Insidouos pop up program...how do I get rid of it?

Marbles · « **on:** 15 Jun 2004, 10:49 pm »

I'm using my sons computer as mine is in the shop. He has some sort of insidious pop up program that I can't get rid of. It seems to work off of Internet explorer. I already have ad-aware, and it doesn't help with this program.

I beleive it actually resides somewhere in my internet explorer program.

Help me get rid of this please...thanks

jgubman · « **Reply #1 on:** 15 Jun 2004, 10:55 pm »

Hate those things. You're on windows I take it?

Spybot worked pretty well for my wife:
http://www.safer-networking.org/index.php?page=spybotsd

dogberry · « **Reply #2 on:** 15 Jun 2004, 11:25 pm »

Get the latest version of Spybot (1.3)

If Spybot doesn't get rid of it, it could also be a Col Web Search variant. Go to http://www.spywareinfo.com/~merijn/downloads.html and get the latest version of CWSShredder.

Whenever you fight spyware, always update the programs definitions (like fighting viruses) or update the program itself.

JoshK · « **Reply #3 on:** 15 Jun 2004, 11:44 pm »

I had one such pop up program that wouldn't quit. Spybot 1.3 didn't get rid of it so after some research I used adaware 6.0, that did the trick.

Your son should watch out for all those porns sites that infect your computer!

JohnR · « **Reply #4 on:** 16 Jun 2004, 12:41 am »

Install FireFox, that'll fix it!

http://www.mozilla.org/products/firefox/

Marbles · « **Reply #5 on:** 16 Jun 2004, 12:53 am »

Quote from: JoshK

I had one such pop up program that wouldn't quit. Spybot 1.3 didn't get rid of it so after some research I used adaware 6.0, that did the trick.

Your son should watch out for all those porns sites that infect your computer!

THANKS GUYS! Adaware 6.0 found some. Spybot 1.3 did better, and that shredder got rid of some, but I still have them

I think my son picked it up on Casino gambling sites. He goes there to play on line games. I have now deleted all links to them. The porn sites are OK if he wants to go there..he IS 12! When I was his age my dad would casually let me know where he "hid" his Playboys and Penthouse.

jgubman · « **Reply #6 on:** 16 Jun 2004, 01:01 am »

Make sure he doesn't bet your RM-40s on one of those sites!!!

mgalusha · « **Reply #7 on:** 16 Jun 2004, 01:11 am »

Rob,

Check your "hosts" file. It's usually located in c:\windows\system32\drivers\etc\. The file has no extension. I helped a friend get rid of one this past weekend that AdAware and Spybot wouldn't kill. We found that his hosts file had been modified and from the changes were able to figure out what it was and manually remove it. (the above directory applies to WinXP other versions are similar)

In his case it was "IGETNET". I don't know if this is what is on your son's pc, but it's worth checking. The links below may help.

http://securityresponse.symantec.com/avcenter/venc/data/adware.igetnet.html

http://www.spy-bot.net/IGetNet.asp

Good luck!

Carlman · « **Reply #8 on:** 16 Jun 2004, 01:22 am »

I seem to remember having a program running called 'Internet Explorer Optimizer' that was purely spyware. See if you have that in your programs.... I removed it with no ill effects and do not have pop-ups.

Marbles · « **Reply #9 on:** 16 Jun 2004, 02:03 am »

Carlman, that was one of the first I manually deleted.

Mike, I follwed the links, but those files were not there. There was another set of files in "system" (not 32) that was pcsvc.dll and others that looked like it could be a problem, but I couldn't delete the .exe one.

Thanks again for all your help.

It is now not as frequent, and only when IE is running.

nathanm · « **Reply #10 on:** 16 Jun 2004, 03:26 am »

Quote

I think my son picked it up on Casino gambling sites. He goes there to play on line games. I have now deleted all links to them. The porn sites are OK if he wants to go there..he IS 12! When I was his age my dad would casually let me know where he "hid" his Playboys and Penthouse.

Geez, you must be one of those Cool Dads who corrupts all the neighborhood kids!

My nephew, who is about that age or older got busted for porn surfing on my mom's computer. Oh the embarassment...surfing porn at Grandmas house - does it get any worse for a kid? Heh heh! My mom & dad managed to turn it into a nice extortion deal by promising not to tell his parents IF he kept his grades up at school. Talk about motivation! But really, there's higher class sites to visit for that stuff. domai.com, pretty much...

As far as pop up goes, my advice is the same as usual: use Mozilla, case closed. Yes, I know that's not the answer anyone wants to hear, but dang it if it ain't true.

mgalusha · « **Reply #11 on:** 16 Jun 2004, 03:31 am »

Rob,

It looks like the pcsvc.dll is part of "DelFin Media Viewer" and is most certainly spyware/adware.

Pest Patrol offers some information on removing it. http://www.pestpatrol.com/pestinfo/d/delfin_media_viewer.asp

BTW, I second the motion to use Firefox. Not only immue to all the IE attacks it's features are great and the price is certainly right. http://www.mozilla.org/products/firefox/

Mike

Marbles · « **Reply #12 on:** 16 Jun 2004, 03:34 am »

Quote from: nathanm

Geez, you must be one of those Cool Dads who corrupts all the neighborhood kids! But really, there's higher class sites to visit for that stuff. domai.com, ...

That domai.com is REALLY ART!!

very nice pics....I normally enjoy a lot lower class of naked women

but they are stellar on domai.

I do have a LOT of kids hanging out at my house, but at least I know what my kids are up too, and it ain't drugs (yet)!. Mainly it's video games.

Marbles · « **Reply #13 on:** 16 Jun 2004, 03:38 am »

Postmortem, I updated my Adaware 6.0 and re-scaned and it found a bunch more stuff. I appear to be clean at this point.

Thanks for all your help guys, it is appreciated.

MaxCast · « **Reply #14 on:** 26 Aug 2004, 04:56 pm »

Just got nailed by Download.Adware, adwareCDT and adware.lefeats.
Norton sends you to individual web pages to get rid of each manually. Some of the values that they say to delete are not there???? Can't get rid of them, any ideas???