popups driving me nuts

  • Thread starter Thread starter
  • Start date Start date

I've scanned with Ad-Aware and Spybot till my pinkies are sore and
nothing comes up except a cookie or two. What else do I need to do to
eliminate popups?

Desperate.
 
Dave Cullen
I've scanned with Ad-Aware and Spybot till my pinkies are sore and
nothing comes up except a cookie or two. What else do I need to do to
eliminate popups?

Desperate.

Well.. Start by using more than just those two applications.

LavaSoft AdAware (SE 1.05) is a great application.. You should uninstall
whatever version you have, download the latest and install it again - to be
sure you have the latest.. And be sure to check for updates before you scan
with it.

Spybot Search and Destroy - same advice. Uninstall what you have, download
the latest version, install it and be sure to download the latest updates
before you scan with it.

Don't leave out Bazooka Scanner, CWShredder and HijackThis! And then when
you are done scanning (possibly in safe mode) - Get and run SpywareBlaster
and IE-SpyAd.

Make sure your firewall is turned on...
Make sure you scan your system for viruses and trojans with your favorite AV
software...
Make sure your system is fully patched from Microsoft...

Look through these tips for more specifics.. Tips (9) and (10) discuss
spyware and viruses.. Tip (5) discusses firewalls and Tip (8) can help you
patch and update your PC..

Protect your PC
http://www.microsoft.com/security/protect/

What to Know Before You Download and Install Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx


Let's take the cleanup of your computer step-by-step. Yes, it will take
up some of your time - but consider what you use your computer
for and how much you would dislike it if all of your stuff on your
computer went away because you did not "feel like" performing some
simple maintenance tasks - think of it like changing the oil in your car,
changing the air filter on your home A/C unit, paying your bills on time,
etc.

Let's go through some maintenance first that should only have to be done
once (mostly):

Tip (1):
Locate all of the software (the installation media - CDs, etc) that you
have installed on your computer. Collect these CDs into a single pile
and locate the original installation media (CDs, disks) in a central and
safe place along with their CD keys and such. Make backups of these
installation media sets using your favorite copying method (CD Burner and
application, Disk copier, etc.) You'll be glad to know that if you have
a CD burner, you may be able to use a free application to make a
duplicate copy of your CDs. One such application is ISORecorder:

ISORecorder home page (with general instructions on use):
http://isorecorder.alexfeinman.com/isorecorder.htm

Pre-SP2 version:
http://isorecorder.alexfeinman.com/IsoRecorder/download.asp

Post-SP2 beta version:
http://isorecorder.alexfeinman.com/download/ISORecorderV2B2.zip


Tip (2):
Empty your Internet Explorer Temporary Internet Files and make sure the
maximum size for this is small enough not to cause trouble in the future.
Empty your Temporary Internet Files and shrink the size it stores to a
size between 10MB and 360MB..

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section, do the
following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the "Amount of disk space to use:" to
something between 10MB and 360MB. (Betting it is MUCH larger right
now.)
- Click OK.
- Click on "Delete Files" and select to "Delete all offline contents"
(the checkbox) and click OK. (If you had a LOT, this could take 2-10
minutes or more.)
- Once it is done, click OK, close Internet Explorer, re-open Internet
Explorer.


Tip (3):
If things are running a bit slow or you have an older system
(1.5GHz or less and 256MB RAM or less) then you may want to look into
tweaking the performance a bit by turning off some of the memory
using Windows XP "prettifications". The fastest method is:

Control Panel --> System --> Advanced tab --> Performance section,
Settings button. Then choose "adjust for best performance" and you
now have a Windows 2000/98 look which turned off many of the annoying
"prettifications" in one swift action. You can play with the last
three checkboxes to get more of an XP look without many of the
other annoyances. You could also grab and install/mess with one
(or more) of the Microsoft Powertoys - TweakUI in particular:

http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx


Tip (4):
Understanding what a good password might be is vital to your
personal and system security. You may not need to password your home
computer, as you may have it in a locked area (your home) where no
one else has access to it. Remember, however, that locked area is
unlocked when you access the Internet unless you are taking proper
precautions. Also, you aren't always "in that locked area" when using
your computer online - meaning you likely have usernames and passwords
associated with web sites and the likes that you would prefer other
people do not discover/use. This is why you should understand and
utilize good passwords.

Good passwords are those that meet these general rules
(mileage may vary):

Passwords should contain at least six characters, and the character
string should contain at least three of these four character types:
- uppercase letters
- lowercase letters
- numerals
- nonalphanumeric characters (e.g., *, %, &, !)

Passwords should not contain your name/logon name. Passwords should
be unique to you and easy to remember. One method many people are
using today is to make up a phrase that describes a point in their
life and then turning that phrase into their password by using only
certain letters out of each word in that phrase. It's much better
than using your birthday month/year or your anniversary in a pure
sense. For example, let's say my phrase is:
"Discharged from Marines in 1964"
I could come up with this password from that:
"DifrMain64"

The password tip is in the "one time" section, but I highly
recommend you periodically change your passwords. The suggested time
varies, but I will throw out a "once in every 3 to 6 months for
every account you have."


Tip (5):
This tip is also "questionable" in the "one time" section. However,
if properly setup, this one can be pretty well ignored for most people
after the initial "fiddle-with" time.

Why you should use a computer firewall..
http://www.microsoft.com/athome/security/viruses/fwbenefits.mspx

You should, in some way, use a firewall. Hardware (like a nice
Cable Modem/DSL router) or software is up to you. Many use both of
these. The simplest one to use is the hardware one, as most people
don't do anything they need to configure their NAT device for and
those who do certainly will not mind fiddling with the equipment to
make things work for them. Next in the line of "simplicity" would
have to be the built-in Windows Firewall of Windows XP. In SP2 it
is turned on by default. It is not difficult to turn on in any
case, however:

Enable/Disable the Internet Connection Firewall (Pre-SP2):
http://support.microsoft.com/kb/283673

More information on the Internet Connection Firewall (Pre-SP2):
http://support.microsoft.com/?kbid=320855

Post-SP2 Windows Firewall Information/guidance:
http://snipurl.com/atal

The trouble with the Windows Firewall is that it only keeps things
out. Truthfully, for most people who maintain their system in other
ways, this is MORE than sufficient. However, you may feel otherwise.
If you want to know when one of your applications is trying to obtain
access to the outside world so you can stop it, then you will have to
install a third-party application and configure/maintain it. I have
compiles a list with links of some of the better known/free firewalls
you can choose from:

ZoneAlarm (Free and up)
http://snipurl.com/6ohg

Kerio Personal Firewall (KPF) (Free and up)
http://www.kerio.com/kpf_download.html

Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/download/

Sygate Personal Firewall (Free and up)
http://smb.sygate.com/buy/download_buy.htm

Symantec's Norton Personal Firewall (~$25 and up)
http://www.symantec.com/sabu/nis/npf/

BlackICE PC Protection ($39.95 and up)
http://blackice.iss.net/

Tiny Personal Firewall (~$49.00 and up)
http://www.tinysoftware.com/

Perhaps you can find the right firewall for your situation in that
list and set it up/configure it. Every firewall MAY require some
maintenance. Essentially checking for patches or upgrades (this
goes for hardware and software solutions) is the extent of this
maintenance - but you may also have to configure your firewall to
allow some traffic depending on your needs. Also, don't stack these
things. Running more than one firewall will not make you safer
- it would likely (in fact) negate some protection you gleamed
from one or the other firewalls you run.


Now that you have some of the more basic (one-time) things down..
Let's go through some of the steps you should take periodically to
maintain a healthy and stable windows computer. If you have not
done some of these things in the past, they may seem tedious at
first - however, they will become routine and some can even be
automatically scheduled.


Tip (6):
The system restore feature is a new one - first appearing in Windows
ME and then sticking around for Windows XP. It is a VERY useful
feature - if you keep it maintained and use it to your advantage.
However, remember that the system restore pretty much tells you in
the name what it protects - "system" files. Your documents, your
pictures, your stuff is NOT system files - so you should also look
into some backup solution.

I'll mainly work around Windows XP, as that is what the bulk of this
document is about. I will, however, point out a single place for you
poor souls still stuck in Windows ME where you can get information on
maintaining your system right now:

Windows ME Computer Health:
http://www.microsoft.com/windowsME/using/computerhealth/articles/

Pay close attention to the sections:
(in order)
- Clean up your hard disk
- Check for errors by running ScanDisk
- Defragment your hard disk
- Roll back the clock with System Restore

Now back to the point at hand - maintaining your system restore in
Windows XP SHOULD be automatic - but I have seen the automatic go wrong
too many times not to suggest the following.. Whenever you think about
it (after doing a once-over on your machine once a month or so would
be optimal) - clear out your System Restore and create a manual
restoration point. Why? Too many times have I seen the system restore
files go currupt or get a virus in them, meaning you could not or
did not want to restore from them. By clearing it out periodically
you help prevent any corruption from happening and you make sure you
have at least one good "snapshot".
(This, of course, will erase any previous restore point you have.)

- Turn off System Restore.
http://support.microsoft.com/?kbid=310405
- Reboot.
- Turn on System Restore.
http://support.microsoft.com/?kbid=310405
- Make a Manual Restoration Point.
http://snipurl.com/68nx

That covers your system files, but doesn't do anything for the files
that you are REALLY worried about - yours! For that you need to look
into backups. You can either manually copy your important files, folders,
documents, spreadsheets, emails, contacts, pictures, drawings and so on
to an external location (CD/DV - any disk of some sort, etc) or you can
use the backup tool that comes with Windows XP:

How To Use Backup to Back Up Files and Folders on Your Computer
http://support.microsoft.com/kb/308422

Yes - you still need some sort of external media to store the results
on, but you could schedule the backup to occur when you are not around,
then burn the resultant data onto CD or DVD or something when you are
(while you do other things!)


Tip (7):
You should sometimes look through the list of applications that are
installed on your computer. The list MIGHT surprise you. There are more
than likely things in there you KNOW you never use - so why have them
there? There may even be things you KNOW you did not install and
certainly do not use (maybe don't WANT to use.)

This web site should help you get started at looking through this list:

How to Uninstall Programs
http://snipurl.com/8v6b

A word of warning - Do NOT uninstall anything you think you MIGHT need
in the future unless you have completed Tip (1) and have the installation
media and proper keys for use backed up somewhere safe!


Tip (8):
Patches and Updates!

This one cannot be stressed enough. It is SO simple, yet so neglected
by many people. It is especially simple for the critical Windows patches!
Microsoft put in an AUTOMATED feature for you to utilize so that you do
NOT have to worry yourself about the patching of the Operating System:

How to configure and use Automatic Updates in Windows XP
http://support.microsoft.com/kb/306525

However, not everyone wants to be a slave to "automation", and that is
fine - as long as you are willing to do things manually. Admittedly, I
prefer this method on some of my more critical systems.

Windows Update
http://windowsupdate.microsoft.com/

Go there and scan your machine for updates. Always get the critical ones
as you see them. Write down the KB###### or Q###### you see when
selecting the updates and if you have trouble over the next few days,
go into your control panel (Add/Remove Programs), match up the latest
numbers you downloaded recently (since you started noticing an issue) and
uninstall them. If there was more than one (usually is), uninstall them
one by one - with a few hours of use in between, to see if the problem
returns. Yes - the process is not perfect (updating) and can cause trouble
like I mentioned - but as you can see, the solution isn't that bad - and is
MUCH better than the alternatives.

Windows is not the only product you likely have on your PC. The
manufacturers of the other products usually have updates as well. New
versions of almost everything come out all the time - some are free, some
are pay - some you can only download if you are registered - but it is best
to check. Just go to their web pages and look under their support and
download sections. For example, for Microsoft Office update, you should
visit:

Microsoft Office Updates
http://office.microsoft.com/
(and select "downloads")

You also have hardware on your machine that requires drivers to interface
with the operating system. You have a video card that allows you to see on
your screen, a sound card that allows you to hear your PCs sound output and
so on. Visit those manufacturer web sites for the latest downloadable
drivers for your hardware/operating system. Always (IMO) get the
manufacturers hardware driver over any Microsoft offers. On the Windows
Update site I mentioned earlier, I suggest NOT getting their hardware
drivers - no matter how tempting. First - how do you know what hardware
you have in your computer? Invoice or if it is up and working now - take
inventory:

Belarc Advisor
http://belarc.com/free_download.html

EVEREST Home Edition
http://www.lavalys.com/products/download.php?pid=1&lang=en

Once you know what you have, what next? Go get the latest driver for your
hardware/OS from the manufacturer's web page. For example, let's say you
have an NVidia chipset video card or ATI video card, perhaps a Creative
Labs sound card or C-Media chipset sound card...

NVidia Video Card Drivers
http://www.nvidia.com/content/drivers/drivers.asp

ATI Video Card Drivers
http://www.atitech.com/support/driver.html

Creative Labs Sound Device
http://us.creative.com/support/downloads/

C-Media Sound Device
http://www.cmedia.com.tw/e_download_01.htm

Then install these drivers. Updated drivers are usually more stable and
may provide extra benefits/features that you really wished you had before.

As for Service Pack 2 (SP2) for Windows XP, Microsoft has made this
particular patch available in a number of ways. First, there is the
Windows Update web page above. Then there is a direct download site
and finally, you can order the FREE CD from Microsoft.

Direct Download of Service Pack 2 (SP2) for Windows XP
http://snipurl.com/8bqy

Order the Free Windows XP SP2 CD
http://snipurl.com/8umo


Tip (9):
What about the dreaded word in the computer world, VIRUS?

Well, there are many products to choose from that will help you prevent
infections from these horrid little applications. Many are FREE to the
home user. Which one you choose is a matter of taste, really. I wouldn't
list one here I had not personally used - and they all work. Many people
have emotional attachments or performance issues with one or another
AntiVirus software. Try some out, read reviews and decide for yourself
which you like more:

Symantec (Norton) AntiVirus (~$11 and up)
http://www.symantec.com/nav/nav_9xnt/

Kaspersky Anti-Virus (~$49.95 and up)
http://www.kaspersky.com/products.html

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

AVG Anti-Virus System (Free and up)
http://www.grisoft.com/

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

AntiVir (Free and up)
http://www.free-av.com/

avast! (Free and up)
http://www.avast.com/

Trend Micro (~$49.95 and up)
http://www.trendmicro.com/en/home/us/personal.htm
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/

Most of them have automatic update capabilities. You will have to
look into the features of the one you choose. Whatever one you finally
settle with - be SURE to keep it updated (I recommend at least daily) and
perform a full scan periodically (yes, it protects you actively, but a
full scan once a month at 4AM probably won't bother you.)


Tip (10):
The most rampant infestation at the current time concerns SPYWARE/ADWARE.
I hate this stuff. It has no purpose. I have seen people try to justify
it over and over - it's worthless. It slows down your PC, it can send
your private information to people you'll never meet and did I mention,
it's worthless. You need to eliminate it from your machine.

If you use P2P software, this COULD make that stop working. Find some
decent software to do the same thing - what you are currently using is
crap.

Anyway - there is no one software that cleans and immunizes you against
everything. Antivirus software - you only needed one. Firewall, you
only needed one. AntiSpyware - you may need several. I have a list and
I recommend you use at least the first 5. I know that sounds like a lot,
and you may be saying "But you said earlier that I should clean my system,
now you are telling me to install more software - 5 pieces in fact!" Okay,
I get your point, but please consider that this stuff has prevented the
install of the latest service pack for some people, it has the potential
to slow and crater your PC, it can send your private information around
the world to people you do not know - it is all around BAD.

First - make sure you have NOT installed "Rogue AntiSpyware". There are
people out there who created AntiSpyware products that actually install
spyware of their own! You need to avoid these:

Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Also, you can always visit this site..
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.

Then, my suggestion again is that you at least install the first five of
these: (Install, Run, Update, Scan with..)

Lavasoft AdAware (Free and up)
http://www.lavasoft.de/support/download/
(How-to: http://snipurl.com/atdn )

Spybot Search and Destroy (Free!)
http://www.safer-networking.net/en/download/index.html
(How-to: http://snipurl.com/atdk )

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/
(How-to: http://snipurl.com/ate3 )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html
(How-to: http://snipurl.com/ate6 )

IE-SPYAD (Free!)
https://netfiles.uiuc.edu/ehowes/www/resource.htm
(How-to: http://snipurl.com/ate7 )

CWShredder (Free!)
http://www.softbasket.com/download/s_8114.shtml

Hijack This! (Free)
http://mjc1.com/mirror/hjt/
( Tutorial: http://hjt.wizardsofwebsites.com/ )

ToolbarCop (Free!)
http://windowsxp.mvps.org/toolbarcop.htm

Browser Security Tests
http://www.jasons-toolbox.com/BrowserSecurity/

Popup Tester
http://www.popuptest.com/

The Cleaner (49.95 and up)
http://www.moosoft.com/

If used properly, you should have a malware free system now. The last
two of the first five I suggest you install are immunization applications.
None of these programs (in these editions) run in the background unless you
TELL them to. The space they take up and how easy they are to use greatly
makes up for any inconvenience you may be feeling.

Unfortunately, although that will lessen your popups on the Internet/while
you are online, it won't eliminate them. I have looked at a lot of options,
seen a lot of them used in production with people who seem to attract popups
like a plague, and I only have a few other suggestions that should help.
This
one ends up serving double duty (search engine and popup stopper in one):

The Google Toolbar (Free!)
http://toolbar.google.com/

Yeah - it adds a bar to your Internet Explorer - but its a useful one. You
can search from there anytime with one of the best search engines on the
planet (IMO.) And the fact it stops most popups - wow - BONUS! If you
don't like that suggestion, then I am just going to say you go to
www.google.com and search for other options.

Please notice that Windows XP SP2 does help stop popups as well.

Another option is to use an alternative Web browser. I suggest
"Mozilla Firefox", as it has some great features and is very easy to use:

Mozilla Firefox
http://www.mozilla.org/products/firefox/

One more suggestion is to disable your Windows Messenger service. This
service is not used frequently (if at all) by the normal home user and
in cooperation with a good firewall, is generally unnecessary. Microsoft
has instructions on how to do this for Windows XP here:

http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp


So your machine is pretty clean and up to date now. If you use the sections
above as a guide, it should stay that way as well! There are still a few
more
little things you can do to keep your machine running in top shape.


Tip (11):
You should periodically check your hard drive(s) for errors and defragment
them. Only defragment after you have cleaned up your machine of
outside parasites and never defragment as a solution to a quirkiness in
your system. It may help speed up your system, but it should be clean
before you do this.

How to use Disk Cleanup
http://support.microsoft.com/?kbid=310312

How to scan your disks for errors
http://support.microsoft.com/?kbid=315265

How to Defragment your hard drives
http://support.microsoft.com/?kbid=314848

I would personally perform the above steps at least once every three months.
For most people this should be sufficient, but if the difference you notice
afterwards is greater than you think it should be, lessen the time in
between
its schedule.. If the difference you notice is negligible, you can increase
the time.


Tip (12):
SPAM! JUNK MAIL!
This one can get annoying, just like the rest. You get 50 emails in one
sitting and 2 of them you wanted. NICE! (Not.) What can you do? Well,
although there are services out there to help you, some email
servers/services that actually do lower your spam with features built into
their servers - I still like the methods that let you be the end-decision
maker on what is spam and what is not. I have two products to suggest to
you, look at them and see if either of them suite your needs. Again, if
they don't, Google is free and available for your perusal.

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

As I said, those are not your only options, but are reliable ones I have
seen function for hundreds+ people.


Tip (13):
ADVANCED TIP! Only do this once you are comfortable under the hood of your
computer!

There are lots of services on your PC that are probably turned on by default
you don't use. Why have them on? Check out these web pages to see what all
of the services you might find on your computer are and set them according
to
your personal needs. Be CAREFUL what you set to manual, and take heed and
write down as you change things! Also, don't expect a large performance
increase or anything - especially on today's 2+ GHz machines, however - I
look
at each service you set to manual as one less service you have to worry
about
someone exploiting. A year ago, I would have thought the Windows Messenger
service to be pretty safe, now I recommend (with addition of a firewall)
that most home users disable it! Yeah - this is another one you have to
work for, but your computer may speed up and/or be more secure because you
took the time. And if you document what you do as you do it, next time, it
goes MUCH faster! (or if you have to go back and re-enable things..)

Task List Programs
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Black Viper's Service List and Opinions (XP)
http://www.blackviper.com/WinXP/servicecfg.htm

Processes in Windows NT/2000/XP
http://www.reger24.de/prozesse/

There are also applications that AREN'T services that startup when you start
up the computer/logon. One of the better description on how to handle these
I have found here:

Startups
http://www.pacs-portal.co.uk/startup_content.php


If you follow the advice laid out above (and do some of your own research as
well, so you understand what you are doing) - your computer will stay fairly
stable and secure and you will have a more trouble-free system.
 
@ NoSpam.net said:
I've scanned with Ad-Aware and Spybot till my pinkies are sore and
nothing comes up except a cookie or two. What else do I need to do to
eliminate popups?

Desperate.

Go to: http://mvps.org/winhelp2002/unwanted.htm
Download "Hijack This!" [freeware]

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic" and post a description of your symptoms. If they need to
see your log they will ask for it.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
 
It depends on what kind of popups you're talking about. There are tons of
sites that have advertising popup windows that have nothing to do with
hijackware. If that's your problem, get a popup blocker, or upgrade to
Windows XPSP2.

If you're ambitious and have some time on your hands, write to the companies
advertising this way and tell them that you will not buy their products
because their popup windows annoy you.

And it goes without saying to never, ever buy a product that was advertised
in this manner.
 
Hi Dave - There are currently two classes of things going on that are
causing people popup difficulties. If you get popups even when your browser
is not connected to the Internet with a title bar reading "Messenger
Service", then these are most likely due to open NetBios TCP ports 135, 139
and 445 and UDP ports 135, 137-138 and a UDP port in the range of
1026-1029.. You really need to block these with a firewall as a general
protection measure. You can stop the popups by turning off Messenger
Service; however, this still leaves you vulnerable. If you have an NT-based
OS such as XP or Win2k, you should probably also specifically block TCP
593, 4444 and UDP 69, 139, 445, and install the very important 824146 patch
from MS03-039, here: http://support.microsoft.com/default.aspx?kbid=824146
to block the Blaster worm as well as several other parasites.


See: Messenger Service Window That Contains an Internet Advertisement
Appears http://support.microsoft.com/?id=330904 which identifies reasons to
keep this service and steps to take if you do.

You can test your system and follow the 'Prevention' link to get additional
information here:
http://www.mynetwatchman.com/winpopuptester.asp Unless you have very good
reasons to keep this active, it should be turned off in Win2k and XP. Go
here and do what it says:
http://www.itc.virginia.edu/desktop/docs/messagepopup/ or, even better, get
MessageSubtract, free, here, which will give you flexible control of the
service and viewing of these messages:
http://www.intermute.com/messagesubtract/help.html Recommended.

(FWIW, ZoneAlarm's default Internet Zone firewall configuration blocks the
necessary ports to prevent this use of Messenger Service. I don't know the
situation with regard to other firewalls.)

Messenger Service is not per se Spyware or something that MS did wrong - It
provides a messaging capability which is useful for local intranets and is
also sometimes (albeit nowdays infrequently) used by some applications to
provide popup messages to users. However, it can also be (and now frequently
is) used to introduce spam via this open NetBios channel. For a single user
home computer, it normally isn't needed and can be turned off which will
eliminate the spam popups. This DOESN'T, however, remove the vulnerability
of having these ports open, when in fact they aren't needed, since they can
be perverted in other ways as well, some of which can be much more damaging
than just a spam popup.



If you're getting a lot of popups while surfing, then the following may be
useful:

#########IMPORTANT#########
Before you try to remove spyware using any of the programs below, download
both a copy of LSPFIX here:

http://www.cexx.org/lspfix.htm

AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257

or here for Win2k/XP http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm

The process of removing certain malware may kill your internet connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
to regain your connection.

NOTE: It is reported that in XP SP2, the Run command netsh winsock reset
will fix this problem without the need for these programs. (You can also
try this if you're on XP SP1. There has also been one, as yet unconfirmed,
report that this also works there.) Also, one MS technician suggested the
following sequence:

netsh int reset all
ipconfig /flushdns

See also: http://windowsxp.mvps.org/winsock.htm for additional XPSP2
info/approaches using the netsh command.
#########IMPORTANT#########



#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is fixed
after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

Clean Boot - General Win2k(if w/msconfig)/XP procedure, but see below for
links for other OS's:
1. Start|Run enter msconfig.
2. On the General tab, click Selective Startup, and then clear the Process
System.ini File, Process WIn.ini File, and Load Startup Items check boxes.
Leave the boot.ini boxes however they are currently set.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.

For additional information about how to clean boot your operating system,
click the following article numbers to view the articles in the Microsoft
Knowledge Base:
310353 How to Perform a Clean Boot in Windows XP
http://support.microsoft.com/kb/310353
281770 How to Perform Clean-Boot Troubleshooting for Windows 2000
http://support.microsoft.com/kb/281770/EN-US/
267288 How to Perform a Clean Boot in Windows Millennium Edition
http://support.microsoft.com/kb/267288/EN-US/
192926 How to Perform Clean-Boot Troubleshooting for Windows 98
http://support.microsoft.com/kb/192926/EN-US/
243039 How to Perform a Clean Boot in Windows 95
http://support.microsoft.com/kb/243039/EN-US/
#########IMPORTANT#########


Sometimes the tools below will find files which they are unable to delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
"replacing, moving, renaming or deleting one or many files which are
currently in use (e.g. system files like comctl32.dll, or virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem



Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from the link
on this page: http://vil.nai.com/vil/stinger/ ME/XP users be sure to read:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm


Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, here: http://www.trendmicro.com/download/pattern.asp Be sure to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might also want
to get Art's updater, SYS-UP.Zip, here for future updating of these:
http://home.epix.net/~artnpeg/). (If you download and use the updater from
the beginning, it will automatically handle downloading the other files.)
Place them in a dedicated folder after appropriate unzipping. Show hidden
and system files (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
Disable Restore if you're on XP or ME (directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then boot to
Safe mode (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
Read tscreadme.txt carefully, then do a complete scan of your system
in Safe mode and clean or delete anything it finds. Reboot to normal mode
and re-run the scan again.

This scan may take a long time, as Sysclean is VERY extensive and thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.



Popups - The best way to start is to get Ad-Aware SE Personal Edition, here:
http://www.lavasoftusa.com/support/download/. UPDATE, set it up in
accordance with this: http://forum.aumha.org/viewtopic.php?t=5877 and run
this regularly to get rid of most "spyware/hijackware" on your machine. If
it has to fix things, be sure to re-boot and rerun AdAware again and repeat
this cycle until you get a clean scan. The reason is that it may have to
remove things which are currently "in use" before it can then clean up
others. configure Ad-aware for a customized scan, and let it remove any bad
files found.....

Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click the gear
wheel at the top and check these options to configure Ad-aware for a
customized scan:

General> activate these: "Automatically save log-file" and "Automatically
quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes",
"Scan registry", "Deep scan registry," "Scan my IE Favorites for banned
sites," and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during
scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister
objects prior to deletion" and "Let Windows remove files in use after
reboot."

Click "Proceed" to save your settings, then click "Start." Make sure
"Activate in-depth scan" is ticked green, then scan your system. When the
scan is finished, the screen will tell you if anything has been found, click
"Next." The bad files will be listed. Right click the pane and click "Select
all objects" - This will put a check mark in the box at the side, click
"Next" again and click "OK" at the prompt "# objects will be removed.
Continue?"

Courtesy of http://www.nondisputandum.com/html/anti_spyware.html: HINT: If
Ad Aware is automatically shut-down by a malicious software, first run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe, before
opening Ad Aware. When AAWCloak is open, click "Activate Cloak". Than open
Ad Aware and scan your system.



Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. Update before starting, then after fixing ONLY RED
things with SpyBot S&D, be sure to re-boot and rerun SpyBot again and repeat
this cycle until you get a clean "no red" scan. The reason is that SpyBot
sometimes has to remove things which are currently "in use" before it can
then clean up others.

Then, there are a variety of third party "Popup Killers" available. I
normally use AdShield, which, if you maintain its Block List every now and
then, almost totally stops this. In addition, it stops a variety of
ads/banners/etc. (particularly spyware like doubleclick) on pages I access.
This is probably all you'll need; however, I've also investigated a program
called webwasher which appears to be very good, but decided that AdShield
was sufficient. At the bottom of this post, you'll find a list provided
courtesy of bc_acadia of a number of free popup blockers with links.

****** NOTE: As of 28 Apr 03 AdShield appears to have partnered with a new
reseller, and AdShield is no longer free. There is a trial version of
AdShield3; however, IMO it is seriously crippled in not being able to import
or export block lists and I think for reasonable utility one would have to
go to the full version. While I don't normally recommend non-free software,
I personally will continue to use AdShield3, since I think it is the best
currently available combined Popup/Ad/Malware blocker, but you should be
aware of the fact that it now costs, ($29.95), whereas the earlier versions
upon which I based my original recommendation were free, although not nearly
as capable as the AdShield3 release. I've included below links to both the
older free version and the new paid version. You'll have to investigate and
make your own choice in the matter. *******

Here are a number of AdShield-related links:

http://www.fsd1.org/technology/Files/AdShield.exe - AdShield1.2 (free)
http://www.internettechs.net/utilities/AdShield.exe - AdShield1.2 (free)
http://ftp.ural.ru/home/index/windows/networking/utils/AdShield -
AdShield1.2 (free)
http://www.megalog.ru/info/utilz/AdShield.zip - AdShield1.2 (free)
http://www.allstarss.com/store/adshield.html - AdShield3
http://www.ad-shield.com/ AdShield3 Info/Purchase/Block List
http://www.mvps.org/winhelp2002/block.txt - (Mike Burgess' .txt Block List
for AdShield - Recommended)
http://www.mvps.org/winhelp2002/block.zip - Mike Burgess' Zipped Block List
for AdShield - Recommended)

http://www.songwave.com/software/adshield_blocklist.txt (40,000 pornsites
blocked - *VERY* large list - use at your own risk)
http://www.chrismyden.com/temp/block.abl (chrismyden's blocklist in .abl
format - Recommended)
http://www.staff.uiuc.edu/~ehowes/resource.htm#AdShield (Eric Howes AGNIS
for AdShield block list - Recommended) (BTW, Eric's site contains a wealth
of very valuable information about all aspects of net security - Very Highly
Recommended)


Here's a good AdShield test site, courtesy of siljaline: "Make ***SURE***
you have your block scripted popups enabled
http://www.mediaboy.net/1010100-1100001-1111010/gahk/>>>> [Warning this URL
opens a multitude of Browser windows almost instantly - YOU'VE BEEN
WARNED!]"

http://www.webwasher.com - Webwasher


For WinXP users, Service Pack 2 has a built-in popup stopper which at first
look appears to be fairly effective.


Additionally, some people have recommended Popup Stopper and PopupBuster,
but they have also been reported or experienced to cause perceived problems
for some people with "normal" links in IE6 such as Google search results and
links from OE. Some proponents of PopupBuster assert, however, that this is
normal operation for this program under certain circumstances which can be
overridden if necessary. YMMV Another "Proxy" type blocker similar to
Webwasher and Proxomitron but supposedly a bit easier to configure is
Privoxy here: http://www.privoxy.org/

Also, the free Google Tool Bar has a builtin popup blocker which is fairly
effective.


A very clever alternative approach to general ad (vice Popup) blocking is
outlined here:
http://www.sherylcanter.com/articles/oreilly_20040330_HostsPac.php
and here: http://s91363763.onlinehome.us/BlackHoleProxy/index.html
The approach is similar to that used in eDexter, but improved. I've tried
it, and it does work as advertised. (<groan> - sorry 'bout that!) :)
Probably should only be considered by more knowlegable users, as it's a
little complicated to set up using the directions given if you don't already
know a bit. (It also has some tendency to block some things you'd rather it
didn't at times if PAC files are used instead of the HOSTS file due to its
use of regular expressions for blocking definitions without some tuning.)


There is additonal information about setting up and using AdShield, and
about using the Restriced Zone (and an additional list) here:
http://www.mvps.org/winhelp2002/hosts.htm

Lastly, ZoneAlarmPro3/4 has added provisions for stopping adds/popups,
handling cookies, web bugs, and scripting/ActiveX components in addition to
it's firewall functionality. Not free, but I have used it with my other
AdBlocking stuff (AdShield, etc.) turned off as a test, and it appears to be
very good indeed. So far I've experienced no problems at all with it set in
its High Security modes for Ads although others have reported the need to
temporarily turn it off to reach some sites. Also, Agnitum's Outpost
Firewall supports a plug-in for this: "Pre-configured to block most banner
advertisement. Can be configured manually or by simply dragging and dropping
unwanted banners into the Ad Trashcan." I have no experience as to how
effective it is, but I have received a favorable report.

There's good information about hijacking in general and fixes available for
specific hijackers here: http://spywareinfo.com/articles/hijacked/
http://gmpservicesinc.com/Articles/hijack.asp
http://www.mvps.org/inetexplorer/Darnit.htm#pop_up
http://www.doxdesk.com/parasite/

bc_acadia's list:

"Some popup blockers. All of these are 100% pure freeware, no trial
periods. Some of these do more than just handle popups.

Pow!: http://www.analogx.com/contents/download/network/pow.htm
NoAds: http://www.southbaypc.com/NoAds/
PopupEraser: http://www.webknacks.com/popuperaser.htm
Stop-the-Pop: http://www.bysoft.se/sureshot/stopthepop/index.html
Internet Organizer: http://www.sf.yucom.be/wdprojects/
PopKi: http://ranfo.com/popki.html
PopUpKiller: http://sourceforge.net/projects/puk/
AdCruncher Proxy:
http://mysite.verizon.net/~mr_fish/AdCruncher/ReadMe.html
KillAd: http://www.iomagic.org/fsc/
ClickOff: http://www.johanneshuebner.com/en/download.html
PopupBuster: http://www.popupbuster.com/PopUpBuster/
Free Surfer: http://www.kolumbus.fi/eero.muhonen/FS/
Window Shades: http://www.g-m-m.com/Software/WindowShades/index.php
AdShield (my personal favorite): http://www.ad-shield.com/
PopupStopper: http://www.panicware.com/popupstopper.html
Proxomitron (Is no longer supported and has a learning curve):
http://www.proxomitron.org/
For those who don't want third party stuff, your own pc's built-in
host file:
http://www.mvps.org/winhelp2002/hosts.htm and
http://www.accs-net.com/hosts/


Here is a review of 61 popup killers, not all of them are free:
http://www.popup-killer-review.com/index.htm"

NOTE that this site also contains a good, comprehensive series of popup
killer tests. Some good additional tests are also available here:
http://www.webknacks.com/aptest.htm


There's another popup test page here:
http://www.kephyr.com/popupkillertest/index.html


Another good test page and lists of both free and cost popup blockers is
here: http://www.popuptest.com/ Recommended

An excellent test site here: http://www.popupcheck.com/ Highly
Recommended.

Another list of some popup blockers:
http://www.messaging-software.net/popup-killer-software.htm

If you install and keep UPDATED a good HOSTS file, it can help you avoid
most adware/malware. See here: <http://www.mvps.org/winhelp2002/hosts.htm>
(Be sure it's named/renamed HOSTS - all caps, no extension)



You might want to consider installing Eric Howes' IESpyAds, SpywareBlaster
and SpywareGuard here to help prevent getting this kind of adware/malware in
the future:

IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm "IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of Internet
Explorer. Once you merge this list of sites and domains into the Registry,
the web sites for these companies will not be able to use cookies, ActiveX
controls, Java applets, or scripting to compromise your privacy or your PC
while you surf the Net. Nor will they be able to use your browser to push
unwanted pop-ups, cookies, or auto-installing programs on your PC." Read
carefully.

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
load - but keep it UPDATED) The latest version as of this writing will
prevent installation or prevent the malware from running if it is already
installed, and it provides information and fixit-links for a variety of
parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. All three Very Highly Recommended

Perhaps these will help.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
@ NoSpam.net said:
I've scanned with Ad-Aware and Spybot till my pinkies are sore and
nothing comes up except a cookie or two. What else do I need to do to
eliminate popups?

Desperate.


No malware or spyware scanner is going to get rid of popups (except for
crapware that happens to use them) since the popups are from the site
you visit with your browser. If your browser doesn't have options to
eliminate popups, and you didn't upgrade to Windows XP Service Pack 2
(assuming you have Windows XP since you never mentioned anything of your
computing environment), then get a 3rd party popup blocker. Google
Toolbar is free as is the Yahoo Companion toolbar. PopUpCop is much
better but costs $20 after the trial period.
 
Back
Top