Topic: Whats with the pop ups?

[Dash Jones]

Purity scan must be running from a program.

I quote from http://66.218.71.225/search/cache?p=Purity+scan+&ei=UTF-8&cop=mss&u=www.miami.com/mld/miamiherald/business/columnists/tim_henderson/4685408.htm%3Ftemplate%3DcontentModules/printstory.jsp&w=purity+scan&d=292A07A803&c=482&yc=16279&icp=1

Quote:


 That appears to be a virus-like advertising program that can be smuggled onto your computer with a program called Purity Scan, which purports to search your hard drive for ''offensive'' material and delete it. To give Purity Scan its due, it appears to disclose the fact that you'll be bombarded with advertising as a condition of using the program. But it puts it in the text of a license agreement that's long, hard to understand and easy to skip over.

If you want to fix it yourself, you can look for a reference to ''winservs.exe'' in your Startup folder and delete it. If all else fails, run the uninstaller program from clickspring, by following the link to ''opt out of interstitial advertising'' (!) at www.clickspring.net/cspop4/frame.html

AFTER disabling it in the Startup, reboot the computer, make sure it's still disabled in startup (via msconfig), then make sure the program is not running in the background (ctrlaltdelete to see if it's running).  Next go and search it out as well as it's code names on your file database, and finally, regedit it.

NOW be aware, that it might not be Purity Scan, there are 500 different programs that claim that they are in someway connected to Purity Scan...

Now if it is affecting your IRC in anyway, it's probably that it may be a different program.  Look in your registry for the Win file in the exe that is connected to the popups.  Good Luck...

I'm betting there's a program that you don't recognize and is not included in Windows that is running or placed in either a system or Windows system folder...Good Luck figuring out which one.

However, one way sometimes is to find the symbol that doesn't belong.  Some trojans actually have icons that are unique to them...if you try this, be sure to have a backup, as you could screw yourself over if you do not...then happy deletions!

[TheBigCheese]

Is it me or does anyone else get pop ups when browsing the Taldren Forums?  

*edit Hell its not Taldren I'm getting it everywhere and I have messenger turned off  

[LongTooth]

Dump your temp internet files/cookes that should solve it
you might want to look in  to getting adaware its a great little program for stoping that type of stuff plus its one
of thoes free trial program's where it dont run out after 30 days  

[Scott Allen Abfalter]

Yeah, it's not Taldren that is popping them up.  It must be a piece of hijack-are.   Get SpyBot or AdAware (free) to clean it out.
 

[TheBigCheese]

Spybotted and it is still doing it

I looked on task manager and shut down some program that was causing it  

[Scott Allen Abfalter]

Might be new.  

I run both SpyBot and AdAware.  There are some things that one catches that the other does not, and vis versa.

 

[JMM]

I sometimes got it, but I was using Win ME, now that I have Win XP, NO MORE POP UPS! Rocks the house!    

[Lurker]

Quote:
I sometimes got it, but I was using Win ME, now that I have Win XP, NO MORE POP UPS! Rocks the house!    

Glad to see the upgrade went well    

[TheBigCheese]

ME  
XP    

[JMM]

Yeah Lurker, I'm in hog heaven now, even though Dell P3 still suck! Vicky's nephew studies programming at the university here, and he just so happened to have Win XP in English. BTW, the next generation of Mexicans are gonna be exactly our kind of people, computer savvy, highly intelligent of world affairs and the nation, and best of all, BILINGUAL!

Man, why do I have to be a 37 y.o. disabled vet? I wanna be 26 again and be able to use my Army College Fund here, so many gorgeous women, so little time, hehehehehehe.    

[Dash Jones]

Quote:
ME  
XP    

I suspect it's actually your WinXp that is causing the popups to be harder to detect.

However...It's not from Taldren.  More than likely you were browsing certain unnamed sites.

These sites are on the very edge of the spyware/hijackingware trojan horses...and can d/l items to you without your knowledge.  I did a search on my aunts machine, and even before spybot and adaware found the items...I found around 200 different programs in the System folder.

First off, this is easier to find in a 9x system, but if you know XP really well, and know EXACTLY what you need to run and not crash XP this is the FIRST method to stopping those popups...even if the trojan is new enough to NOT yet be detected by spyware or Adaware.

First, as stated above, empty your internet cache.  Also make sure that ANY d/l'ed cookies are gone.

Next, DOUBLECHECK.  There was a nasty trojan a little while ago that would NOT delete out of the temporary internet folder.  You manually had to remove it.  Go to Folders, and explore the folders in the Temporary Internet Files Folder.  Delete ANYTHING YOU SEE.

Next, go to the View Objects, If you know what the objects do keep them, if not...it's pretty safe to delete just about EVERYTHING in there, you just might lose some temporary usage of internet quirks that you'll need to redownload.

Now you are ready to actually start the trojan hunt.

In a Win9x system, it would be easy to hit ctrl-alt-delete, note any programs that are running besides sys and explorer, and look them up on the web, and delete those that are not needed or recognized.

Unfortunately, you have XP.  First, close all applications.  If any appear that you haven't started yourself (hence bootup is a good time to do a ctrl-alt-delete so you know you haven't started anything) note the name of the file, and then close the application.

Next go to Processes.  XP needs half a dozen to a dozen of these...this is where you better know XP.  The thing you need to do is differentiate between the needed files of XP and the files which are not needed.  Note, that your card is listed here...SOOOO, you probably don't want to go around deleting drivers.  I'm not on the Ati machine right now, otherwise I could give you a run down of the files that go with Ati as well as XP...sorry).

However, you need to end the processes that are going on that are NOT necessary or recognized by you.  IT IS MOST PROBABLE THESE ARE CAUSING THE POPUPS.  You delete these, and the popups should stop...unless you did something REALLY STUPID and installed a new taskbar from a porn site or something...in which case it will soon be uninstallation time.

Now, once the processes are stopped, that will temporarily stop the popups...BUT it won't stop the program permanently, it is still there.

Next, go back and make sure the cache and all the internet stuff is still clean.

Next, do a search of the system for ALL the programs that you found running that weren't approved by you.  Most likely you will have one or two in the actual Windows system folder under official sounding names such as Windowsregfile.exe, or other such things.  A popular thing to do now is to disguise files in the system folder under such titles.

Find and delete these.

Another way to check, as long as you haven't installed anything today, and know when the popups started, as long as you didn't install anything on that date, look for files on your computer that were created on THAT DATE.  YOu must be careful as Windows creates one or two files that are also like that, but other than that...almost ANY PROGRAM if you did not install or create it, is a trojan.

Once you have done this process, go to the registry...do a search for those terms.  This is the really tricky part, because you should really know your registry well.  Delete unnecessary files with those names, and references to the sites that the trojans bring to.

Do this all again to make sure the computer is clear.

I'd suggest you also do a scan with Housecall, a free virus scanner which sometimes catches items that Adaware and Spybot do not.

Be aware that sometimes it detects a trojan, but doesn't correctly identify it, because the trojan is an offshot of another one's programing to help avoid the current adaware and spybot updates...but the detection will STILL point you in the right direction.

This is a big hassle, I know.  Sorry, but it's the best way I know of.

Or you could wait two weeks to a month for an update to adaware or Spybot that will find the problem for you.

Now if you did do something like install a taskbar...I've already typed a lot out here, and I'm tired and sleepy...so good luck...perhaps I'll cover it later, perhaps not, but to make a long item short, simply uninstall the taskbar and try to continue doing the things stated above.

[Lurker]

Some good advice there. Your not using Kazaa instead of Kazaa lite are you? The standard Kazaa is packed with crappy adware stuff.  

[jualdeaux]

I run XP Pro and I have no problem with pop-ups at all. One of the things I do is go to msconfig and go to the startup tab and see what is set to automatically start. if I know what the program is, like the qtask one, I just uncheck it and it won't startup at bootup. If you know a bit more you can hit the services tab and change some settings there. Two final things, make sure you are using a good, configurable firewall and get another browser that has a builtin pop-up blocker. My preference is the Mozilla Firefox 0.8 browser.

[Dash Jones]

Quote:
I run XP Pro and I have no problem with pop-ups at all. One of the things I do is go to msconfig and go to the startup tab and see what is set to automatically start. if I know what the program is, like the qtask one, I just uncheck it and it won't startup at bootup. If you know a bit more you can hit the services tab and change some settings there. Two final things, make sure you are using a good, configurable firewall and get another browser that has a builtin pop-up blocker. My preference is the Mozilla Firefox 0.8 browser.  

Good advice, I meant to include that as one of the steps, but it skipped my mind...so this actually needs to be done as well.

As for XP and popups, it's not that you are more likely to get them, it's just harder to clear them out overall, especially some of the newer spyware materials that have been coming out in the past 6 months.

There are still a few out there that cannot be caught by spybot or adaware after half a year!

I believe some of the virus programs (like Norton) close some of those gaps though, but like housecall sometimes id the items wrongly so only doing a partial removal.

PS:  Good Luck at getting all of them off!

[TheBigCheese]

Found the nasty....Purity scan

but I have tried everything to get rid of it  

no ****ing luck  

[Javora]

Quote:
Found the nasty....Purity scan

but I have tried everything to get rid of it  

no ****ing luck  

Have you tried HijackThis?  If I can think of anything else I'll post.  Hope this helps.
 

[Sethan]

Cheese - it would help if you post what you tried.

[TheBigCheese]

All of the suggestions above.

all the adware stoppers

norton antivirus

everything points to Purityscan but it is almost impossible to remove  

[Sethan]

Try  this.  

[TheBigCheese]

done that already