IE7 adware problem

Posted: 04-12-2007, 11:55 PM
When I start IE7 after awhile I get random ads that open a new instance of
IE7
Windoes one care was install and so called protecting when it happened
I have since installed McAfee and it doesn't find it
I've also tried difeerent spyware and adware products to no avail
Has anyone else had this problem or know a solution
thanks

IE7 adware problem


Responses to "IE7 adware problem"

pete
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-13-2007, 01:11 AM
IE7.........Tools............popup blocker............is it on??
peter
"Taz" <tom_snyder@hotmail.com> wrote in message
news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
> When I start IE7 after awhile I get random ads that open a new instance of
> IE7
> Windoes one care was install and so called protecting when it happened
> I have since installed McAfee and it doesn't find it
> I've also tried difeerent spyware and adware products to no avail
> Has anyone else had this problem or know a solution
> thanks
Taz
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-13-2007, 02:56 AM
yes it's not acting like a popup it's like starting another instance of
IE7
first flash command has login.revenue as part of the command that flashes
then it goes to a different ad
sometimes games, sometimes registry editor program, sometimes spyware ads
wanting you to download their product

"pete" <pete@nowhere.net> wrote in message
news:C86E3513-BF91-4FE8-9C8A-AF51691E6809@microsoft.com...
> IE7.........Tools............popup blocker............is it on??
> peter
> "Taz" <tom_snyder@hotmail.com> wrote in message
> news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
>> When I start IE7 after awhile I get random ads that open a new instance
>> of IE7
>> Windoes one care was install and so called protecting when it happened
>> I have since installed McAfee and it doesn't find it
>> I've also tried difeerent spyware and adware products to no avail
>> Has anyone else had this problem or know a solution
>> thanks
>
pete
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-14-2007, 01:17 AM
Try downloading Lavasofts AdAware program and running it.
It will/should find errant adware
I personally am not a fan of McAfee I prefer AVAST and they have a free
version or Vista
I use 3 different anti spy/ad ware programs.
spybot search and destroy
spywareblaster
Adaware from Lavasoft.
all of these are available for free............dp a google.

peter

"Taz" <tom_snyder@hotmail.com> wrote in message
news:OeTueeXfHHA.2396@TK2MSFTNGP04.phx.gbl...
> yes it's not acting like a popup it's like starting another instance of
> IE7
> first flash command has login.revenue as part of the command that flashes
> then it goes to a different ad
> sometimes games, sometimes registry editor program, sometimes spyware ads
> wanting you to download their product
>
> "pete" <pete@nowhere.net> wrote in message
> news:C86E3513-BF91-4FE8-9C8A-AF51691E6809@microsoft.com...
>> IE7.........Tools............popup blocker............is it on??
>> peter
>> "Taz" <tom_snyder@hotmail.com> wrote in message
>> news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
>>> When I start IE7 after awhile I get random ads that open a new instance
>>> of IE7
>>> Windoes one care was install and so called protecting when it happened
>>> I have since installed McAfee and it doesn't find it
>>> I've also tried difeerent spyware and adware products to no avail
>>> Has anyone else had this problem or know a solution
>>> thanks
>>
>
Taz
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-14-2007, 10:51 AM
Tried it still have the problem

"pete" <pete@nowhere.net> wrote in message
news:40CA6844-2C2F-4CC8-85B9-EA38DE2AA8B9@microsoft.com...
> Try downloading Lavasofts AdAware program and running it.
> It will/should find errant adware
> I personally am not a fan of McAfee I prefer AVAST and they have a free
> version or Vista
> I use 3 different anti spy/ad ware programs.
> spybot search and destroy
> spywareblaster
> Adaware from Lavasoft.
> all of these are available for free............dp a google.
>
> peter
>
> "Taz" <tom_snyder@hotmail.com> wrote in message
> news:OeTueeXfHHA.2396@TK2MSFTNGP04.phx.gbl...
>> yes it's not acting like a popup it's like starting another instance of
>> IE7
>> first flash command has login.revenue as part of the command that flashes
>> then it goes to a different ad
>> sometimes games, sometimes registry editor program, sometimes spyware ads
>> wanting you to download their product
>>
>> "pete" <pete@nowhere.net> wrote in message
>> news:C86E3513-BF91-4FE8-9C8A-AF51691E6809@microsoft.com...
>>> IE7.........Tools............popup blocker............is it on??
>>> peter
>>> "Taz" <tom_snyder@hotmail.com> wrote in message
>>> news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
>>>> When I start IE7 after awhile I get random ads that open a new instance
>>>> of IE7
>>>> Windoes one care was install and so called protecting when it happened
>>>> I have since installed McAfee and it doesn't find it
>>>> I've also tried difeerent spyware and adware products to no avail
>>>> Has anyone else had this problem or know a solution
>>>> thanks
>>>
>>
>
TDM
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-16-2007, 03:40 PM

"Taz" <tom_snyder@hotmail.com> wrote in message
news:eC8uoMofHHA.4652@TK2MSFTNGP02.phx.gbl...
> Tried it still have the problem
>
Taz,

The last time I had to troubleshoot a very stubborn malware situation
such as yours, it turned out to be a rootkit. Go to sysinternals.com
and run theire "Root Kit Revealer". This may help you isolate the issue.

http://www.microsoft.com/technet/sys...tRevealer.mspx

Should it find a rootkit, they can be a bit of a hassle to get rid of. I use
the Bart PE Builder to create a bootable XP CD, then boot from that
CD to fix the issues on the C: drive. It is almost impossible to remove
a rootkit booted from the infected OS.

The last time I used the root kit revealer, there was no option to print
the results, you could only save to file. You will need to to that, then
boot from the bootable XP cd, open the file you saved and process
any issues it finds.

However, ask any certified security expert and they will almost always
say the only "real" way to clean your system after it has been compromised
is to re-image.

Good luck.

TDM


Taz
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-16-2007, 06:22 PM
I took off windows live one care and put McAfee on
I then turned everything off on McAfee, ie. smart recognizer and trusted
sites and apps
I don't have the problem at this point and I'm being very careful what I
allow
I tried numerous programs and nothing found it
this has been the only thing I've tried that has worked to this point

"TDM" <rpuffd@gmail.com> wrote in message
news:%235Zld2DgHHA.596@TK2MSFTNGP06.phx.gbl...
>
> "Taz" <tom_snyder@hotmail.com> wrote in message
> news:eC8uoMofHHA.4652@TK2MSFTNGP02.phx.gbl...
>> Tried it still have the problem
>>
>
> Taz,
>
> The last time I had to troubleshoot a very stubborn malware situation
> such as yours, it turned out to be a rootkit. Go to sysinternals.com
> and run theire "Root Kit Revealer". This may help you isolate the issue.
>
> http://www.microsoft.com/technet/sys...tRevealer.mspx
>
> Should it find a rootkit, they can be a bit of a hassle to get rid of. I
> use
> the Bart PE Builder to create a bootable XP CD, then boot from that
> CD to fix the issues on the C: drive. It is almost impossible to remove
> a rootkit booted from the infected OS.
>
> The last time I used the root kit revealer, there was no option to print
> the results, you could only save to file. You will need to to that, then
> boot from the bootable XP cd, open the file you saved and process
> any issues it finds.
>
> However, ask any certified security expert and they will almost always
> say the only "real" way to clean your system after it has been compromised
> is to re-image.
>
> Good luck.
>
> TDM
>
>
Taz
Guest
Posts: n/a
 
Re: IE7 adware problem
Posted: 04-17-2007, 01:24 AM
PC Doctor 5 finds it as a hijacker and quarentines it but it comes right
back
It writes a file
user/tom/appdata/roaming/microsoft/windows/cookies/low/tom@cpvfeed[2].txt
if you fix that it just wrotes [3]

This is the file it writes
mgFreq
F|1|150289|1176768854437
cpvfeed.com/
1024
1290014464
29857816
4127253120
29851780
*
mgData
B|2
cpvfeed.com/
1024
1290014464
29857816
4127293120
29851780
*
myGeekConv
558343|110830|24.127.232.181|ron|24255609|11767688 54437
cpvfeed.com/
1024
1290014464
29857816
4127383120
29851780
*
mgUser
1|10aecc7799c740ff9cfaf32e4f0394b2|24.127.232.181| 1176768854437
cpvfeed.com/
1024
1290014464
29857816
4127423120
29851780
*
I have not been able to find the file that writes it yet

"Taz" <tom_snyder@hotmail.com> wrote in message
news:%23cHtSSFgHHA.3388@TK2MSFTNGP02.phx.gbl...
>I took off windows live one care and put McAfee on
> I then turned everything off on McAfee, ie. smart recognizer and trusted
> sites and apps
> I don't have the problem at this point and I'm being very careful what I
> allow
> I tried numerous programs and nothing found it
> this has been the only thing I've tried that has worked to this point
>
> "TDM" <rpuffd@gmail.com> wrote in message
> news:%235Zld2DgHHA.596@TK2MSFTNGP06.phx.gbl...
>>
>> "Taz" <tom_snyder@hotmail.com> wrote in message
>> news:eC8uoMofHHA.4652@TK2MSFTNGP02.phx.gbl...
>>> Tried it still have the problem
>>>
>>
>> Taz,
>>
>> The last time I had to troubleshoot a very stubborn malware situation
>> such as yours, it turned out to be a rootkit. Go to sysinternals.com
>> and run theire "Root Kit Revealer". This may help you isolate the issue.
>>
>> http://www.microsoft.com/technet/sys...tRevealer.mspx
>>
>> Should it find a rootkit, they can be a bit of a hassle to get rid of. I
>> use
>> the Bart PE Builder to create a bootable XP CD, then boot from that
>> CD to fix the issues on the C: drive. It is almost impossible to remove
>> a rootkit booted from the infected OS.
>>
>> The last time I used the root kit revealer, there was no option to print
>> the results, you could only save to file. You will need to to that, then
>> boot from the bootable XP cd, open the file you saved and process
>> any issues it finds.
>>
>> However, ask any certified security expert and they will almost always
>> say the only "real" way to clean your system after it has been
>> compromised
>> is to re-image.
>>
>> Good luck.
>>
>> TDM
>>
>>
>
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
Removing MS-Adware from Vista Business Reid Windows Vista Administration 2 05-30-2007 08:59 PM
adware/spyware JC Windows XP Embedded 1 09-17-2004 07:57 PM
adware files vinividivici76 Windows XP Help & Support 1 11-07-2003 02:14 AM
No Video after install/uninstall of DivX Adware Craig Windows XP Video 0 09-25-2003 06:04 AM
lavasoft adware Ken Wickes [MSFT] Windows XP Network & Web 1 07-18-2003 03:06 AM