Need help getting rid of pop-ups

[yusuke]

Hi my brother has some problems with his pc. He stumbled into some porn sites (I'm skeptical about this) and got a lot of pop-ups.

In the midst of closing the pop-ups, there were some messages that asked him to install stuff and, believe it or not, he clicked 'yes'. ( I think that was really dumb)

Now when he's surfing the net, he gets a lot of pop-ups. When i asked him to install spybot from cnet, his internet explorer crashed when he clicked on the download link.

Norton antivirus 2004 didn't detect anything. He cleared spyware with Ad-aware. but the problem still remains.

Can someone help? He can't format his pc because he doesn't have the win xp cd with him at the moment.

Thanks for the help!

 

[helpmeout]

Well, first off, have him uninstall whatever it is he said "Yes" to, and see if that helps.

 

[imported_Fluffy]

Uninstalling the programs he clicked "Yes" to will most likely solve your problem as helpmeout previously stated.

But, in the event that you or he cannot find the files that were installed, one place to look might be that of your startup programs. (AKA the registry).

From the Start menu, select Run. Then type in "MSCONFIG" without quotes and hit Enter.

A box should come up with a series of tabs that you can select. Click the Startup tab. (Last one).

Within that tab there will be a list of programs. Obviously these programs start up everytime you boot Windows.

Search through the listed programs for suspicious applications. Especially ones that contain the term "xxx." Simply uncheck the box to disable. (Be sure to keep the programs Explorer, and Systray enabled).

Lastly, restart Windows when prompted.

If by chance you would happen to make your system worse off, or disable a needed program, simply repeat the above process, re-checking the box, and restarting Windows.

Hope this helps to some extent. As always, not surfing such sites will keep this problem from recurring. I strongly support this option.

 

[mechBgon]

Have him try this link for Spybot S&D:

http://www.safer-networking.org/en/download/index.html

Is Norton 2004 up-to-date on its definitions, is it set to use maximum heuristics and scan within compressed files, and is it set up to watch for spyware/adware in the options? If not, get it playing hardball here

Also, have him go to the C:\WINDOWS\SYSTEM32\DRIVERS\ETC folder, open the HOSTS file (with Notepad), and it should look like this:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

If there are other addresses besides 127.0.0.1, have him delete them all and then close (and save) the HOSTS file.

It would be smart for him to make an Administrator-class account on his computer that he uses ONLY for Administrator duties like installing software and major hardware. He should change his own account to Limited, and then he won't even have the option of installing any further junk by mistake. I have some more suggestions for him under the Ongoing Prevention header here.

Anyway, once he has Spybot S&D, he should also download the latest update file from Spybot's site and then:

• Disable System Restore on his drives (how?)
• Reboot into Safe Mode
• Install Spybot and use the downloaded updater to update it
• Run it, immunize the system, scan the system, and nuke stuff that it finds :evil:
• Reboot, do another scan
• Take preventive measures so it can't happen again

Good luck to him, and welcome to the Forums Let us know if that fails to resolve it.

 

[yusuke]

I would like to thank everyone who replied so far. I'll get him to try all these as soon as possible. I still can't believe he was so dumb!