I keep getting these popup ads that start off with a URL that includes "documentsandsettings/localsettings/temp" and then changes to the ad's URL. I've noticed it also creates folders labeled DlfnTmp1, DlfnTmp2, etc. in the documentsandsettings/localsettings/temp folder. I can't figure out what's causing these popups. I've already uninstalled DeskAd Service using Control Panel -> Add & Remove, but the problem is still occuring. When I run Spybot, it says there's no spyware, and yet I keep getting these popups.

When I run ad-aware, I get DealHelper. So I tried a search on the net for removal instructions, but none of the files that the instructions list to delete are actually on my computer.

It seems to be only on IE, but occasionally they come up even when I'm using FireFox. Any idea what's causing this? It's been happening ever since I visited dictionary.com and not only were there a lot of popups blocked but it kept requesting access to download .exe files and eventually caused my computer to crash. (That got fixed when I used restore and restored back to the day before I visited dictionary.com.)

thebriggsdude

now i don't know about aol, but CIDAEMON.EXE i don't know if that is a aol thing or not, i have not seen a virus or anything that uses that either. hmmmm i need to talk to my buddy about this more, he has had something similar to this happen and i forgot what it was called he got rid of and solved the problem

penelopecat

According to this site it's part of Windows...

http://www.iamnotageek.com/a/cidaemon.exe.php

thebriggsdude

well thats good, havn't seen it on many though. hmmm he ain't home, well i will be asking about it tommorrow though, it was caused while he was surfing in IE and clicked the wrong thing and no scanner or anything picked it up and it was a registry fix he did.

jimsmithjimsmith

This one looks suspicious:

wsxsvc.exe

Here is how to remove it:
http://www3.ca.com/securityadvisor/p...x?id=453076775

Do you remember installing the 'delfin media viewer?'

More on this:
http://www.processlibrary.com/direct...xsvc/index.php
(use that site to check others too)

Very interesting to check out the company that created this:
http://www.delfinproject.com/
and click on Ad Spec's. It gives details on the crap they send out...

I did not finish looking at the entire list, you might try the processlibrary link above and search others. It might be worth the effort. Then publish it for others...

Good luck!

thebriggsdude

you know that rings a bell wsxsvc.exe

penelopecat

On that one web site that says to unregister/remove all those files and DLLs...none of them are present on my computer except for the license.txt, which is present for a whole bunch of stuff (like Adobe Acrobat and so on). According to my computer delfin isn't on there anywhere.

And no, I didn't download the viewer...at least not knowingly. It's possible when I went to dictionary.com it went and just installed itself into my machine. I noticed icons for a porn site and a couple of other things that suddenly appeared after I went to dictionary.com, so I wouldn't be surprised if delfin did that, too.

penelopecat

I did a search for info on that and that's part of the delfin viewer itself. So, how do I remove that without totally killing my computer?

fredg

Hi,
Another thing you can look at is what programs are starting up when you turn on or boot up the computer. All of these are listed under a StartUp tab.
Go to Start/Run , then type in MSCONFIG , then click on OK.
In that window, click on the StartUp tab.
Look over to the left hand side to see all the programs starting up when you boot up. You can scroll down to see the remaining ones.

You can Left click on any checkmark (to uncheck it) by something you don't recognize. For example, one of the Spyware programs shows "Load32".

After unchecking an item, click on Apply then OK, and re-boot.
If you have disabled something you need, you can always go back and re-check it.
Best wishes,
fredg

penelopecat

fredg, tried that and we'll see if it works.

penelopecat

Looks like turning it off in msconfig worked. Thanks, all!