Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
How to beat your advertising popups & other browser nasties
Removing adware & spyware
If you have popups appearing overly frequently, you may have some "adware" on your PC.
Adware, spyware, and browser hijackers are nasty beings, full of fang and poison to irritate, lurking in the dark damp corners of your PC.
You must go into battle suitably armed.
Your first steps in the assault should be to delete your internet browser's cache ("Temporary Internet Files" in IE) and to delete your cookies. If this doesn't work, use an adware removal program.
[color red]Windows XP users[/color]
Some malware programs install themselves as a required windows system file, which means Windows XP will restore the program after you've deleted. You should turn off system restore before you remove the spyware, then turn it back on after it's gone. Note: you will lose any previous restore points.
[color red]Adware removal programs[/color]
Spybot Search & Destroy
http://security.kolla.de/
http://downloads-zdnet.com.com/3000-2144-10194058.html?tag=lst-0-1
Adaware:
http://www.lavasoftusa.com/software/adaware/
http://downloads-zdnet.com.com/3000-2144-10186632.html?tag=lst-0-1
BHO demon - goes for the "Browser Helper Objects"
http://www.definitivesolutions.com/bhodemon.htm
Hijack This (counters homepage hijacking)
http://www.lurkhere.com/~nicefiles/
[color red]Windows Messenger Service[/color]
A second cause of popups is ads that target the Windows Messenger Service. These ads are not hosted on your PC, so there's nothing to clean off. You can either setup a firewall (and block the originating IPs or ports 131 and 139), or disable the messenger service completely.
Free personal firewall
http://www.free-firewall.org/
http://www.zonelabs.com/ (the site is a bit "salesy" - look for the free zonealarm download)
Disabling Windows messenger service
http://www.itc.virginia.edu/desktop/docs/messagepopup/
http://www.theeldergeek.com/messenger_removal.htm
http://www.whitehat-security.com/SPF/Messenger_Service_exploit.htm
[color red]Host file[/color]
Another way to block banners and popups is to prevent them from accessing their owner's website...you do this by editing your "hosts." file (normally found in the windows directory).
Hosts file editing (banner blocking)
http://www.ssw.com.au/SSW/KB/KB.asp?KBID=Q453237
EMS free surfer MK II (popup stopper)
http://www.kolumbus.fi/eero.muhonen/FS/Index.html
[color red]Preventing spyware from downloading[/color]
Spyware Blaster (for intercepting spyware BEFORE it installs)
http://www.wilderssecurity.net/spywareblaster.html
other advice sites
General spyware advice:
http://www.spyware.com
More about browser hijacking:
http://www.spywareinfo.com/articles/hijacked/
Tthanks to all the posters in the forums - this FAQ is essentially all of their information, carefully compiled
I'm just taking the credit!
If anything here is incorrect, out of date, or can be improved - please let me know by clicking the [color red]Send a Comment to manarth About This FAQ[/color] link below.
Adware, spyware, and browser hijackers are nasty beings, full of fang and poison to irritate, lurking in the dark damp corners of your PC.
You must go into battle suitably armed.
Your first steps in the assault should be to delete your internet browser's cache ("Temporary Internet Files" in IE) and to delete your cookies. If this doesn't work, use an adware removal program.
[color red]Windows XP users[/color]
Some malware programs install themselves as a required windows system file, which means Windows XP will restore the program after you've deleted. You should turn off system restore before you remove the spyware, then turn it back on after it's gone. Note: you will lose any previous restore points.
[color red]Adware removal programs[/color]
Spybot Search & Destroy
http://security.kolla.de/
http://downloads-zdnet.com.com/3000-2144-10194058.html?tag=lst-0-1
Adaware:
http://www.lavasoftusa.com/software/adaware/
http://downloads-zdnet.com.com/3000-2144-10186632.html?tag=lst-0-1
BHO demon - goes for the "Browser Helper Objects"
http://www.definitivesolutions.com/bhodemon.htm
Hijack This (counters homepage hijacking)
http://www.lurkhere.com/~nicefiles/
[color red]Windows Messenger Service[/color]
A second cause of popups is ads that target the Windows Messenger Service. These ads are not hosted on your PC, so there's nothing to clean off. You can either setup a firewall (and block the originating IPs or ports 131 and 139), or disable the messenger service completely.
Free personal firewall
http://www.free-firewall.org/
http://www.zonelabs.com/ (the site is a bit "salesy" - look for the free zonealarm download)
Disabling Windows messenger service
http://www.itc.virginia.edu/desktop/docs/messagepopup/
http://www.theeldergeek.com/messenger_removal.htm
http://www.whitehat-security.com/SPF/Messenger_Service_exploit.htm
[color red]Host file[/color]
Another way to block banners and popups is to prevent them from accessing their owner's website...you do this by editing your "hosts." file (normally found in the windows directory).
Hosts file editing (banner blocking)
http://www.ssw.com.au/SSW/KB/KB.asp?KBID=Q453237
EMS free surfer MK II (popup stopper)
http://www.kolumbus.fi/eero.muhonen/FS/Index.html
[color red]Preventing spyware from downloading[/color]
Spyware Blaster (for intercepting spyware BEFORE it installs)
http://www.wilderssecurity.net/spywareblaster.html
other advice sites
General spyware advice:
http://www.spyware.com
More about browser hijacking:
http://www.spywareinfo.com/articles/hijacked/
Tthanks to all the posters in the forums - this FAQ is essentially all of their information, carefully compiled
I'm just taking the credit!
If anything here is incorrect, out of date, or can be improved - please let me know by clicking the [color red]Send a Comment to manarth About This FAQ[/color] link below.