popups from an unknown source

penelopecat · #1 Mar 1, 2005, 01:19 PM

I keep getting these popup ads that start off with a URL that includes "documentsandsettings/localsettings/temp" and then changes to the ad's URL. I've noticed it also creates folders labeled DlfnTmp1, DlfnTmp2, etc. in the documentsandsettings/localsettings/temp folder. I can't figure out what's causing these popups. I've already uninstalled DeskAd Service using Control Panel -> Add & Remove, but the problem is still occuring. When I run Spybot, it says there's no spyware, and yet I keep getting these popups.

When I run ad-aware, I get DealHelper. So I tried a search on the net for removal instructions, but none of the files that the instructions list to delete are actually on my computer.

It seems to be only on IE, but occasionally they come up even when I'm using FireFox. Any idea what's causing this? It's been happening ever since I visited dictionary.com and not only were there a lot of popups blocked but it kept requesting access to download .exe files and eventually caused my computer to crash. (That got fixed when I used restore and restored back to the day before I visited dictionary.com.)

thebriggsdude · Mar 1, 2005, 02:27 PM

first off try the hijack this program, should be up in the thread at the top of this section, because first off, my friend just by clicking one simple link got almost 300 peices of spyware and loads of trojans that would cause pop ups. windows, what else could you expect

fredg · Mar 1, 2005, 03:22 PM

Hi,
Sounds like your computer is completely infected with spyware/advertising programs!
Run your spyware programs in Safe Mode.
Here is a listing of free programs, and how to use them. They should take care of the issue:

If you think you already have Spyware/Advertising Ware in your computer, run these as follows:

http://www.security-related.com/download2.htm
Download: SpyBot Search & Destroy; 1.3

AdAware at:
http://www.lavasoftusa.com
Download: AdAware_SE

CWShredder at:
http://www.intermute.com/products/cwshredder.html
(CWShredder is intended only for removal of CoolWebSearch files; placed as spyware on the harddrive). It is not a "stand alone" scan, but needs to be run. Download the free version by clicking on "Download stand alone version of CW Shredder".

All 3 of the above programs run better and much faster when run in SafeMode.

To get into SafeMode:
Re-boot the computer, and immediately after starting up, Press and hold down, F8, at top of keypad.
When the options show on the screen, use the up and down arrow keys on the keyboard to select
"Safe Mode".
Press Enter

It's best to run the AdAware scan first; 3 times; then re-boot.
Then, run the AdAware scan again 3 times; then run the SpyBot. Then, run CWShredder.
Re- Boot.
Reason for running so many times:
Some of these trojans' files can be deleted the first time; leaving some others; but on re-boot, they re-write the files that were deleted.
Running multiple times deletes most of it the first
time.

If you wish to have a great program, after you clean out Spyware/Advertising Ware:
SpyWare Blaster 3.2
Great, free, program that STOPS spyware, trojans, home page hijacks, etc, BEFORE they get into your computer. Check it out at CNET at link:

http://www.download.com/SpywareBlast...ml?tag=lst-0-2

I haven't had any spyware at all since installing the Spyware Blaster.

Just for information:
If you wish to add or subtract from an Experts' reputation, or show appreciation or discontent with
an answer, click on the "balance scales" icon by the Experts' name. You can then choose what you wish.

Best wishes,
fredg

penelopecat · Mar 2, 2005, 04:23 PM

I'm on AOL, but I don't think that's the problem. I've been on that for years and never had trouble with popups until I went on dictionary.com one day and then all the popups started happening. Might be coincidence, but I don't think so.

thebriggsdude · Mar 2, 2005, 04:44 PM

aol should have a virus scanner for you to use so no worries there, most likely adware and spyware. thats why never use IE to go to sites, always firefox.

penelopecat · Mar 2, 2005, 04:48 PM

Well, the AOL techies told me to go to kw: spyware and try theirs, but all I could find was a link to spybot. I think version 8.0 doesn't come with it, and I didn't like the new style of 9.0, which is why I stuck with 8.0.

thebriggsdude · Mar 2, 2005, 07:15 PM

well if you can try some of those free spyware adware scanners

fredg · Mar 3, 2005, 05:26 AM

Hello again,
Have you tried my suggestions for getting rid of Spyware yet?
The Deal Helper is Advertising/Spyware, and the AdAware_SE, and SpyBot, coupled with CWShredder will get rid of it for you.

Best wishes,
fredg

penelopecat · Mar 3, 2005, 04:51 PM

Sorry about taking so long to respond. I needed to let the computer run a few days in order to see if your suggestion worked, see.

Unfortunately I still get popups every once in a while. Just not as often as before.

And yes, this was after I did everything you suggested.

jimsmithjimsmith · Mar 3, 2005, 05:16 PM

Hi,
Another good set of tools:
- hit Start/Run and type msconfig if it's an XP machine. You can download it for othe os's. It is a utility to see all the stuff that's going to run/is running. You can choose to start in "diagnostic startup" to get a clean boot too.

- Startup Control Panel, but a young guy named Mike Lin, MIT student.
http://www.mlin.net/StartupCPL.shtml

This will show you what's running on your computer when you start up. Kind of an online tool to safely edit the registry. It allows you to uncheck items which will then not run upon reboot. A stripped down version of msconfig

Hope that helps!



At Ask Me Help Desk you can ask questions in any topic and have them answered for free by our experts. To ask questions or participate in answering them you must register for a free account. By registering you will be able to: Get free answers from experts in any of our 300+ topics. Accept money for answers that you provide. Communicate privately with other members (PM). See fewer ads. Sign Up!