help with Strange pop ups!

My husband computer has been getting strange pop ups.

We are on cable modem with a netgear router.

We use system suite for firewall and anti virus

He has checked his computer for virus/ spyware etc.

He is using Ad aware too.

Strange enough when he is gone to work he gets pop ups without even having a browser window open. I close them and come back to find 7 more.

He started getting them really bad when he was playing Planetside online. No one else online had that problem.

Any ideas what it could be?

if he's going to porn sites with IE he could be getting continually re-infected. Also, he could be downloading a trojan over and over again. If they happen w/o a browser window maybe his messenger.exe service is being used. You can turn that off easilly.

If he has windows 2000, go to: Settings->Control Panel->Administrative Tools->Services

and look for messenger. Right click, look for startup type in the window that pops up. Change it to manual.

well he said his Messeger exe. is off. As for porn sites, he don't do it. (anymore) He's got plenty in the bedroom. Happily entertained. He spends all his time gaming online. He has never found any virus or trojan of any kind on his computer.

Only frequents 3 sites regularly
Letsgokings.com
republicanguard.com
latimes.com

The pop ups are coming from a site called Clickspring.com. He says he's never been there before.

????

[Edited on 03/20/04 by favouriteslave]

You gots some spyware on your computer causing those popups.

Clickspring generally comes from one of two sources:
1. PurityScan: a program that claims to remove evidence of "naughty" sites from your IE cache, history & cookies
or
2. Forced downloads from "naughty" sites themselves.

Ad Aware or Spybot S&D should be able to get rid of it for you.

There are also manual removal instructions.

-B.

AdAware has a new reference file (01R271 19.03.2004) that is now available for download. It has removal information for Clickspring among others. Try downloading the update and running a scan.

Ok

So he ran his spybot and Ad aware, they found some purityscan stuff and removed it.

unfortunately, they are still poping up.

Right now, he has one and it says " stop pop ups forever" Leads to a www.jimmysurf............

Ironically right after he ran spy bot!

This is so outa control. He may dump the damn thing off the balcony!

Originally posted by favouriteslave
Right now, he has one and it says " stop pop ups forever" Leads to a www.jimmysurf............
Ironically right after he ran spy bot!
This is so outa control. He may dump the damn thing off the balcony!

Gimme a minute, I'm researching this one.
Jimmysurf is a mutation of Clickspring. I'll get you removal instructions shortly.

-B.

Yeah, this one sucks.

Here's your removal instructions

Spybot & Ad Aware don't seem to have paramaters for it yet. If you don't feel comfortable with the manual removal, just hang tight for a few days and hopefully one of the two will have updates to delete that junk.
It's not a virus, it's "just" adware.

-B.

Originally posted by favouriteslave
Ok

So he ran his spybot and Ad aware, they found some purityscan stuff and removed it.

unfortunately, they are still poping up.

Right now, he has one and it says " stop pop ups forever" Leads to a www.jimmysurf............

Ironically right after he ran spy bot!

This is so outa control. He may dump the damn thing off the balcony!

Don't do that. Send it to me instead! Kidding. No, don't stress. You probably just need to clean up your system a bit. Instead of relying on software to do it for you, although it should work, do it manually yourself.

Using 'Explorer' manually delete all your cookies, all the stuff in Temp, and Temporary Internet Files. When it comes to Temporary Internet Files, there are 'hidden' folders that will not show up unless you use the 'Explorer' View and have 'Show all Files' selected in your folder options. If you rt-click the folder and choose 'Explore' you should see a + symbol next to the folder in the left part of the explore window that you can click on to show the directory tree within Temporary Internet Files. My Sister and Bro-In-Law for example were having a similar problem. Using Explore to expose the hidden folders, 10 of them, I found 1000 little tiny files per folder (10,000 total, mostly porn thumbnail pics) which they couldn't find or remove any other way.

Also check the folder 'Downloaded Program Files' and delete anything with an 'Unknown' description or anything that looks out of place. Don't worry if you delete something you need like shockwave or whatever, your browser will just download it again next time you're online.

This still may not solve your problem however. Depending on the type of Online Games you are using, they may be your problem. If you've had to download and install something in order to play, it may have come with some spyware/adware crap included. Sometimes it's even imbedded so that the program will stop working if you try and remove the spyware, sometimes not, just depends. You'll just have to find out more info about what you have installed and see what it says.

Your Router won't stop this traffic though. It's going to assume that it's normal, wanted traffic and allow it through. Routers really only stop Unwanted traffic from the outside getting in. Most likely this is happening because your computer is being told to contact them first, which is establishing the connection legally as far as the router knows.

If the spyware software isn't doing the trick for you, you may want to download a simple free Firewall and install it. It will watch for Outbound traffic as well as inbound traffic and report it when it happens. Allowing you to allow or deny it. But also will allow you to find out just where and why you're connecting somewhere when you're not supposed to.

EDIT: is changed to isn't.....oops!! Big difference.

[Edited on 21-3-2004 by mOjOm]

hey thanks for all your help guys!

We will continue the fight and try everything you suggested.

My dad had this problem i think changed his server he was getting all this porn # so he changed the server.
And voila no pop-ups.

[Edited on 21-3-2004 by drunk]