Internet explorer opening pop ups

N9eav

My internet explorer seems to be allowing web page pop ups.
Ther is a huge line of pages open at the bottom of the screen.
I have Zone alrm on. Pop up controls on and ran the spyware and anti-virus. Stilll does it. Any ideas?

Browntoa

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

N9eav

Browntoa, thanks. Did everything you sai and it ran perfectly and found 3 problems. 2 trojans and somthing else.

Trouble is I am still getting web page pop ups. Anything else I can do?

aliEnRIK

Can you please open Malwarebytes, goto LOGS and post the FULL log please?

then ~

Download SUPERANTISPYWARE (Click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_superantispyware/
UPDATE and COMPLETE scan

reboot

Download HIJACK THIS (Click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
reboot
SCAN and post the log so we can see whats running

Browntoa

the posts don't mention anything like CID as they come up ??

do you have a MSN add on called Messenger Plus ??

N9eav

Browntoa wrote: »

the posts don't mention anything like CID as they come up ??

do you have a MSN add on called Messenger Plus ??

CID? The latest pop up said Cid Utarget on the tab if that helps

Don't have messeger plus

Malwarebytes' Anti-Malware 1.34
Database version: 1894
Windows 5.1.2600 Service Pack 2
25/03/2009 07:15:59
mbam-log-2009-03-25 (07-15-59).txt
Scan type: Quick Scan
Objects scanned: 81335
Time elapsed: 14 minute(s), 59 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\!!549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Browntoa

look for a program called Messenger Plus on your add/remove program list

Messenger Plus! Live & Sponsor (CiD) (if you got Lop through a Messenger Plus! installation)

You'll be asked if you want to uninstall the full program or just the sponsor program (CiD).

Choose the sponsor program only if you want to just remove the adware. Alternatively, if you want to stick two fingers up to the developer of Messenger Plus and completely withdraw your support for a program that includes a trojan by default, uninstall both!!

or

Download nolop from here …..


http://www.spywareedge.net/nolop/NoLop.exe


save anything you are working on and prepare for a possible reboot …..

run nolop.exe…..

click the button "search and destroy"…..

when it's done it will prompt you to reboot if you are infected …..

click the "reboot" button.

Post the log which is saved to c:\nolop.log.

Browntoa

Next download ComboFix (either location will do) >

http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

http://www.techsupportforum.com/sect...s/ComboFix.exe

Double click combofix.exe & follow the prompts.

Note >> Do not mouseclick combofix's window while it's running. That may cause it to stall.

When finished, it will produce a log for you. The report is called ComboFix.txt.

aliEnRIK

that NOLOP links not the right one Browntoa

N9eav

Chaps. You were right. There was messegnger plus and sponsor on the program list. Must have been one of my kids.

How can they create such a program that has a real annoying web page opener.

I have deleted the lot and will see what happens.

Do I still need to run those other removal programs?

Or should I just buy a MAC

aliEnRIK

Trojans are not good and generally quite difficult to remove

Id certainly give Combofix a run at the very least

You also need to download and install SERVICE PACK 3 (security updates)