popups GRRR..?

Question

I get random popups on firefox advertising some "Win-antivirus" which i know is fake.. how do i find the source, file or process that is instigating the popup?? i also get some on internet explorer...

and dont tell me to do an adaware scan, virus scan or spyware scan, cuz i did and it did nothing.....
Thank you for your help
Andrew

also i get popups from NSIS media and tribalfusion

i still get popups from Internet Explorer (bold.com videos, some with broken links), not from firefox anymore

Answer 1

Been there my friend. And I am pretty sure that you just got a TROJAN The actualy name of the trojan is:
TROJ_VUNDO.H
Trend Micro have removal details:

http://uk.trendmicro-europe.com/enterprise/vinfo/encyclopedia.php?LYstr=VMAINDATA&vNav=2&VName=TROJ_VUNDO.H


So, try this.
I use a hosts file from mvps.org, which seems pretty thorough. A download link is here - http://www.mvps.org/winhelp2002/hosts.zip

Try downloading the free FireFox browser from here - www.mozilla.org. Open it, go to Tools, Options, Web Features and check Block Popup Windows. This should give you some peace while you fix the problem. I use FireFox as my default browser but IE is still required to access Windows updates.

Vundo seems to have been getting more common recently. I would suggest you download the free trial of TrojanHunter from here - http://www.castlecops.com/downloads-file-83.html . Update it (Update button is at the top of the screen) but don't run it yet. Close the window, reboot into Safe Mode and run TrojanHunter. Hopefully this will find and clean the infection. If not then there is a manual fix detailed here - http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453079972

This fix involves editing the registry so please back it up first. Go to Start, Run, type regedit and click OK. In the regedit window go to File, Export and enter a name and a location to save the registry. Check the box next to Export Range - All at the bottom left and click Save. Close Regedit.

Follow the instructions under the heading Detection and Removal, halfway down the page. There are links in the instructions which tell you how to implement each stage of the instructions, but please post back if you're unsure and we'll help you through it.

I suggest you copy the info detailing the registry keys (the ones that start HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE) to notepad and print them out before proceeding - it will be handy if you need to delete and reboot.

After this I suggest running Spybot in Safe Mode as a precaution.
Also have look at Eric Howes' excellent site:
https://netfiles.uiuc.edu/ehowes/www/main-nf.htm
here is a wealth of information on securing your privacy whilst browsing the internet with links to various resources to do so.


Good Luck!

Answer 2

Popups from Winantivirus gennerally indicate a Vundo infection and you are correct, most "general purpose" removal tools do not work.

Look at these links. The free VundoFix tool should help you:
http://www.atribune.org/
http://www.atribune.org/content/view/24/2/

Good luck.

Answer 3

You need some good firewall software. Use Outpost Pro or Comodo Firewall. Also Comodo has some anti-popup software as well.

Answer 4

Try downloading Malware Bytes Anti-malware(free download). I think it works well. After downloading, scan your computer. It should take care of your problem. Good Luck. Mike

Answer 5

Down load yahoo tool bar for and install it