Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

UNWANTED WEB SITES 2

Status
Not open for further replies.

moveit

Technical User
Joined
Sep 30, 2002
Messages
266
Location
GB
Just over a week ago I started getting additional web pages popping up. When I visited sites I usually go to, I keep getting a second web page. The three I get are: any-purpose-loan.co.uk, ad-doubleclick.net, winantivirus.com. The first one is an advert but the other two are just blank pages. I have Zone-alarm firewall, Norton anti-virus, Spystopper and have just recently loaded Counterspy to see if that helps. I also have a router that has a built in firewall. I run Spybot and Ad-aware once a week at least. I have done nothing different that should make this problem happen. I assume there is some sort of spy-ware but cannot understand why the various software does not clear. Suggestions please.
 
Do adaware or spybot find stuff they can't remove?

Try other anti-spyware apps - eg, windows defender (sorry, doesn't run on 2k any more without a tweak), AVG.

Download and install autoruns (google for it) and just look through the entries for possible trouble makers

Download and run hijackthis - please don't post the log here if you use the log option. I'd just look through the entries for possible problems.

You may have a version of something called vundo or virtuamonde among other names. There are various fixes available for this tenacious beast if you google (some work better than others).
 
Hi wolluf

Spybot finds one called smitfraud-c.toolbar888

It says it has removed it but when I re-run Spybot it is still there. I will try what you have suggested and will let you know the out come.
 
For things like double click, run spybot first to remove them initially, then to prevent recurrence, modify your winnt\system32\drivers\etc\host file. Just add something like
Code:
127.0.0.1 ad-doubleclick.net
When your browser tries to get something from the annoying site, it goes to your local site, does not find anything and does not do anything.

If they do it by addresses, you can also fake the addresses either on your network settings or in your host file.

The 888 thing might be running as a service. Check your task manager. If it is, go to admin tools/services and stop the service then remove the service using regsvr32 /u
 
moveit - smitfraud is another name for vundo etc
 
I have tried the various software removal programs and after running some three times my computer seems okay at the moment. Thanks to you both for your help.
 
Spybot - Search and Destroy version 1.5.1 to date can write over 6,600 entries to the HOSTS file linking bad domains to 127.0.0.1

Also, have a look at
I have combined the two sets into one big HOSTS file thus closing off thousands of ad sites and other rubbish. It does wonders for your Internet performance. The very large HOSTS file (783kb) does not create a performance hit - far from it!

Always expect the unexpected and imagine the unimaginable.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top