Problem with popups and ads..

Hi XeroChaos245.  Read the post at the top of the forum posted by Chris RLG.

http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=572

You can also possibly solve some of the problems by getting CWShredder and using that tool.

CWShredder direct download: http://216.180.233.153/~merijn/files/CWShredder.exe

Also, along with the other links provided, if you trust Spybot(and who dosen't?), there is a host blocking feature too. Follow these steps:

Open Spybot, in advanced mode/click Tools/click Load Spybot hosts list.

This may take several minutes,depending on your connection.

Good luck, and remember.................you can NEVER be OVERPROTECTED!

Stopping ads and other unwanted nasties with the HOSTS file:

All about using the HOSTS file for ad blocking http://www.accs-net.com/hosts/ 

A good HOSTS file http://www.mvps.org/winhelp2002/hosts.htm

A great HOSTS file http://webpages.charter.net/hpguru/hosts/hosts.html

Oh so Yokenny should i dl all of them or just 1 of the 3 you listed and do you know what this possibly might be ?

Oh and also if you guys can help me in this forum...i can't install norton antivirus because it saids i have another version of it in my computer...but i cant find it in my computer i checked all over my computer do you know what place it usually goes?Also Corporate addition tries to install but then it just dissapears while it saids ''please wait while norton antivirus corporate edition...something something''Anyone know where its located and thanks for the help im going to try the hosts file..

Arg the hosts file didnt work ......it stills has ads here...=/ can i do anything else?

Please be more specific than "did not work."    We don't know what operating system you are using and you don't offer any clues. 

What operating system are you using? Have you applied ALL Critical Updates?

What is the Web site causing the ads?  

What do the ads look like?  

Do they appear by themselves?

There are several ways that ads can be delivered to you and the HOSTS file covers only one way.

Message Edited by YoKenny on 01-31-2004 04:59 PM

I suggest you post a hijackthis log for us to check, either YoKenny or I will then give some advice.

By the way, the hardware that you purchased (that you listed) is not the operating system, that would probably be windows XP home or pro.

Below is details of how to do a hijackthis log for us to view.
------------------------
A post of a hijackthis log for the experts to advise.
HijackThis From Here
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary. Then run, scan, save log, then in notepad copy the FULL log by copy and paste as a reply to this post and an expert with HijackThis Knowldge, will have a go at giving advice. Please note the list of experts names below, very few forum regulars here have had this training.

DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.

Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.

TomCoyote (of http://tomcoyote.org/forums/index.php fame)
YoKenny (Accredited Expert at TomCoyotes)
baskar1234 (Spyware Classroom Teaching Assistant at TomCoyotes)
ChrisRLG (Spyware Classroom Teaching Assistant at TomCoyotes)
Yellowhammer (In Training at TomCoyotes)
therock247uk (In Training at TomCoyotes)
irelynmisses (In Training at TomCoyotes)

You could also go to one of the more specalist forums where more experts will be able to help.
http://tomcoyote.org/forums/index.php
http://forums.spywareinfo.com/index.php
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi (Home of Spybot S&D)
http://boards.cexx.org/index.php
Do read the sites FAQ before posting, and advise your problem and what steps you have already done to try to cure your problem.

I, and the other hijack experts mentioned above, are in all those sites (and more) with the same login names. You might get one of us at those sites also to anwser your log, but other experts will also be available.

Oh shoot how stupid of me...well yeah thanks I have Windows xp home...and uh heres my Hijackthis log...

Logfile of HijackThis v1.97.7
Scan saved at 8:29:34 PM, on 1/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\uartzq.exe
C:\WINDOWS\System32\SLC.exe
C:\WINDOWS\System32\CPSVCST.exe
C:\WINDOWS\System32\INPUT8D.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\gfxhfini.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nytimes.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway
O1 - Hosts: ‰?@³å³c÷1‚çÅHDœ6'—†Æä‚{jµ~�bXQ)# –Émì’Fv“HóÄ>NSlçöI«
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [uartzq] C:\WINDOWS\System32\uartzq.exe
O4 - HKLM\..\Run: [SLC] C:\WINDOWS\System32\SLC.exe
O4 - HKLM\..\Run: [CPSVCST] C:\WINDOWS\System32\CPSVCST.exe
O4 - HKLM\..\Run: [INPUT8D] C:\WINDOWS\System32\INPUT8D.exe
O4 - HKLM\..\Run: [gfxhfini] C:\WINDOWS\System32\gfxhfini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

XeroChaos your log has some entries that are unknown to me and could be causing the problem.  Also, the  last O16 entries are missing that are important as well if present.

Start HijackThis and tick the boxes next to all these, then close all browser and explorer windows, and tell HijackThis to "Fix checked".

O1 - Hosts: ‰?@³å³c÷1‚çÅHDœ6'—†Æ ä‚{jµ~�bXQ)# –Émì’Fv“HóÄ>NSlçöI«

O4 - HKLM\..\Run: [uartzq] C:\WINDOWS\System32\uartzq.exe
O4 - HKLM\..\Run: [SLC] C:\WINDOWS\System32\SLC.exe
O4 - HKLM\..\Run: [CPSVCST] C:\WINDOWS\System32\CPSVCST.exe
O4 - HKLM\..\Run: [INPUT8D] C:\WINDOWS\System32\INPUT8D.exe
O4 - HKLM\..\Run: [gfxhfini] C:\WINDOWS\System32\gfxhfini.exe
 
Then Reboot.

Your HOSTS file looks realy wierd!

O1 - Hosts: ‰?@³å³c÷1‚çÅHDœ6'—†Æ ä‚{jµ~�bXQ)# –Émì’Fv“HóÄ>NSlçöI«

I recommend using only the HOSTS file available at the MVP's Web site until you become more familiar with using the HOSTS file.  Follow the excellent directions there.

http://www.mvps.org/winhelp2002/hosts.htm

Your ads could probably be due to not running a firewall and are coming from Messenger Service spammers that are rampant these days.   I recommend ZoneAlarm.   For more information on firewalls, please read:

http://www.firewallguide.com/

It is very dangeous to be on the Internet today without a firewall and an anti virus application.

I use free AVG from Grisoft and they have a newer pay version.

http://www.grisoft.com/us/us_dwnl7.php

To get the most rewarding benefit and reduce frustration with your PC, you should invest some time in reading one of the excellent PC basic understaning books.   Windows ME for Dummies is very good and has structured lessons in how to get the most out of your PC.  Fifteen minutes a day spent reading this book will save days of frustration later.  It can be purchased at Amazon books for about $2.50 last time I looked.

Message Edited by YoKenny on 02-01-2004 09:43 AM