Guest Steve T Posted August 1, 2007 Posted August 1, 2007 Don't know what this is or how to get rid of it. Started popping up across my desktop over the weekend after, I think; downloaded some videos from Youtube with a converter. I have removed the program and Google's IE bar as I thought that was the problem. I have run my AV, Ad-Aware, Spybot and AVG's anti rootkit. Task manager shows it as a running process when it appears. I can shut it down, but after a while it pops up onto the desktop. It appears as an ad and sometimes just an advertisement for a product. Here it is translated with IE 6: You have an Internet site, a blog, a myspace page? You want an address short, original and sympathetic? http://www.C.LA proposes to you to create in two minutes your own domain name free and easy to retain. For example: http://www.myspace.com/tom becomes tom.c.la winsteadfan.free.fr becomes winsteadfan.c.la http://www.myspace.com/lespiedssurscene becomes lespiedssurscene.c.la! The free redirection functions by defect with a very discrete stringcourse at the foot of the page to avoid the abuses like the phishing. To make withdraw this stringcourse it is enough for you to establish a link towards http://www.C.LA and to warn us for validation. You profit thus from a free redirection and without publicity. Thanks, Steve T
Guest sgopus Posted August 1, 2007 Posted August 1, 2007 RE: pop up across desktop I don't have an answer for your problem, but just a comment. I had visited You tube and watched a video, soon after I started getting a download trojan, trying to install itself in my pc, luckly my AV software caught it. I suggest you try Adaware and spybot search and destroy and also hijack this. do not upload the log from hijackthis to this forum. "Steve T" wrote: > Don't know what this is or how to get rid of it. Started popping up across > my desktop over the weekend after, I think; downloaded some videos from > Youtube with a converter. I have removed the program and Google's IE bar as > I thought that was the problem. I have run my AV, Ad-Aware, Spybot and AVG's > anti rootkit. Task manager shows it as a running process when it appears. I > can shut it down, but after a while it pops up onto the desktop. It appears > as an ad and sometimes just an advertisement for a product. Here it is > translated with IE 6: > > You have an Internet site, a blog, a myspace page? You want an address > short, original and sympathetic? http://www.C.LA proposes to you to create in two > minutes your own domain name free and easy to retain. > > For example: > > http://www.myspace.com/tom becomes tom.c.la > > winsteadfan.free.fr becomes winsteadfan.c.la > > http://www.myspace.com/lespiedssurscene becomes lespiedssurscene.c.la! > > The free redirection functions by defect with a very discrete stringcourse > at the foot of the page to avoid the abuses like the phishing. To make > withdraw this stringcourse it is enough for you to establish a link towards > http://www.C.LA and to warn us for validation. You profit thus from a free > redirection and without publicity. > > > > Thanks, Steve T > > >
Guest David H. Lipman Posted August 1, 2007 Posted August 1, 2007 Re: pop up across desktop From: "Steve T" <stumas@NOBINGOcharter.net> | Don't know what this is or how to get rid of it. Started popping up across | my desktop over the weekend after, I think; downloaded some videos from | Youtube with a converter. I have removed the program and Google's IE bar as | I thought that was the problem. I have run my AV, Ad-Aware, Spybot and AVG's | anti rootkit. Task manager shows it as a running process when it appears. I | can shut it down, but after a while it pops up onto the desktop. It appears | as an ad and sometimes just an advertisement for a product. Here it is | translated with IE 6: | | You have an Internet site, a blog, a myspace page? You want an address | short, original and sympathetic? http://www.C.LA proposes to you to create in two | minutes your own domain name free and easy to retain. | | For example: | | http://www.myspace.com/tom becomes tom.c.la | | winsteadfan.free.fr becomes winsteadfan.c.la | | http://www.myspace.com/lespiedssurscene becomes lespiedssurscene.c.la! | | The free redirection functions by defect with a very discrete stringcourse | at the foot of the page to avoid the abuses like the phishing. To make | withdraw this stringcourse it is enough for you to establish a link towards | http://www.C.LA and to warn us for validation. You profit thus from a free | redirection and without publicity. | | Thanks, Steve T | For non-viral malware... Please download, install and update the following software... * Ad-aware SE 2007 http://www.lavasoft.de/ http://www.lavasoftusa.com/ http://www.lavasoft.de/ms/index.htm * SpyBot Search and Destroy v1.4 http://security.kolla.de/ http://www.safer-networking.org/microsoft.en.html * SuperAntiSpyware http://www.superantispyware.com/superantispywarefreevspro.html After the software is updated, I suggest scanning the system in Safe Mode. For viral malware... * Download MULTI_AV.EXE from the URL -- http://www.pctipp.ch/downloads/dl/35905.asp To use this utility, perform the following... Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS } Choose; Unzip Choose; Close Execute; C:\AV-CLS\StartMenu.BAT { or Double-click on 'Start Menu' in C:\AV-CLS } NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your FireWall to allow it to download the needed AV vendor related files. C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS} This will bring up the initial menu of choices and should be executed in Normal Mode. This way all the components can be downloaded from each AV vendor's web site. The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC. You can choose to go to each menu item and just download the needed files or you can download the files and perform a scan in Normal Mode. Once you have downloaded the files needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key during boot] and re-run the menu again and choose which scanner you want to run in Safe Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode. When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help file. http://www.ik-cs.com/multi-av.htm Additional Instructions: http://pcdid.com/Multi_AV.htm * * * Please report back your results * * * -- Dave http://www.claymania.com/removal-trojan-adware.html http://www.ik-cs.com/got-a-virus.htm
Guest Steve T Posted August 1, 2007 Posted August 1, 2007 Re: pop up across desktop Dave is there another site for this tool download, I don't speak German? I've tried Googleing but it keeps giving a site that's unavailable, and it is on your site too. Thanks, Steve T. "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:u%230VzC%230HHA.4816@TK2MSFTNGP04.phx.gbl... > From: "Steve T" <stumas@NOBINGOcharter.net> > > | Don't know what this is or how to get rid of it. Started popping up > across > | my desktop over the weekend after, I think; downloaded some videos from > | Youtube with a converter. I have removed the program and Google's IE bar > as > | I thought that was the problem. I have run my AV, Ad-Aware, Spybot and > AVG's > | anti rootkit. Task manager shows it as a running process when it > appears. I > | can shut it down, but after a while it pops up onto the desktop. It > appears > | as an ad and sometimes just an advertisement for a product. Here it is > | translated with IE 6: > | > | You have an Internet site, a blog, a myspace page? You want an address > | short, original and sympathetic? http://www.C.LA proposes to you to create in > two > | minutes your own domain name free and easy to retain. > | > | For example: > | > | http://www.myspace.com/tom becomes tom.c.la > | > | winsteadfan.free.fr becomes winsteadfan.c.la > | > | http://www.myspace.com/lespiedssurscene becomes lespiedssurscene.c.la! > | > | The free redirection functions by defect with a very discrete > stringcourse > | at the foot of the page to avoid the abuses like the phishing. To make > | withdraw this stringcourse it is enough for you to establish a link > towards > | http://www.C.LA and to warn us for validation. You profit thus from a free > | redirection and without publicity. > | > | Thanks, Steve T > | > > > For non-viral malware... > > Please download, install and update the following software... > > * Ad-aware SE 2007 > http://www.lavasoft.de/ > http://www.lavasoftusa.com/ > http://www.lavasoft.de/ms/index.htm > > * SpyBot Search and Destroy v1.4 > http://security.kolla.de/ > http://www.safer-networking.org/microsoft.en.html > > * SuperAntiSpyware > http://www.superantispyware.com/superantispywarefreevspro.html > > After the software is updated, I suggest scanning the system in Safe Mode. > > For viral malware... > > * Download MULTI_AV.EXE from the URL -- > http://www.pctipp.ch/downloads/dl/35905.asp > > To use this utility, perform the following... > Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS } > Choose; Unzip > Choose; Close > > Execute; C:\AV-CLS\StartMenu.BAT > { or Double-click on 'Start Menu' in C:\AV-CLS } > > NOTE: You may have to disable your software FireWall or allow WGET.EXE to > go through your > FireWall to allow it to download the needed AV vendor related files. > > C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS} > This will bring up the initial menu of choices and should be executed in > Normal Mode. > This way all the components can be downloaded from each AV vendor's web > site. > The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and > Reboot the PC. > > You can choose to go to each menu item and just download the needed files > or you can > download the files and perform a scan in Normal Mode. Once you have > downloaded the files > needed for each scanner you want to use, you should reboot the PC into > Safe Mode [F8 key > during boot] and re-run the menu again and choose which scanner you want > to run in Safe > Mode. It is suggested to run the scanners in both Safe Mode and Normal > Mode. > > When the menu is displayed hitting 'H' or 'h' will bring up a more > comprehensive PDF help > file. http://www.ik-cs.com/multi-av.htm > > Additional Instructions: > http://pcdid.com/Multi_AV.htm > > > * * * Please report back your results * * * > > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > http://www.ik-cs.com/got-a-virus.htm > >
Guest Plato Posted August 1, 2007 Posted August 1, 2007 Re: pop up across desktop Steve T wrote: > > Don't know what this is or how to get rid of it. Started popping up across > my desktop over the weekend after, I think; downloaded some videos from http://www.bootdisk.com/xptop20.htm#3 -- http://www.bootdisk.com/
Guest Leythos Posted August 1, 2007 Posted August 1, 2007 Re: pop up across desktop In article <e5VgUc#0HHA.536@TK2MSFTNGP06.phx.gbl>, stumas@NOBINGOcharter.net says... > Dave is there another site for this tool download, I don't speak German? > I've tried Googleing but it keeps giving a site that's unavailable, and it > is on your site too. Thanks, Steve T. http://www.pctipp.ch/index.cfm?pid=1411&pk=28470 The original site was taken down my a malicious zealot with a faked DMCA violation claim and the hosting company would not believe anyone that provided proof the file was legit. The link I posted above will take you directly to the download site, in about 10 seconds it should pop-up a download, save it to disk, run it once it's downloaded, and you'll love the results - the best cleaning tool I've used in ages. -- Leythos - Igitur qui desiderat pacem, praeparet bellum. - Calling an illegal alien an "undocumented worker" is like calling a drug dealer an "unlicensed pharmacist" spam999free@rrohio.com (remove 999 for proper email address)
Guest David H. Lipman Posted August 2, 2007 Posted August 2, 2007 Re: pop up across desktop From: "Leythos" <void@nowhere.lan> | | http://www.pctipp.ch/index.cfm?pid=1411&pk=28470 | | The original site was taken down my a malicious zealot with a faked DMCA | violation claim and the hosting company would not believe anyone that | provided proof the file was legit. | | The link I posted above will take you directly to the download site, in | about 10 seconds it should pop-up a download, save it to disk, run it | once it's downloaded, and you'll love the results - the best cleaning | tool I've used in ages. | Thanx Leythos :-) -- Dave http://www.claymania.com/removal-trojan-adware.html http://www.ik-cs.com/got-a-virus.htm
Guest Steve T Posted August 3, 2007 Posted August 3, 2007 Re: pop up across desktop Sorry it took so long to reply back. Here is what I did: Ran Ad-Aware Se, Spybot and SuperAnti all in Normal and Safe Modes. I ran my AV, CA; in both modes. I downloaded Multi_AV and ran all 4 modules in both modes. The first Sophos, in normal mode; found 7 infections and cleaned them all. It did not find anything in Safe Mode after. TrendMicro did not find any viruses McAfee found 1 possible virus but did not clean it Total files 259,147 Clean 257,425. Don't know why the disparity is there Kaspersky found 1 known virus, 2 virus bodies, disinfected 0, deleted 1 After all this, the pop up comes back up. First the body of the text that I included, then an ad later for phones, blogs, date services, porn, etc. Maybe I should just have Gateway go through the recovery process of restoring my PC to what it was when I first got it and then delete whatever backup files it creates? I can be selective of the data files I save. It won't be any youtube videos! Thanks, Steve T. "Plato" <|@|.|> wrote in message news:46b016b5$0$266$bb4e3ad8@newscene.com... > Steve T wrote: >> >> Don't know what this is or how to get rid of it. Started popping up >> across >> my desktop over the weekend after, I think; downloaded some videos from > > http://www.bootdisk.com/xptop20.htm#3 > > > > > -- > http://www.bootdisk.com/ > >
Guest Steve T Posted August 3, 2007 Posted August 3, 2007 Re: pop up across desktop I forgot to mention that it was pretty disheartening to see these pop ups come up while the AV's were doing their scans in normal mode. Did not occur in Safe Mode. Steve T. "Steve T" <stumas@NOBINGOcharter.net> wrote in message news:%23pAnMVi1HHA.5644@TK2MSFTNGP05.phx.gbl... > Sorry it took so long to reply back. Here is what I did: > Ran Ad-Aware Se, Spybot and SuperAnti all in Normal and Safe Modes. > I ran my AV, CA; in both modes. > I downloaded Multi_AV and ran all 4 modules in both modes. > The first Sophos, in normal mode; found 7 infections and cleaned them all. > It did not find anything in Safe Mode after. > TrendMicro did not find any viruses > McAfee found 1 possible virus but did not clean it > Total files 259,147 Clean 257,425. Don't know why the disparity is there > Kaspersky found 1 known virus, 2 virus bodies, disinfected 0, deleted 1 > After all this, the pop up comes back up. First the body of the text that > I included, then an ad later for phones, blogs, date services, porn, etc. > Maybe I should just have Gateway go through the recovery process of > restoring my PC to what it was when I first got it and then delete > whatever backup files it creates? I can be selective of the data files I > save. It won't be any youtube videos! Thanks, Steve T. > "Plato" <|@|.|> wrote in message > news:46b016b5$0$266$bb4e3ad8@newscene.com... >> Steve T wrote: >>> >>> Don't know what this is or how to get rid of it. Started popping up >>> across >>> my desktop over the weekend after, I think; downloaded some videos from >> >> http://www.bootdisk.com/xptop20.htm#3 >> >> >> >> >> -- >> http://www.bootdisk.com/ >> >> > >
Guest Guest Posted August 4, 2007 Posted August 4, 2007 Re: pop up across desktop Hey Steve, I knew all these popup ads and especially those antispyware sponsor companies. It also happened to me when a searched The Rose song by Bette Midler on Google. Why not fights fire with fire? Use one of their software and this is very good: http://www.superantispyware.com download it and upgrade immediately then press Scan Your Computer button then check all your hard drives and tick Complete Scan and Next button to start scanning. Delete everything it found. Just remember to scan PC after every online visits (the free HOME edition is sufficient for your needs) if you like Real Time Protection then you've to buy their Professional edition. Wish US Congress do something to clean-up the dirty Internet and WWW. -Rino "Steve T" <stumas@NOBINGOcharter.net> wrote in message news:#N3xzXi1HHA.4680@TK2MSFTNGP03.phx.gbl... > I forgot to mention that it was pretty disheartening to see these pop ups > come up while the AV's were doing their scans in normal mode. Did not occur > in Safe Mode. Steve T. > "Steve T" <stumas@NOBINGOcharter.net> wrote in message > news:%23pAnMVi1HHA.5644@TK2MSFTNGP05.phx.gbl... > > Sorry it took so long to reply back. Here is what I did: > > Ran Ad-Aware Se, Spybot and SuperAnti all in Normal and Safe Modes. > > I ran my AV, CA; in both modes. > > I downloaded Multi_AV and ran all 4 modules in both modes. > > The first Sophos, in normal mode; found 7 infections and cleaned them all. > > It did not find anything in Safe Mode after. > > TrendMicro did not find any viruses > > McAfee found 1 possible virus but did not clean it > > Total files 259,147 Clean 257,425. Don't know why the disparity is there > > Kaspersky found 1 known virus, 2 virus bodies, disinfected 0, deleted 1 > > After all this, the pop up comes back up. First the body of the text that > > I included, then an ad later for phones, blogs, date services, porn, etc. > > Maybe I should just have Gateway go through the recovery process of > > restoring my PC to what it was when I first got it and then delete > > whatever backup files it creates? I can be selective of the data files I > > save. It won't be any youtube videos! Thanks, Steve T. > > "Plato" <|@|.|> wrote in message > > news:46b016b5$0$266$bb4e3ad8@newscene.com... > >> Steve T wrote: > >>> > >>> Don't know what this is or how to get rid of it. Started popping up > >>> across > >>> my desktop over the weekend after, I think; downloaded some videos from > >> > >> http://www.bootdisk.com/xptop20.htm#3 > >> > >> > >> > >> > >> -- > >> http://www.bootdisk.com/ > >> > >> > > > > > >
Guest Steve T Posted August 4, 2007 Posted August 4, 2007 Re: pop up across desktop This is one of the anti-spyware programs I've used. Still no cure. Steve T. "< < Rino > >" <noemail@email.com> wrote in message news:eC4jA6u1HHA.1208@TK2MSFTNGP03.phx.gbl... > Hey Steve, I knew all these popup ads and especially those antispyware > sponsor companies. > It also happened to me when a searched The Rose song by Bette Midler on > Google. Why not fights > fire with fire? Use one of their software and this is very good: > http://www.superantispyware.com > download it and upgrade immediately then press Scan Your Computer button > then check all your > hard drives and tick Complete Scan and Next button to start scanning. > Delete everything it found. > > Just remember to scan PC after every online visits (the free HOME edition > is sufficient for your needs) > if you like Real Time Protection then you've to buy their Professional > edition. > > Wish US Congress do something to clean-up the dirty Internet and WWW. > > -Rino > > > > > "Steve T" <stumas@NOBINGOcharter.net> wrote in message > news:#N3xzXi1HHA.4680@TK2MSFTNGP03.phx.gbl... >> I forgot to mention that it was pretty disheartening to see these pop ups >> come up while the AV's were doing their scans in normal mode. Did not >> occur >> in Safe Mode. Steve T. >> "Steve T" <stumas@NOBINGOcharter.net> wrote in message >> news:%23pAnMVi1HHA.5644@TK2MSFTNGP05.phx.gbl... >> > Sorry it took so long to reply back. Here is what I did: >> > Ran Ad-Aware Se, Spybot and SuperAnti all in Normal and Safe Modes. >> > I ran my AV, CA; in both modes. >> > I downloaded Multi_AV and ran all 4 modules in both modes. >> > The first Sophos, in normal mode; found 7 infections and cleaned them >> > all. >> > It did not find anything in Safe Mode after. >> > TrendMicro did not find any viruses >> > McAfee found 1 possible virus but did not clean it >> > Total files 259,147 Clean 257,425. Don't know why the disparity is >> > there >> > Kaspersky found 1 known virus, 2 virus bodies, disinfected 0, deleted 1 >> > After all this, the pop up comes back up. First the body of the text >> > that >> > I included, then an ad later for phones, blogs, date services, porn, >> > etc. >> > Maybe I should just have Gateway go through the recovery process of >> > restoring my PC to what it was when I first got it and then delete >> > whatever backup files it creates? I can be selective of the data files >> > I >> > save. It won't be any youtube videos! Thanks, Steve T. >> > "Plato" <|@|.|> wrote in message >> > news:46b016b5$0$266$bb4e3ad8@newscene.com... >> >> Steve T wrote: >> >>> >> >>> Don't know what this is or how to get rid of it. Started popping up >> >>> across >> >>> my desktop over the weekend after, I think; downloaded some videos >> >>> from >> >> >> >> http://www.bootdisk.com/xptop20.htm#3 >> >> >> >> >> >> >> >> >> >> -- >> >> http://www.bootdisk.com/ >> >> >> >> >> > >> > >> >> > >
Guest Steve T Posted August 6, 2007 Posted August 6, 2007 Re: pop up across desktop I had ZoneAlarm Pro on my PC but removed it about a month ago because of the slow boot times and "popular" opinion is if you already have a router (I do) don't use another firewall. I just used the XP firewall. I had re-installed Zone Alarm prior to your suggestion and did not experience the pop ups. I received an alert about "isys32.exe" trying to access the internet, which I declined at first. The second time I allowed it access and it is the culprit! I got connected to that damn French website (xxx.pourxxxx.x.xx). I set Zone Alarm to Kill this program and then found it in Windows\System32 and deleted it. No more pop ups for the last couple of hours anyway. Anybody know what this isys32.exe file is anyway? A search brought up a bunch of spyware topics so that must have been it. I'll get back to you if it happens again. Curious why none of the AV or spyware programs could find it. Thanks, Steve T. "Steve T" <stumas@NOBINGOcharter.net> wrote in message news:OCqE98u1HHA.5740@TK2MSFTNGP04.phx.gbl... > This is one of the anti-spyware programs I've used. Still no cure. Steve > T. > "< < Rino > >" <noemail@email.com> wrote in message > news:eC4jA6u1HHA.1208@TK2MSFTNGP03.phx.gbl... >> Hey Steve, I knew all these popup ads and especially those antispyware >> sponsor companies. >> It also happened to me when a searched The Rose song by Bette Midler on >> Google. Why not fights >> fire with fire? Use one of their software and this is very good: >> http://www.superantispyware.com >> download it and upgrade immediately then press Scan Your Computer button >> then check all your >> hard drives and tick Complete Scan and Next button to start scanning. >> Delete everything it found. >> >> Just remember to scan PC after every online visits (the free HOME edition >> is sufficient for your needs) >> if you like Real Time Protection then you've to buy their Professional >> edition. >> >> Wish US Congress do something to clean-up the dirty Internet and WWW. >> >> -Rino >> >> >> >> >> "Steve T" <stumas@NOBINGOcharter.net> wrote in message >> news:#N3xzXi1HHA.4680@TK2MSFTNGP03.phx.gbl... >>> I forgot to mention that it was pretty disheartening to see these pop >>> ups >>> come up while the AV's were doing their scans in normal mode. Did not >>> occur >>> in Safe Mode. Steve T. >>> "Steve T" <stumas@NOBINGOcharter.net> wrote in message >>> news:%23pAnMVi1HHA.5644@TK2MSFTNGP05.phx.gbl... >>> > Sorry it took so long to reply back. Here is what I did: >>> > Ran Ad-Aware Se, Spybot and SuperAnti all in Normal and Safe Modes. >>> > I ran my AV, CA; in both modes. >>> > I downloaded Multi_AV and ran all 4 modules in both modes. >>> > The first Sophos, in normal mode; found 7 infections and cleaned them >>> > all. >>> > It did not find anything in Safe Mode after. >>> > TrendMicro did not find any viruses >>> > McAfee found 1 possible virus but did not clean it >>> > Total files 259,147 Clean 257,425. Don't know why the disparity is >>> > there >>> > Kaspersky found 1 known virus, 2 virus bodies, disinfected 0, deleted >>> > 1 >>> > After all this, the pop up comes back up. First the body of the text >>> > that >>> > I included, then an ad later for phones, blogs, date services, porn, >>> > etc. >>> > Maybe I should just have Gateway go through the recovery process of >>> > restoring my PC to what it was when I first got it and then delete >>> > whatever backup files it creates? I can be selective of the data files >>> > I >>> > save. It won't be any youtube videos! Thanks, Steve T. >>> > "Plato" <|@|.|> wrote in message >>> > news:46b016b5$0$266$bb4e3ad8@newscene.com... >>> >> Steve T wrote: >>> >>> >>> >>> Don't know what this is or how to get rid of it. Started popping up >>> >>> across >>> >>> my desktop over the weekend after, I think; downloaded some videos >>> >>> from >>> >> >>> >> http://www.bootdisk.com/xptop20.htm#3 >>> >> >>> >> >>> >> >>> >> >>> >> -- >>> >> http://www.bootdisk.com/ >>> >> >>> >> >>> > >>> > >>> >>> >> >> > >
Recommended Posts