - Very Highly
Recommended)
There's also a new AdShield forum here:
http://users.boardnation.com/~adshield/index.php
Here's a good AdShield test site, courtesy of siljaline: "Make ***SURE***
you have your block scripted popups enabled
http://www.mediaboy.net/1010100-1100001-1111010/gahk/>>>> [Warning this URL
opens a multitude of Browser windows almost instantly]"
http://www.webwasher.com - Webwasher
Additionally, some people have recommended Popup Stopper and PopupBuster,
but they have also been reported or experienced to cause perceived problems
for some people with "normal" links in IE6 such as Google search results and
links from OE. Some proponents of PopupBuster assert, however, that this
is normal operation for this program under certain circumstances which can
be overridden if necessary. YMMV Another "Proxy" type blocker similar to
Webwasher and Proxomitron but supposedly a bit easier to configure is
Privoxy here:
http://www.privoxy.org/ Popup Manager, free, here, has also
been recommended to me:
http://www.endpopups.com/
Also, if you're comfortable allowing changes to the registry, there is an
approach, IE-SPYAD, using the restricted sites list which can be used for
scripted popups. I use this and it works very well. See here:
http://www.staff.uiuc.edu/~ehowes/resource.htm
There is additonal information about setting up and using AdShield, and
about using the Restriced Zone (and an additional list) here:
http://www.mvps.org/winhelp2002/hosts.htm
and some of the Frequently Asked Questions (FAQ's) about AdShield here:
http://adshield.briankass.com
Lastly, ZoneAlarmPro3/4 has added provisions for stopping adds/popups,
handling cookies, web bugs, and scripting/ActiveX components in addition to
it's firewall functionality. Not free, but I have used it with my other
AdBlocking stuff (AdShield, etc.) turned off as a test, and it appears to be
very good indeed. So far I've experienced no problems at all with it set in
its High Security modes for Ads although others have reported the need to
temporarily turn it off to reach some sites. Also, Agnitum's Outpost
Firewall supports a plug-in for this: "Pre-configured to block most banner
advertisement. Can be configured manually or by simply dragging and dropping
unwanted banners into the Ad Trashcan." I have no experience as to how
effective it is, but I have received a favorable report.
There's good information about hijacking in general and fixes available for
specific hijackers here:
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp
http://www.mvps.org/inetexplorer/Darnit.htm#pop_up
http://www.doxdesk.com/parasite/
bc_acadia's list:
"Some popup blockers.
All of these are 100% pure freeware, no trial periods. Some of these
do more than just handle popups.
Pow!:
http://www.analogx.com/contents/download/network/pow.htm
NoAds:
http://www.southbaypc.com/NoAds/
PopupEraser:
http://www.webknacks.com/popuperaser.htm
Stop-the-Pop:
http://www.bysoft.se/sureshot/stopthepop/index.html
Internet Organizer:
http://www.sf.yucom.be/wdprojects/
PopKi:
http://ranfo.com/popki.html
PopUpPopper:
http://www.bayden.com/Popper/default.asp
PopUpKiller:
http://sourceforge.net/projects/puk/
AdCruncher Proxy:
http://home.sprintmail.com/~dtrout/AdCruncher/ReadMe.html
KillAd:
http://www.wplus.net/pp/fsc/
ClickOff:
http://www.johanneshuebner.com/en/download.html
PopupBuster:
http://www.popupbuster.com/PopUpBuster/
Free Surfer:
http://www.kolumbus.fi/eero.muhonen/FS/
Window Shades:
http://www.g-m-m.com/Software/WindowShades/index.php
AdShield (my personal favorite):
http://www.adshield.org/
PopupStopper:
http://www.panicware.com/popupstopper.html
Proxomitron (has learning curve):
http://www.proxomitron.org/
For those who don't want third party stuff, your own pc's built-in
host file:
http://www.mvps.org/winhelp2002/hosts.htm and
http://www.smartin-designs.com/ and
http://www.accs-net.com/hosts/
Here is a review of 61 popup killers, not all of them are free:
http://www.popup-killer-review.com/index.htm"
NOTE that this site also contains a good, comprehensive series of popup
killer tests. Some good additional tests are also available here:
http://www.webknacks.com/aptest.htm
Finally, there's a new class of hijacker using Window's Messenger Service
(not Instant Messaging, BTW). See: Messenger Service Window That Contains
an Internet Advertisement Appears
http://support.microsoft.com/?id=330904
which identifies reasons to keep this service and steps to take if you do.
You can test your system and follow the 'Prevention' link to get additional
information here:
http://www.mynetwatchman.com/winpopuptester.asp Unless
you have very good reasons to keep this active, it should be turned off in
Win2k and XP. Go here and do what it says:
http://www.itc.virginia.edu/desktop/docs/messagepopup/ or, even better, get
MessageSubtract, free, here, which will give you flexible control of the
service and viewing of these messages:
http://www.intermute.com/messagesubtract/help.html Recommended.
Perhaps these will help.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
