destructionfever Posted October 28, 2005 CID Share Posted October 28, 2005 I recently networked my new and my old pc together. I never had spyware problems on my new pc. I reinstalled windows xp on the old one last night. It still felt like I was running sluggish on the old system still. I downloaded the usual security programs like spybot,spyware blaster, and ad aware. I got the sygate firewall and avast antivirus. This is the same setup as my new pc...I set the old one up this way because obviously my new computer has no issues. I had to uninstall avast because it was slowing the old pc to a stand still.I just mapped the drive on my new pc and decided that I would just scan that drive off of my avast on the new pc. I scanned it and no viruses were found on the old pc. However later I checked back on the old one and it had this messenger pop up telling me I had severe and critical registry errors. It told me to go to a website like regfixup.com and if I x-ed out the window I would get another pop up saying I had a virus and that I should go to another site (similar in name). The pop ups don't stop on the old pc now...though each pop up is either telling me I have severe registry errors or that I have a virus...all the pop up windows are similar. Do I have a virus or trojan guys? Someone please help me. What's a good free antivirus that is low on system resources but will actually get the job done? Someone tell me what is wrong and tell me what to do. The new pc was acting funny a tiny bit earlier but not any popups and everything is normal on it now. Will a fresh xp install on the old pc get rid of my problems? I know my questions seem frantic and jumbled it's just I am freaking out here!!! Please help me. Thanks Quote Link to comment Share on other sites More sharing options...
destructionfever Posted October 28, 2005 Author CID Share Posted October 28, 2005 I just did a clean install of windows xp and I am still getting these errors. And at first my comp was fast. Then when the popups came it became sluggish again. What is left to do? PLEASE someone help me. Quote Link to comment Share on other sites More sharing options...
disturbed Posted October 28, 2005 CID Share Posted October 28, 2005 no....seems you just have a severe case of popups do a scan on ur comp for spyware Quote Link to comment Share on other sites More sharing options...
organ_shifter Posted October 28, 2005 CID Share Posted October 28, 2005 Have you turned off the messenger service? Quote Link to comment Share on other sites More sharing options...
disturbed Posted October 28, 2005 CID Share Posted October 28, 2005 good one fresh installs of win xp have the windows messenger running by default...and ull get random popups now and then Quote Link to comment Share on other sites More sharing options...
disturbed Posted October 28, 2005 CID Share Posted October 28, 2005 just in case.... Windows 2000 Click Start-> Settings-> Control Panel-> Administrative Tools->Services Scroll down and highlight "Messenger" Right-click the highlighted line and choose Properties. Click the STOP button. Select Disable or Manual in the Startup Type scroll bar Click OK Windows XP Home Click Start->Settings ->Control Panel Click Performance and Maintenance Click Administrative Tools Double click Services Scroll down and highlight "Messenger" Right-click the highlighted line and choose Properties. Click the STOP button. Select Disable or Manual in the Startup Type scroll bar Click OK Windows XP Professional Click Start->Settings ->Control Panel Click Administrative Tools Click Services Double click Services Scroll down and highlight "Messenger" Right-click the highlighted line and choose Properties. Click the STOP button. Select Disable or Manual in the Startup Type scroll bar Click OK Windows NT Click Start ->Control Panel Double Click Administrative Tools Select Services-> Double-click on Messenger In the Messenger Properties window, select Stop, Then choose Disable as the Startup Type Click OK Quote Link to comment Share on other sites More sharing options...
destructionfever Posted October 28, 2005 Author CID Share Posted October 28, 2005 Hey, thanks for your quick and helpful responses guys. I disconnected the pc from the internet and the popups stopped magically. Then I ran spybot and found a spyware entry titled alexa reloaded. I fixed it but now I am running ad aware right now to make sure there is no remaining crap on my cpu. I never thought to run spyware scans right after a clean install. But I hopethat once I connect to the net that it doesn't happen again. And believe it or not...I was actually hoping this was an easy spyware problem that I could fix. LOL, there's a first for everything. I will disable the messenger. Thanks for looking out guys. Quote Link to comment Share on other sites More sharing options...
organ_shifter Posted October 28, 2005 CID Share Posted October 28, 2005 Not a problem. Quote Link to comment Share on other sites More sharing options...
destructionfever Posted October 28, 2005 Author CID Share Posted October 28, 2005 I finished all of the spyware programs and it cleaned all of the spyware. But as soon as I connected the pc to the internet again the popups happened almost instantly. If anyone else has ideas on how to fix this please post. Thanks. I'm off to bed but will check the forums in the morning. Nite all. Quote Link to comment Share on other sites More sharing options...
lorne Posted October 28, 2005 CID Share Posted October 28, 2005 Strange, make sure in spybot and ad-awrae you update and than immunize, than scan again. Could also be a trojan thats lettin them in. Than do a scan at http://housecall.trendmicro.com/ Little tip to people also if you didn't do this, keep your favourite firewall,AV and spyware scanners on disk. Disconnect from internet before installing windows and install all your proggies before connecting or you will get nailed One thing i forgot one of the favourite hiding spots of the real nast stuff that causes popups is your hosts file. Location and what it should look like are below. If there is spyware in it you will see it Windows XP = /windows/system32/drivers/etc Windows 2K = /winnt/system32/drivers/etc Win 98ME = /windows Open up the hosts file with Notepad. Below is what it should look like: ------------------------------------------------------------------------------------- # Copyright Quote Link to comment Share on other sites More sharing options...
organ_shifter Posted October 28, 2005 CID Share Posted October 28, 2005 Also, your system restore folders are a great hiding spot for trojans. Turn it off and scan as well. Scan you system with Kaspersky Antivirus afterwards. Quote Link to comment Share on other sites More sharing options...
cholla Posted October 28, 2005 CID Share Posted October 28, 2005 lorne;I looked for the Host file (windows ME) what I found was a HOSTS.SAM,&LMHOSTS.SAM these seem to be sample files the HOSTS.SAM looked like your example. I also found a hostperm.1 which was a FireFox Mozilla file this is a copy of it: # HTTP Permission File # This is a generated file! Do not edit. host cookie 2 100hot.com host cookie 2 247realmedia.com host cookie 2 247media.com host cookie 2 realmedia.fr host cookie 2 2o7.net host cookie 2 7adpower.com host cookie 2 7search.com host cookie 2 8ad.com host cookie 2 911promotion.com host cookie 2 adbureau.com host cookie 2 adbutler.com host cookie 2 adbutler.de host cookie 2 adbutler.net host cookie 2 addynamix.com host cookie 2 ad-flow.com host cookie 2 adforce.com host cookie 2 ad-logics.com host cookie 2 admonitor.net host cookie 2 admonitor.com host cookie 2 adorigin.com host cookie 2 ads360.com host cookie 2 ads360.net host cookie 2 adserver.com host cookie 2 adservingcentral.com host cookie 2 adtech.de host cookie 2 adtrak.net host cookie 2 advertising.com host cookie 2 adviva.com host cookie 2 adviva.net host cookie 2 Aureate.com host cookie 2 atdmt.com host cookie 2 bannerbank.net host cookie 2 bfast.com host cookie 2 bluestreak.com host cookie 2 HyperBanner.net host cookie 2 bpath.com host cookie 2 bridgetrack.com host cookie 2 brilliantdigital.com host cookie 2 centrport.net host cookie 2 centrport.com host cookie 2 click2net.com host cookie 2 clickagents.com host cookie 2 comclick.com host cookie 2 cometcursors.com host cookie 2 cometcursor.com host cookie 2 cometcursors.net host cookie 2 cometcursor.net host cookie 2 commission-junction.com host cookie 2 commission-junction.net host cookie 2 cj.com host cookie 2 qksrv.net host cookie 2 qksrv.com host cookie 2 commissionpartner.com host cookie 2 coremetrics.com host cookie 2 coremetrics.net host cookie 2 Counted.com host cookie 2 dbbsrv.com host cookie 2 directnetadvertising.com host cookie 2 directnetadvertising.net host cookie 2 BankAds.com host cookie 2 doubleclick.com host cookie 2 doubleclick.net host cookie 2 doubleclick.co.uk host cookie 2 engage.com host cookie 2 ads.enliven.com host cookie 2 epilot.com host cookie 2 e-plus.cc host cookie 2 euniverseads.com host cookie 2 excite.com host cookie 2 ezhits4u.com host cookie 2 falkag.com host cookie 2 falkag.de host cookie 2 falkag.org host cookie 2 fastadvert.com host cookie 2 fastclick.com host cookie 2 fastclick.net host cookie 2 findwhat.com host cookie 2 FlyCast.com host cookie 2 Flyswat.com host cookie 2 focalink.com host cookie 2 gator.com host cookie 2 gatoradvertisinginformationnetwork.com host cookie 2 hightrafficads.com host cookie 2 hitbox.com host cookie 2 hitboxcentral.com host cookie 2 hitslink.com host cookie 2 hotlog.ru host cookie 2 hotnaughtywives.com host cookie 2 infinite-ads.com host cookie 2 InternetFuel.com host cookie 2 link4ads.com host cookie 2 linkbuddies.com host cookie 2 linksynergy.com host cookie 2 lop.com host cookie 2 sckr.com host cookie 2 scrk.com host cookie 2 sdry.com host cookie 2 seld.com host cookie 2 sfux.com host cookie 2 sheat.com host cookie 2 sipo.com host cookie 2 smds.com host cookie 2 srib.com host cookie 2 srox.com host cookie 2 srsf.com host cookie 2 ssaw.com host cookie 2 ssby.com host cookie 2 surj.com host cookie 2 thko.com host cookie 2 wfix.com host cookie 2 wflu.com host cookie 2 ebch.com host cookie 2 ebdv.com host cookie 2 ebdw.com host cookie 2 ebjp.com host cookie 2 ebkn.com host cookie 2 ebky.com host cookie 2 eblv.com host cookie 2 ebvr.com host cookie 2 ecwz.com host cookie 2 ecyb.com host cookie 2 eduy.com host cookie 2 eeev.com host cookie 2 ibmx.com host cookie 2 icwb.com host cookie 2 icwo.com host cookie 2 icwp.com host cookie 2 iddh.com host cookie 2 idhh.com host cookie 2 ifiz.com host cookie 2 iguu.com host cookie 2 samz.com host cookie 2 saoe.com host cookie 2 sbjr.com host cookie 2 sbnl.com host cookie 2 sbnt.com host cookie 2 sbvr.com host cookie 2 scbm.com host cookie 2 tbvg.com host cookie 2 tdak.com host cookie 2 tdko.com host cookie 2 tefs.com host cookie 2 tfil.com host cookie 2 torc.com host cookie 2 wbkb.com host cookie 2 mainentrypoint.com host cookie 2 mainentrypoint.net host cookie 2 marketscore.com host cookie 2 marketscore.net host cookie 2 matchcraft.com host cookie 2 mediaplex.com host cookie 2 NarrowCastMedia.com host cookie 2 offshoreclicks.com host cookie 2 opentracker.com host cookie 2 opentracker.net host cookie 2 overture.com host cookie 2 oxcash.com host cookie 2 partnercash.de host cookie 2 paycounter.com host cookie 2 paypopup.com host cookie 2 ru4.com host cookie 2 pointroll.com host cookie 2 popupsponsor.com host cookie 2 popuptraffic.com host cookie 2 porntrack.com host cookie 2 porntracker.com host cookie 2 Preferences.com host cookie 2 pstats.com host cookie 2 questionmarket.com host cookie 2 Radiate.com host cookie 2 realtracker.com host cookie 2 realtracker.net host cookie 2 res99.com host cookie 2 roispy.com host cookie 2 sex-in-www.com host cookie 2 sexlist.com host cookie 2 sextracker.com host cookie 2 smartadserver.com host cookie 2 smartclicks.com host cookie 2 smartclicks.net host cookie 2 specificpop.com host cookie 2 spermatrix.com host cookie 2 spylog.com host cookie 2 targetnet.com host cookie 2 targetnet.net host cookie 2 track-star.com host cookie 2 tradedoubler.com host cookie 2 trafficmp.com host cookie 2 trafficmarketplace.com host cookie 2 clickfinders.com host cookie 2 trafficsupport.com host cookie 2 trafficvenue.net host cookie 2 trakkerd.net host cookie 2 tribalfusion.com host cookie 2 UtopiAd.com host cookie 2 servedfor.valuead.com host cookie 2 valuead.com host cookie 2 specificclick.net host cookie 2 valueclick.com host cookie 2 valueclick.ne.jp host cookie 2 valueclick.net host cookie 2 webads.com host cookie 2 webtrendslive.com host cookie 2 S005-01-4-11-234545-68181.com host cookie 2 wegcash.com host cookie 2 wegcash.net host cookie 2 X10.com host cookie 2 xxxcounter.com host cookie 2 xxxtoolbar.com Is this file supposed to look this way? There were a couple that are inside Spybot S&D I'm sure they are supposed to be there. I agree with organ_shifter on the system restore folders .You need to reboot after disabling these. One warning this deletes them & new ones are created when you reenable but if you need a system restore from before you disabled system restore it has been deleted. Quote Link to comment Share on other sites More sharing options...
lorne Posted October 28, 2005 CID Share Posted October 28, 2005 Cholla, i have never seen the like of that. I recognize about 80% of those names and they are all spyware. But that being a mozilla file and we know how good it is for blocking spyware that may be its own integrated immunization file. host cookie 2 100hot.com I believe the 2 stands for blocked, now we know why you don't get popups with FF Quote Link to comment Share on other sites More sharing options...
cholla Posted October 28, 2005 CID Share Posted October 28, 2005 The one I posted above was "hostperm.1" .I think you are correct & it is probably a spyware block file in fire fox. Just wanted to ask do others wit FireFox have the same file? Quote Link to comment Share on other sites More sharing options...
destructionfever Posted October 28, 2005 Author CID Share Posted October 28, 2005 I'm happy to say I'm reporting back to you guys on my old pc that was infected. All of your help led me to fix the spyware problem I was having. Thankyou to everyone who helped me last night. Quote Link to comment Share on other sites More sharing options...
lorne Posted October 28, 2005 CID Share Posted October 28, 2005 Good Stuff Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.