Armat Posted June 26, 2004 Report Share Posted June 26, 2004 Recently for reasons beyond me I get pop ups every 20 sec.It is so annoying that I can’t use my internet anymore without getting harassed furthermore every time I start my computer I get new programs on my program list. I know my system has serious holes. Any suggestions? One annoying pop says .Microsoft internet connection provided by verizon and a huge add covering my whole computer screen and this one in particular annoys me the most since it appears every 30 sec and with different add. What is more disturbing that my internet provider is verizon so I doubt it is a legitimate verizon thing or may be.I am not sure. Please help me get rid of this pop ups. Any free antivirus programs out there?I got SP version. Quote Link to comment Share on other sites More sharing options...
vava Posted June 26, 2004 Report Share Posted June 26, 2004 Hi Armat, There are some basic preautions that you can take to avoid all those troubles... 1. Ensure that your version of windows is up to date. For that you go to the windows update site: Windows Update. You can follow the instructions at that site It's usually pretty easy, but if you've never updated your windows, you may need to download several modules, and even restart a few times. I know it's a pain, but it is necessary. 2. Once windows is updated, you'll may to install 3 things: - A decent anti-virus. Norton has a basic version that's not too expensive, and it will automatically update the virus definitions regularly. This is important. The next two are up to you... - A pop-up blocker, (you can use the google toolbar for your browser, it works!) See Google toolbar - A Spyware blacking program. Ad-aware works quite well. Download it here. Note that you should make sure that your system is free of any virus/spyware before beginning the updates. You can use the tools above. It make take some time at first, but it keeps your frustration level MUCH lower in the long term... Good luck Armat jan... Quote Link to comment Share on other sites More sharing options...
Armat Posted June 26, 2004 Author Report Share Posted June 26, 2004 (edited) Thanks Vav j I updated the latest microsoft fixes,I got google toolbar and ad-aware and still pop ups. I will call verizon monday and bitch. Vav you can't believe this?I found the virus. Shopnav and I found the file folder in my computer srng but amazingly it would not let me dellete the file.Some smart virus.What is scary that everytime I turn on the computer it updates itself.If you know how to dellete this virus let me know.thanks Edited June 26, 2004 by Armat Quote Link to comment Share on other sites More sharing options...
bellthecat Posted June 27, 2004 Report Share Posted June 27, 2004 It's NOT a virus so virus software won't help - it's a program that has installed itself on your PC and set itself so that it starts running as you start up Windows. There will probably be several of them, actually. One for the popups, and another that is adding links to your favourites list. If you press control-alt-del towards the end of the windows startup then you will see all the programs that are running at startup. I don't know what version of Windows you have - I'm still using 98 - on that you go to system tools, then system information then software environment then startup programs, to see all the programs that are starting at the same time as Windows starts. (Hmmm, I've just noticed on mine something called "Wet_me", which sounds suspicious!) It will also give the file locations so you can go and erase them manually. But before doing the erasing, on the same window go into tools and then system configuration utility. Choose the startup tab. You will see a list of all the programs there with a tickbox opposite each. You can disable them by unticking the box. I'll say goodby to "Wet_me.exe". Steve Quote Link to comment Share on other sites More sharing options...
bellthecat Posted June 27, 2004 Report Share Posted June 27, 2004 PS., be careful what you erase - many programs have a legitimate reason for being in the startup list. Quote Link to comment Share on other sites More sharing options...
Sip Posted June 27, 2004 Report Share Posted June 27, 2004 Armat, here is the info on Shopnav. It is actually classified as spyware and not a virus. Looks like Norton will remove it for you but follow their directions. They also provide a removal tool on the shopnav website here. --- Edit: Link updated. Quote Link to comment Share on other sites More sharing options...
Armat Posted June 28, 2004 Author Report Share Posted June 28, 2004 Thank you both for the tips.Sip their(shopnav) tools are not working.This thing is preetty strong.I delleted all files related to this program but still there.I am frustrated. Steve I will try your solution but the problem is this program attaches itself to other programs which would be hard to get rid off.I will try anyway.I will let you guys know how succeful I'll be. Quote Link to comment Share on other sites More sharing options...
vava Posted June 28, 2004 Report Share Posted June 28, 2004 Armat jan - sometimes running Norton to clean up an infected system is not a bad thing. Also, Ad-aware and similar programs can help keep you free of spyware. Of course, you can install ALL the protection you want, if the user (that's you BTW ) over-rides the safegaurds, and accepts to install various screensavers, toolbars, smilies, browser buddies, most of which the provenance is more or less unknown, then you're apt to have some problems. So be careful, bud I hope you're on your way to less frustating computing. Quote Link to comment Share on other sites More sharing options...
bellthecat Posted June 28, 2004 Report Share Posted June 28, 2004 Steve I will try your solution but the problem is this program attaches itself to other programs which would be hard to get rid off.I will try anyway.I will let you guys know how succeful I'll be. Don't quite know what you mean. It's attaching itself to Windows obviously, in the sense that it is adding itself on to other programs - but it can still be unattached since it is still a separate program residing on your hard disk somewhere - its just a matter of finding what it is and where it is located. First disable, then erase. The same system works for windows 2000, but I don't know for XP. If you are doubtful about erasing a file, then try renaming it first - perhaps put an exclamation mark in front of the name. Then the associated software will not be able to find and run it, but if it is not a spyware file but something important you can just take away the "!" and return it to its previous state. Quote Link to comment Share on other sites More sharing options...
DominO123 Posted June 28, 2004 Report Share Posted June 28, 2004 Thank you both for the tips.Sip their(shopnav) tools are not working.This thing is preetty strong.I delleted all files related to this program but still there.I am frustrated. Steve I will try your solution but the problem is this program attaches itself to other programs which would be hard to get rid off.I will try anyway.I will let you guys know how succeful I'll be. That thing is just like Spoton... just reinstall Windows and spare yourself all the trouble... they are worst than trojans, viruses and worms to get rid of. The most disgusting is that one for example(Spoton) is made by a compagny and it does not get sued... if I were to do something like this to a computer I would be arrested. Quote Link to comment Share on other sites More sharing options...
DominO123 Posted June 28, 2004 Report Share Posted June 28, 2004 Don't quite know what you mean. It's attaching itself to Windows obviously, in the sense that it is adding itself on to other programs - but it can still be unattached since it is still a separate program residing on your hard disk somewhere - its just a matter of finding what it is and where it is located. First disable, then erase. The same system works for windows 2000, but I don't know for XP. If you are doubtful about erasing a file, then try renaming it first - perhaps put an exclamation mark in front of the name. Then the associated software will not be able to find and run it, but if it is not a spyware file but something important you can just take away the "!" and return it to its previous state. They seems to duplicate in the ram and recopy themselves before the reboot. Maybe Sip can clarify about how it is done. But finding the oroginal "program" is nearly impossible, and everything about it you find out(files) after deletion they come back soon after. Quote Link to comment Share on other sites More sharing options...
bellthecat Posted June 28, 2004 Report Share Posted June 28, 2004 They seems to duplicate in the ram and recopy themselves before the reboot. Maybe Sip can clarify about how it is done. But finding the oroginal "program" is nearly impossible, and everything about it you find out(files) after deletion they come back soon after. If they are in ram then a reboot would clear the memory, wouldn't it. I think that there is a hidden second program that re-copies the actual active program when that is erased. The hidden program runs on startup, looks for the second program, and if it is not there then it makes a new copy of it. Then the second program runs and does its more obvious nefarious deeds. But I'm not an expert - though I've run into the same problem before and got rid of it through the method I wrote about, though I'm not sure if my PC was infected by exactly the same program (mine had an address registered in New Zealand). Its quicker than formatting your hard disk anyway - just re-installing Windows won't help since the unwanted spyware program will still be there on your disk and will just reinstall itself again. Steve Quote Link to comment Share on other sites More sharing options...
Sip Posted June 28, 2004 Report Share Posted June 28, 2004 Well, I think the symantec site does a pretty good job of outlining what shopnav does. There are several ways to run a program automatically in windows. The most commonly used method is by placing an item in the following registry locations: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run there is also the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run So the first thing to disable this bug would be to stop it's associated processes, remove the entries from the registery that will make it start the next time you reboot, and to delete (or replace) the affected DLLs. The link above does a nice step by step. For shopnav, if you see HKEY_LOCAL_MACHINE\Software\Srng HKEY_LOCAL_MACHINE\Software\Kugoo you sould remove them from the registry. --- somewhat techy info below --- When you reboot, the contents of your RAM become meaningless. Interestingly enough, we did some experiments with DRAM in one of the project classes I was supervising and the contents can sometimes stay in there for up to 24 hours without power!!! But tha doesn't make a difference ... the operating system will not go and execute random code from memory unless specifically told to do so. And if there is already malicious code in there that is going to make it do that, then it might as well start doing all the bad things it was going to do anyway and not rely on content of RAM. Quote Link to comment Share on other sites More sharing options...
Sasun Posted June 28, 2004 Report Share Posted June 28, 2004 They seems to duplicate in the ram and recopy themselves before the reboot. Maybe Sip can clarify about how it is done. But finding the oroginal "program" is nearly impossible, and everything about it you find out(files) after deletion they come back soon after. A while back I had a nasty virus (or warm) like that. The file in the start up group would kill my antivirus program so I could not update it and run to get rid of the whole thing. I was deleting the file and trying to reboot the machine but everytime a copy was created by a hidden program. To get rid of the nasty file I did a simple trick: 1) Delete the file. If you can't delete check if the file is read-only, if so change it. 2) Create a dummy file with exactly the same name and extension, at the same location. You can use noteapad for simplicity, it does not have to contain anything, and save it giving the file name and extension in quotes so that it doesn't add a .txt extension. 3) Make the new file READ ONLY (right click on the file and select properties, check the read only option). That way when you reboot the hidden program will see that that there is a file with the same name. In that case it either will not create a new one, or if it is smart enough will try to create a new file but since a read-only file with the same name exists it will not be able to overwrite it. Now you can reboot your computer without this bad file being created and all problems that it was creating will be gone though you better remove the hidden program as well. Quote Link to comment Share on other sites More sharing options...
vava Posted June 29, 2004 Report Share Posted June 29, 2004 Nice method Sasun - but in effect, your method treats the symptom neatly, but it does not get rid of the root of the problem: the code that's installing the spyware in the firstplace. Going into the registry keys is not for everday users - you can really mess things up if you don't know what you're doing - but it's porbably the most effective way of getting rid of these problems... Quote Link to comment Share on other sites More sharing options...
vava Posted June 29, 2004 Report Share Posted June 29, 2004 Oh and I just wanted to add - prevention is MUCH easier than all the troubleshooting steps you may have to take to restore your system. Quote Link to comment Share on other sites More sharing options...
Sasun Posted June 29, 2004 Report Share Posted June 29, 2004 Nice method Sasun - but in effect, your method treats the symptom neatly, but it does not get rid of the root of the problem: the code that's installing the spyware in the firstplace. Going into the registry keys is not for everday users - you can really mess things up if you don't know what you're doing - but it's porbably the most effective way of getting rid of these problems... Yes, sure. Since there is an established solution in Armat's case then that's what should be done. But if there is no good solution then perhaps one should not give up quickly and resintall Windows, it takes a lot of time and effort to do all the backups and reinstallations. There is often some kind of an easy trick like the one I tried for a temporary solution. As for playing with the registery, Armat probably should be very careful. Maybe it is better that he asks some techi guy to do it... in the meantime maybe he can try my trick. But I am wondering, Armat, is it really that bad to have pop up? Sometimes they make really nice pop-ups Quote Link to comment Share on other sites More sharing options...
Harut Posted June 29, 2004 Report Share Posted June 29, 2004 while we are at it... anyone know how to remove the "btv" (VX2) spyware? adware removes the registries associated with it, the btv.exe file, but can't delete the .dll file associated with it in the system32 folder, because it is in use. i stop the rundll32.exe process from the processes list, which lets me remove the dll file. (adware also removes it if i stop the rundll32 process before the scanning). however it comes back after restarting. this time with the same registery entries, the btv.exe file, but a different dll file (i guess it's created with a random name). i rebooted with safe mode, manually deleted the registery entries, the exe file, and the dll files, but it still comes back after rebooting. the interesting thing is that after cleaning everything (the exe file, the dll file, the registry entries) adaware doesn't recognise any "faulty" processes. so, i don't know how it recreates itself if it's not in the memory. the only thing i haven't done is scanning the master boot record. i just don't have any clean start up disks (no start up disks... kind of messed up for a computer person, isn't it...) you might just want to know that there were 30+ different spywares, 50+ spyware associated registery entries, 250+ spyware associated files, and 5+ trojan horses in this machine few days ago. i'm down to this one and can't kill it. Quote Link to comment Share on other sites More sharing options...
Armat Posted June 29, 2004 Author Report Share Posted June 29, 2004 Hi guys,Thanks for the suggestions.Ed is going to send me norton and I'll give it a try.Free adware does not remove the program but it shows I got 128 corrupt files and programs. My kids went to game sites and probably downloaded something but I read you don't even have to download anything just going infected sites is enough...modern day goghutiun.. Quote Link to comment Share on other sites More sharing options...
Sip Posted June 29, 2004 Report Share Posted June 29, 2004 Harut, here's some info that may help you: http://www.cexx.org/vx2.htm#vx2 Note that if VX2 keeps coming back, then maybe you haven't removed the source which keeps installing it. It seems to come with Audio Galaxy ... so if you have Audio Galaxy, you may have to remove that first. You should also check the run keys in the registery as I said above ... that's where most of these things get started. Either there, or as part of an IE helper. Quote Link to comment Share on other sites More sharing options...
Sasun Posted June 29, 2004 Report Share Posted June 29, 2004 modern day goghutiun.. Well, if you think of it, it is actually 'nviratvutiun' They give you free programs and you don't even have to download anything, what else do you want? OK, OK Armat jan, I am just being silly. Don't worry, you will solve the problem. Quote Link to comment Share on other sites More sharing options...
vava Posted June 29, 2004 Report Share Posted June 29, 2004 you might just want to know that there were 30+ different spywares, 50+ spyware associated registery entries, 250+ spyware associated files, and 5+ trojan horses in this machine few days ago. i'm down to this one and can't kill it. The proliferation of these kinds of 'nuisances' may be downfall of 'free' Internet. If I didn't know much about computers, the sheer amount of virus threats, spyware, and spam, would completely discourage me from buying a computer, or anything remotely related to computers. The industry had better get things under control.... Quote Link to comment Share on other sites More sharing options...
Sip Posted June 29, 2004 Report Share Posted June 29, 2004 On the bright side though, not too many of these "spyware" are malicious. They just invade privacy. Quote Link to comment Share on other sites More sharing options...
sev-mard Posted June 29, 2004 Report Share Posted June 29, 2004 Thanks Vav j I updated the latest microsoft fixes,I got google toolbar and ad-aware and still pop ups. I will call verizon monday and bitch. Vav you can't believe this?I found the virus. Shopnav and I found the file folder in my computer srng but amazingly it would not let me dellete the file.Some smart virus.What is scary that everytime I turn on the computer it updates itself.If you know how to dellete this virus let me know.thanks Argh I have the exact same thing! What a pain in the vorik, I can't figure out how to get rid of it either. Quote Link to comment Share on other sites More sharing options...
DominO123 Posted June 29, 2004 Report Share Posted June 29, 2004 Harut, here's some info that may help you: http://www.cexx.org/vx2.htm#vx2 Note that if VX2 keeps coming back, then maybe you haven't removed the source which keeps installing it. It seems to come with Audio Galaxy ... so if you have Audio Galaxy, you may have to remove that first. You should also check the run keys in the registery as I said above ... that's where most of these things get started. Either there, or as part of an IE helper. Where is the source? That thing is like spoton. I never had the same problems with virus, worms and trojans. Spywares are becoming very difficult to get rid of. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.