I have this pop up that just wont go away. It some pop up for getting payed to take surveys. Ad-Aware and Spybot S&D dont pick it up. I have Pop up blocker from panic ware and ad muncher. It keeps getting through all of those. Anyone have an idea how to get rid of these pop ups? Thanks for any info.

What browser do you use? IE is beat - try Mozilla Firefox - I haven't had a popup in months even without using Ad-Aware.

Yes, very good suggestion. Get Mozilla Internet Browser. It has a pop-up blocker built in it and it is just overall way better than IE. Download it here - http://www.mozilla.org.

Mozilla is the best real browser out there in my opinion, it is better than both netscape and ie.

This pop even appears even if a browser isnt open. >.<

Yes, I do use IE. I just got the mozzila firefox browser and I like it =)

does the popup appear if when your on the internet or when your off the net, or just gaming?

Kev is the pop up in a grey window? If it is you need to go to administrative tools in control panel open services scroll down to messenger, double click on it and change the start up type to disabled. Hit the stop button, apply, and then OK

Nope, its not a white box. It can appear while I am gaming. It wouldnt bother me too much except if Final Fantasy XI gets minimized for any reason(Alt-Tab, pop ups) the entire game will shut down.

So not even Mozilla blocked the pop up eh? And it ain't a system pop up you say? Try downloading Stopzilla or Ad Muncher. System Mechanic has a pop up blocker also.

Also, do you think you can describe to us what this pop up looks like and what it says?

Also, Spybot - Search & Destroy and Ad-Aware doesn't remove pop ups. They only scan and remove adware/spyware.

If you want, you should download SpywareBlaster and this will stop spyware and adware from entering the computer when browsing the net. This way you won't even need to use Spybot - Search & Destroy or Ad-Aware.

So scan computer, remove spyware/adware then use SpywareBlaster. No more spyware/adware will enter your computer.

The pop up is a girl sitting on her bed with a laptop on cofee. The ad says on it Get Paid to take Surveys! 5-150$ a survey and some other crap That I didnt bother reading.

Did you disable messenger in services.

Yes, I have it disabled.

save yourself a major headache just backup your important files and reinstall windows

You have some kind of advertising malware running on your computer. Are you using the latest version of Spybot V1.3? Why don't you download Hijack This, run the scan, and post it. You should be running spyware blaster and spyware guard, to prevent this. EMS FreeSurfer MK II is a good pop up blocker, but none of them are gonna work until you find out whats causing this one, and deleting it.

Get a registered copy of SpywareNuker. I've found it 100 times, if not, more, better then Spybot S&D. I scanned with latest updates with Spybot and Ad Aware. SpywareNuker still managed to find 700! more spyware / adware which spybot and ad aware didn't detect. I wasn't able to remove them since my copy wasn't registered.

Here is the log of Hijack this



Logfile of HijackThis v1.97.7
Scan saved at 5:48:15 PM, on 7/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Rage3DTweak\RegTwk.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\rage3dtweak\gameutil.exe
C:\WINDOWS\System32\WScript.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Free Surfer\fs20.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe
C:\Documents and Settings\Kevin\Desktop\Windower\Windower.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kevin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RegTweak] C:\Program Files\Rage3DTweak\RegTwk.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [Ad Muncher] C:\Program Files\Ad Muncher\AdMunch.exe /bt
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: gameutil.exe.lnk = ?
O4 - Global Startup: Search.vbs
O8 - Extra context menu item: Download using LeechGet - file://C:\Program Files\LeechGet 2003\\AddUrl.html
O8 - Extra context menu item: Download using LeechGet Wizard - file://C:\Program Files\LeechGet 2003\\Wizard.html
O8 - Extra context menu item: Parse with LeechGet - file://C:\Program Files\LeechGet 2003\\Parser.html
O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Free Surfer (HKLM)
O9 - Extra 'Tools' menuitem: Free Surfer (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_42.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.ap...taller.exe
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendm...scan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A19966F-AE0E-4699-8CCE-9B6F5F1C352C} (NPKXSite Control) - http://211.172.247.223/nprotect/npkx/npkxsite.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup145.cab

Hey Kev. Thats a hell of a long list there. OK First of all do you have Spybot S&D version 1.3. Open it up in advanced mode from the start/all programs menu. Hit tools, then BHOs. Highlight these two Browser helper items and post back telling me what they are

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Repoen Hijack This and put a check by this item and hit fix. Make sure no other programs are running. This is a hijacker.

O4 - Global Startup: Search.vbs


Here is part of your problem. You HAVE TO read these privacy statements when you sign up for some of these web sites. This entry

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab

Here is something from PopCaps privacy statement on their site:

None of the information you give us is shared outside PopCap.com. However, when one of our partners co-sponsors a promotion or contest with us, we may share the information collected for that contest or promotion only with our partners

C:\Program Files\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe

Same thing here with Square Enix

What types of information does Square Enix collect?

In order to give you the best experience on our Websites, Square Enix may collect information about you. Typically, we may ask you to submit personal and/or demographic information in connection with any one of the following features or services.

Website registration (including game-specific registration)
Email announcements
Online store
Message Boards
Contests, sweepstakes, and other promotions
Polls, surveys, or questionnaires
Online technical support
Other features such as tell a friend and customer service correspondence

Notice the point about polls surveys, questionaires? What you really need to do is go through this list and get rid of stuff you don't need. This for example has to load everytime you start your computer. Know what it's for? It's a program that creates popups to remind you to register some leadertech or Iomega product whose program you downloaded

O4 - Startup: PowerReg Scheduler V3.exe

Open up Spybot again and go to tools and hit system startup. As you go down the list highlight each one and a window should open and tell you what it is and if it is necessary. Anyway at least get rid of that one for sure everything else looks legit. I really want to know what those 2 BOs are though. Let me know how it goes. After tomorrow my kids coming for the weekend which usually means I won't be online very much so if I don't get back to you right away, thats why.

Thanks for the help but theres one thing about the first BHO(O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) ) when i go into S&D. The name is in italic and no description comes up. The second one O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) is Microsoft Money.

Run HJT again and check the 549B file and hit fix. let me know if you are still getting the pop up.

Thanks for all the help man. The pop ups havent been coming up for a while so I guess that did it. Thanks agian =D

P.S. Happy 4th of July!

Edit: Didnt notice it was 30 mins past 12 so Happy 30 minutes late 4th of July!

I'll keep my fingers crossed, and you weren't late. It's still only 10:32PM here in L.A.