I have tried everything
 

Can anyone help me stop these windows appearing on web sites (screen shot attached). I have tried security settings in IE (i even get them in Mozilla) plus numerous other things.

Does anyone else suffer or is it just me?

regards

IC2

Re: I have tried everything
 

No screen shot :shrug: have you got a pop up stopper installed and enabled?

Re: I have tried everything
 

Sorry user error, file now attached. I am running google toolbar and IE popup blockers but does not seen to help. Any suggestion on what I should be running to stop this thing?

regards

IC2

Re: I have tried everything
 

I would run ms anti spyware and some of the other ones, seems a strange one.

Re: I have tried everything
 

Hi,

running MS antispyware, Webroot spysweeper & spybot but nothing found. It is driving me nuts.

IC2

Re: I have tried everything
 

Have you tried Ad Aware SE Personal?

Re: I have tried everything
 

Hi,

yes had a copy and ran it, just highlighted some tracking cookies?

IC2

Re: I have tried everything
 

OK, so it's not a virus or backdoor or spy ware - as far as the detection software can tell.

Check out your browser settings - i.e. ALL of them. Perhaps something has tweaked your browser settings and either set this location as a default, or something like that.

If you're confident with tweaking the registry you might also check out any entries that have 'doubleclick' (they really ought to be placed in front of a wall and riddled with bullets!) in them. You can probably delete most entries containing that string without any worries.

Re: I have tried everything
 

thanks tried that but no joy...........totally miffed. Even disabled scripting in IE security settings.

IC2

Re: I have tried everything
 

i'd just add *doubleclick* to your popup and content blockers that'llget rid of it

Re: I have tried everything
 

But would give him a annoying Windows popup thing unless he disables that which then means on certain sites which it popup's something you need you cannot check.

Perhaps you should run Hijack this and perhaps one of the intelligent chaps ( zingle where are you?? ) can help..

Re: I have tried everything
 

Although running some kind of spyware software is a good thing, they don't always pick up recent spyware. I would check the run entries in the registry to see what's getting started when windows boots up and I would also look at task manager to see what processes are running. It might be worthwhile posting a screenshot of the running processed from task manager. That way we can see if anything dodgy is running.

Re: I have tried everything
 

i run ms antispy and yahoo antispy both find things the other doesnt

thats it i'm :confused: myself:dunce:

Re: I have tried everything
 

Guys,

thanks, I had an old programme called XoftSpy that I installed (searched for best pop up blockers on the web) and its stopped it. Do not understand what this does against all the others but it sure does work.
I have attached my task manager screen shot anyway.

regards

IC2

Re: I have tried everything
 

I had a quick look at the processes and nothing really looks out of place. There's several items that don't need to be running but that's a different story :) Perhaps it's worth checking the windows services to see if anything dodgy is running as a service :shrug:

Re: I have tried everything
 

There are some free programs out there which install an extra program (the reason it's free) so the only way to permanantly get rid of these things is to rid yourself of the "free" program as well or use a startup monitor to stop the annoying part running.

Re: I have tried everything
 

Personally I do not think this is a problem on your system. What it is asking you to do is login into a advertising companies website, obviously someone at their end has been playing with something like ILS and set it so it asks for a password which would be one on their corporate network. That is my theory. If you post the link to the site you are having trouble with I will take a look.

Re: I have tried everything
 

i'd agree with matthew... dont think there's anything like spyware or a virus causing the problem....

it may be worth checking in your control panel, in add/remove programs... then windows components and make sure that 'internet information services (IIS) is unticked.

Re: I have tried everything
 

I was talking about ILS on the web server rather then the personal computer.

If a link to one of the effecting sites can be provided it would help.

Re: I have tried everything
 

Thanks for the offer.

At work now but will post it tonight.

IC2

Re: I have tried everything
 

I'd second that. Run HJT and post the log on here.

Re: I have tried everything
 

Zingle's intelligent ...... blimey ;) :D

Re: I have tried everything
 

OK - HJT log as requested, plus the linky for Mathew:
http://www.pcpro.co.uk/phpbb/viewforum.php?f=20

Logfile of HijackThis v1.99.1
Scan saved at 18:20:37, on 11/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PGPserv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Belkin Bulldog Plus\upsd.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Link Logger\LinkLogger.exe
C:\Program Files\Belkin Bulldog Plus\MUPS.EXE
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.meshcomputers.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher\SCActiveBlock.dll (file missing)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - (no file)
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Acronis*True*Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [OutpostFeedBack] C:\PROGRA~1\Agnitum\OUTPOS~1\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe -s
O4 - Global Startup: Link Logger.lnk = C:\Program Files\Link Logger\LinkLogger.exe
O4 - Global Startup: MUPS.lnk = C:\Program Files\Belkin Bulldog Plus\MUPS.EXE
O4 - Global Startup: PGPtray.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/f...trol_en_US.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1118858515952
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1118858494139
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E56347B0-6C2B-4C2E-939F-EE513EAC80BC} (Creative Product Registration ActiveX Control Module) - http://www.creative.com/register/OCX...lientNoMFC.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O20 - AppInit_DLLs: ocmapihk.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - Service: UPS - UPSentry Service (UPSentry_Smart) - Delta - C:\Program Files\Belkin Bulldog Plus\upsd.exe

Re: I have tried everything
 

Just out of interest, what sites are you visiting when you get that popup?

Re: I have tried everything
 

Hi,

here is one of the sites: http://www.pcpro.co.uk/phpbb/viewforum.php?f=20

Re: I have tried everything
 

Do you get it on the main page or just certain pages?

Re: I have tried everything
 

As soon as I go to that page, up it pops?

Re: I have tried everything
 

Ok, thanks.

Just wanted to see if I could replicate it, it appears that I can't - I don't get that box come up on my system.

Re: I have tried everything
 

wow

must be a setting on my machine but since installing XoftSpy, it has stopped. That must block something, but for the life of me, goodness knows what, I even played around with Java script blocking and scripting in IE security setting but no joy.

Re: I have tried everything
 

Have you done a search in the registry for the url that it goes to because it must be stored somewhere on your PC :shrug:

Re: I have tried everything
 

I'd be suspicious of these. I don't know what the Eset stuff is though.

The CTDVDDET and CTHELPER are Creative stuff, totally legit, but you don't really need them. Infact the CTDVDDET has been known to cause Autorun problems.

Re: I have tried everything
 

C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Link Logger\LinkLogger.exe

The Eset stuff belongs to NOD antivirus, Link Logger, helps me interogate my firewall alerts and MXOALDR is to do with Maxtor one touch drive.
__________________

Nope not done that, will try it

Re: I have tried everything
 

Seems ok then. Maybe it didn't propagate.

Resolved
 

Just thought I would post the resolution, in case anyone else comes across this problem again, but thanks anyway for all the suggestions.

I edited my host file to inlude 127.0.01 ad.uk.doubleclick.net & 127.0.0.1 view.atdmt.com.
This article got me going down the right path:
http://www.mvps.org/winhelp2002/hosts.htm