Topic: Is it a new battle or a new war?

[joudi]

Some friends around me got a lot of pop-ups after restoring their PC?s with the restoration Cd.

I tried my best to help for no avail.

One of them has already SP1 in his system, but when trying to get the Windows update, his internet connection gets in troubles. It gets too slow and disconnects.

The other doesn?t have SP1, but the result is the same.    

Another got a pop-up without having the system restored, but unable to remove it.

I tried with them all to install the ?Ad-aware? and ?Spybot?, also the antivirus plus I tried with one of them the ?pop-up inspector?. Nothing worked.    

I?m surprised to the non efficiency of those programs, when I know that they can solve most of pop-ups problems especially with the help of the windows updates.

Wondering if the senders of those pop-ups have got recently more powerful than our systems.

Did anyone hear about that?

Any idea or suggestion?

What do you advice more than that as solutions?

Thank ?  

[Sandra]

Do you know if its the same popups on both PCs Joudi ?
Often one piece of software can bring a lot in attached to it that cant be found by adaware etc.
I find that if I do a search for the actual popup that comes up theres often a tool or a suggestion on a forum that helps to remove it  

[joudi]

Yes Sandra!

Both who did the restoration got most of similar pop-ups. (Adults sites publicity plus other things too).

[Sandra]

Well if you can find something they downloaded recently that they both have in common that should narrow it down hopefully  

[joudi]

Sandra, that happens just after the restoration. No time yet to the download.

One of them I worked by my own hand directly. After formatting and restoring the system I didn't connect it immediately to the internet. I installed first all those programs to prevent any ads. After that I connected it to the internet. As soon as it's connected to the net, it's infested by these things and it starts to slow down and cut the connection.

Never happened like that to me before.

The other friend is in another city. I'm trying to help by phone. He's telling me the same things which are happening to me here.

I'm really lost. I don't know if it's a new method against microsoft for those attackers.

[Sandra]

That sounds strange Joudi  
I cant think what it is thats got in so quickly on both pcs  

[Reno]

Did you fdisk and delete the previous partrician tables. The last couple of times i had that type of trouble it wasn't spyware it was a trojan. Some of them are quite resistant.

Did the machines belong to two different friends or were the two machines networked at one particular friend's place. Sometimes the worms enjoy fooling around on networks.

Also you could go to oldversion and pick up the patches and service packes and put them on cd, so you wouldn't have to connect online.

[Clive]

I have found that SP2 kills all pop-ups stone dead.  I use Avant and Mrs Clive uses IE6 and neither of us has seen a pop-up since installation.  You even get notification that a pop-up has been blocked.

[Dack]

You did do the run->services.msc and kill the messenger service after restoring didn't you? Otherwise you will get lots of popups through the messenger sub-system.

[joudi]

You did do the run->services.msc and kill the messenger service after restoring didn't you? Otherwise you will get lots of popups through the messenger sub-system.

No Dack !   I didn't change or modify anything.

I just wanted to help in restoring the internet connection after the computer CD restoration.

Well, at last, a neighbour was able to reconnect the internet after more than 5 hours of working on it. He formatted the HDD and installed windows. No SP1 or SP2 though. The internet connection is ok now, but the computer is full of folders of those ads installed already, and you can see them among the other programs and in the "Add and remove programs" section (control panel. I removed them twice: once manually and again by the help of "Spybot". Just after that, as soon as we rebooted the system they were all back.

We're afraid to download the windows updates (SP1 or SP2) because when we tried to do that before, it slowed and disconnected the internet.    

Well, I'll try to run any program of "trojan" remover, maybe the problem is there.  I don't know !!!      

[davy51]

It sounds like you have been hijacked by a couple different dialers.
If you turn off restore and remove them and then turn restore back on after.
That should stop them from coming back.
They are hideing in restore.

I had the same trojans and that was what i had to do

[Dack]

You did do the run->services.msc and kill the messenger service after restoring didn't you? Otherwise you will get lots of popups through the messenger sub-system.

No Dack !   I didn't change or modify anything.

Unless you do that you will leave yourself open to infection as soon as you connect to the internet. You also *NEED* the msblaster fix for similar reasons.

http://antivirus.about.com/b/a/034857.htm