[penelopecat]

I keep getting these popup ads that start with a URL that includes "documentsandsettings/localsettings/temp" and then changes to the ad's URL. I've noticed it also creates folders labeled DlfnTmp1, DlfnTmp2, etc. in the documentsandsettings/localsettings/temp folder. I can't figure out what's causing these popups. I've already uninstalled DeskAd Service using Control Panel -> Add & Remove, but the problem is still occurring. When I run Spybot, it says there's no spyware, and yet I keep getting these popups.

When I run ad-aware, I get DealHelper. So I tried a search on the net for removal instructions, but none of the files that the instructions list to delete are actually on my computer.

It seems to be only on IE, but occasionally they come up even when I'm using FireFox. Any idea what's causing this? It's been happening ever since I visited dictionary.com and not only were there a lot of popups blocked but it kept requesting access to download .exe files and eventually caused my computer to crash. (That got fixed when I used restore and restored back to the day before I visited dictionary.com.)

[thebriggsdude]

First off try the hijack this program, should be up in the thread at the top of this section, because first off, my friend just by clicking one simple link got almost 300 pieces of spyware and loads of trojans that would cause pop ups. Windows, what else could you expect :rolleyes:

[fredg]

Hi,
Sounds like your computer is completely infected with spyware/advertising programs!
Run your spyware programs in Safe Mode.
Here is a listing of free programs, and how to use them. They should take care of the issue:

If you think you already have Spyware/Advertising Ware in your computer, run these as follows:

http://www.security-related.com/download2.htm
Download: SpyBot Search & Destroy; 1.3

AdAware at:
http://www.lavasoftusa.com
Download: AdAware_SE

CWShredder at:
http://www.intermute.com/products/cwshredder.html
(CWShredder is intended only for removal of CoolWebSearch files; placed as spyware on the harddrive). It is not a "stand alone" scan, but needs to be run. Download the free version by clicking on "Download stand alone version of CW Shredder".

All 3 of the above programs run better and much faster when run in SafeMode.

To get into SafeMode:
Re-boot the computer, and immediately after starting up, Press and hold down, F8, at top of keypad.
When the options show on the screen, use the up and down arrow keys on the keyboard to select
"Safe Mode".
Press Enter

It's best to run the AdAware scan first; 3 times; then re-boot.
Then, run the AdAware scan again 3 times; then run the SpyBot. Then, run CWShredder.
Re- Boot.
Reason for running so many times:
Some of these trojans' files can be deleted the first time; leaving some others; but on re-boot, they re-write the files that were deleted.
Running multiple times deletes most of it the first
Time.

If you wish to have a great program, after you clean out Spyware/Advertising Ware:
SpyWare Blaster 3.2
Great, free, program that STOPS spyware, trojans, home page hijacks, etc, BEFORE they get into your computer. Check it out at CNET at link:

http://www.download.com/SpywareBlast...ml?tag=lst-0-2

I haven't had any spyware at all since installing the Spyware Blaster.

Just for information:
If you wish to add or subtract from an Experts' reputation, or show appreciation or discontent with
An answer, click on the "balance scales" icon by the Experts' name. You can then choose what you wish.

Best wishes,
fredg

[penelopecat]

I'm on AOL, but I don't think that's the problem. I've been on that for years and never had trouble with popups until I went on dictionary.com one day and then all the popups started happening. Might be coincidence, but I don't think so.

[thebriggsdude]

AOL should have a virus scanner for you to use so no worries there, most likely adware and spyware. That's why never use IE to go to sites, always Firefox.

[penelopecat]

Well, the AOL techies told me to go to kw: spyware and try theirs, but all I could find was a link to spybot. I think version 8.0 doesn't come with it, and I didn't like the new style of 9.0, which is why I stuck with 8.0.

[thebriggsdude]

Well if you can try some of those free spyware adware scanners

[fredg]

Hello again,
Have you tried my suggestions for getting rid of Spyware yet?
The Deal Helper is Advertising/Spyware, and the AdAware_SE, and SpyBot, coupled with CWShredder will get rid of it for you.

Best wishes,
fredg

[penelopecat]

Sorry about taking so long to respond. I needed to let the computer run a few days in order to see if your suggestion worked, see. :) Unfortunately I still get popups every once in a while. Just not as often as before. :( And yes, this was after I did everything you suggested.

[jimsmithjimsmith]

Hi,
Another good set of tools:
- hit Start/Run and type msconfig if it's an XP machine. You can download it for othe os's. It is a utility to see all the stuff that's going to run/is running. You can choose to start in "diagnostic startup" to get a clean boot too.

- Startup Control Panel, but a young guy named Mike Lin, MIT student.
http://www.mlin.net/StartupCPL.shtml

This will show you what's running on your computer when you start up. Kind of an online tool to safely edit the registry. It allows you to uncheck items which will then not run upon reboot. A stripped down version of msconfig

Hope that helps!

[penelopecat]

Tried that, but how do I know what to look for?

[jimsmithjimsmith]

I look at task manager, check the Processes that are running. If you want, post a list or a screenshot for review here. I look up suspicious ones and find out what they are. It can take a while but I think it's worth it in the long run, to know what each does - it would be nice to start posting a list of them here.

Once you find the bad process, you can get it cleared. Just search for the process name and find out how to clear it (google it).

Also, mention here which OS you use, windows xp/2000/etc. - good to know for troubleshooting...

One more thing - there's a hosts file and an lmhosts file, check there too. Located somewhere around here:

C:\WINDOWS\system32\drivers\etc
(that's winxp)

Open it (use notepad) and look for entries in it. All, or nearly all lines should be commented out with # symbols. There might be one or two at the end that are not commented, but certainly not any suspicious looking ones.

[thebriggsdude]

Good thinking, I can't really know unless I know which os either, but I do know that if you are getting popups in Firefox you either have a virus bringing them in or adware/spyware. Oh and plus Firefox is now 1.01 now, they had a serious update needed on count of a hole in the program, but they caught it before it happened :D unlike Microsoft waiting till it happens :rolleyes:

[penelopecat]

How do I post a list without having to type out every single entry?

I'm on XP, by the way.

[thebriggsdude]

Either do type it out or just post a pic of the task manager running with it totally open and showing all the tasks. Basically just hit the print screen button right on the right side of the backspace button and go to paint and click paste and cut and copy the task manager to show. Either that or type it.

[penelopecat]

Do you need Startup or Services?

[thebriggsdude]

No just task manager.

[penelopecat]

Oh, I was thinking of msconfig, which was the previous suggestion.

[thebriggsdude]

I look at task manager, check the Processes that are running. If you want, post a list or a screenshot for review here. I look up suspicious ones and find out what they are. It can take a while but I think it's worth it in the long run, to know what each does - it would be nice to start posting a list of them here.

Once you find the bad process, you can get it cleared. Just search for the process name and find out how to clear it (google it).

Also, mention here which OS you use, windows xp/2000/etc. - good to know for troubleshooting...

One more thing - there's a hosts file and an lmhosts file, check there too. located somewhere around here:

C:\WINDOWS\system32\drivers\etc
(that's winxp)

Open it (use notepad) and look for entries in it. All, or nearly all lines should be commented out with # symbols. There might be one or two at the end that are not commented, but certainly not any suspicious looking ones.

i look at task manger, check the Processes that are running that sort of thing :) gives an idea of what may be going on, but not all the time, some can hide in the registry, etc.

[penelopecat]

I'm just going to list the Image Names...

Firefox.exe
Iexplore.exe
Taskmgr.exe
CIDAEMON.EXE
Aolwbspd.exe
Mcagent.exe
DSentry.exe
Directcd.exe
Alg.exe
Explorer.exe
McShield.exe
MpfAgent.exe
Mcvsshld.exe
Realsched.exe
Wanmpsvc.exe
AOL.exe
Aoltray.exe
Nvsvc32.exe
MpfService.exe
Mdm.exe
MpfTray.exe
Mcvsrte.exe
Cisvc.exe
Wsxsvc.exe
Spoolsv.exe
Support.exe
Svchost.exe
NotifyAlert.exe
ViewMgr.exe
Ctfmon.exe
Lsass.exe
Services.exe
Winlogon.exe
Csrss.exe
Smss.exe
McVSEscn.exe
Waol.exe
Ad-Aware.exe
System
System Idle Process