Help - Cannot Get Rid of Popups!!

Hello there,

I have tried several programs including SpyBot and Ad Aware and both programs say my system is clean but I keep getting popups that appear to be PurityScan type popups. I am also using the Google pop up blocker.

I am getting ads for partypoker.com, screensaver.com, clickspring.net, and several others and I cannot find the program that is causing this. I do have Hijack This and ran that program but nothing in the log seemed out of the ordinary. Any help or assistance would be greatly appreciated!!

Mike

 

Hi Mike,

Try looking in Add or Remove Programs fo ClickSpring or PurityScan and Uninstall them if found. Also, take a look for them in your Program Files Folder and Delete them if found.

It would probably be a good idea for you to take a spin through our Cleanup Tutorial as well:

READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan and Virus Removal

Please note the steps that you are able to complete and the ones that give you problems. Note that you need to be in Safe Mode with System Restore OFF and have the Viewing of Hidden Files ENABLED as per the instructions in the link. Make sure to do the Online Scans.

Post back and let us know how you fared. Also, send us a HijackThis Log. Make sure to follow the instructions below:

Note that your HijackThis should be up-to-date (v1.98.2) and MUST be extracted to its own safe folder - C:\Program Files\HijackThis!

If you need a Fresh Download of HJT, get it HERE: HijackThis 1.98.2

Also note that, before you scan, you MUST close all running programs including your web browser, e-mail and items in the system tray.

Please save your HJT Log and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

Chaslang or I will try to check back when we get a chance.

Best luck
PP

 

Hello,

Thanks again for your help! I followed all instructions to the letter and still the pop ups persist. Again, it looks very similar to the Clickspring or Purityscan style of pop-ups but I have ran all checks and these programs do not appear to be on my computer and I followed all of the other steps per the reply to my first post and I still have the same problem.

As requested, I ran Hijack This and here is my log that it created. Any help would be greatly appreciated!!

 

Hello again!

Can anyone help on this one? I am still being hit with pop ups that appear to be clickspring or purityscan type pop ups but those programs are not anywhere in my system. I followed all instructions on this website on how to search and clean my system for pop ups and even did the optional steps as well, with nothing showing up. I also ran the Hijack This program and posted in my previous message and also followed the steps for on this website for using Hijack This. Can someone look at my attached log (in my previous message) and let me know if you see something that should not be there. Is it possible there is a new, undetectable variant of Purityscan??

Thanks for your help!!!!

Mike

 

Here is my Hijack This log. I pasted it here just to make it easier to view and it goes with my previous posts. Again, thanks in advance for all of your help!!

Mike

 

Hey Mike,

You've got to be patient! Chaslang and I volunteer some of our free time in this forum to help people out, but we still have lives to attend to. Plus, it's the holiday season & free time can be scarce!


Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files is Enabled as per the tutorial.

Please look for this running process in Task Manager (Ctrl – Alt – Del) and end it if found: ?ttrib.exe

THEN, scan with HijackThis and Check the Boxes for the following:

O2 - BHO: (no name) - {6BD84178-B01D-57C2-8301-62550881284A} - C:\WINDOWS\system32\spth.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKCU\..\Run: [Avszmn] C:\WINDOWS\system32\?ttrib.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

Now boot into Safe Mode and DELETE the following if they should remain:

C:\WINDOWS\system32\?ttrib.exe
C:\WINDOWS\system32\spth.dll

Reboot to Normal Windows and Scan with HijackThis and attach that log. Chaslang or I will check back when we get a chance.

Best Luck
PP

 

Hello PP!

I totally understand the time constraints and forgive me if I came across as being impatient. I certainly do appreciate (and I am sure the others that use this forum as well), all the hard work and time that you and everyone else that assists in this forum puts in. You guys are providing a very valuable and excellent service and I am so very grateful for the assistance. I will go ahead and follow the instructions from your response and then post my log again. Again, thanks so much for all of the help!!

Warm regards,

Mike

 

I should thank you for giving me the opportunity to post that bit!
I started answering a few threads here and there to give Chaslang a little assistance - At the time, he was responding to something like 90% of the threads here. Now, frankly, I respond to more than I really have the time to address!
I feel kinda bad when people get ignored, but such is often the case in a free community Forum. . . . . And there I go again!

Let me know how you fare with the removal steps. Note that I left the 016 Stopzilla entry alone.

PP

 

Hello PP!!

Thanks again for all of your great help in this matter. I have attached my new Hijack This log per your instructions and it looks like the items you wanted deleted are no longer there. Let me know if this should fix the problem and if there is anything else I need to do to. Again, thanks so much for your great help and for the wonderful service you provide.

Have a great week!!!

Mike

Here is the log:

 

Hey Mike,

You're welcome! We are always happy to help. . . As long as it doesn' feel too much like work!

Your HJT Log looks good to me! Your machine should be OK now. How are things running?

Please prepare yourself for the canned speech:

You ought to implement some of Chaslang's recommendations, if you haven't already: How to protect yourself from malware!

I definitely recommend that you continue to use the following tools from the tutorial:
Ad-Aware SE Personal

SpyBot-Search & Destroy - Remember to use the "Immunize" feature

SpywareBlaster

These are all FREE! Just remember to Internet Update them regurlarly! They, along with a good Anti-Virus and Firewall & keeping your Windows up-to-date will do wonders in helping to keep Malware off your computer!

Best Regards
PP

 

Hello PP!!

Many thanks again for all of your fine help! The PC seems to be runnning just fine now and I think getting rid of that attrib.exe program did the trick. I have already been following many of Chaslang's recommendations so far and I will be sure to implement the others as well. I have been using Ad Aware, Spy Bot and SpyBlaster, and I will go ahead and implement one of the firewalls as well.

Again, thanks so much for the great help and have a wonderful holiday season!!

Warm regards,

Mike

 

Happy Holidays to you as well! May the coming year bring you peace and joy!

PP