Popups won't stop

[JCrou82]

I'm getting alot of popups from pretty much the same address. I've been able to get the originators of these pop ups (azoogleads.com, azjmp.com, 69.20.62.53).

We are running Win XP. One of our users accidently clicked on the yes button to install some adware/malware/spyware. In any event, I went through the whole process of CWShredder, Ad-Aware, Spybot and HiJackThis! and still the popups are there. These aren't Internet pop-ups in the sense that they come up when the user is on the internet. These pop-ups occur somewhat on a timed basis and the come on wether or not the user is browsing the web or not. They just popup. If I leave the machine running for a few, after a while, that machine will have 5, 10 or more popups and nothing else will be running. Has any one else experienced this before?

PS. The only thing I haven't tried which I will do is to run the programs in safe mode to attempt to remove the spyware. But I tried this on another machine that has also been infected with this and it didn't seem to fix it.

Thanks

 

[carrr]

1) Are you disabling system restore before running your removal tools? If not, you MUST do so, else you're simply running in a circle.

2) Have you disabled Windows Messenger Service?

http://www.itc.virginia.edu/desktop/docs/messagepopup/

3) Have you run through the fixes enumerated here: faq608-4650 ?

All failing, post a hijack this! log in forum760 along with a description of your problems.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[smah]

This does sound like Messenger Service. If these are Messenger Service pop-ups, we've hit on one of my pet peeves. You can disable the Messenger Service to stop the pop-ups; but it doesn't cure the underlying problem that you are on the internet without a firewall!

 

[JCrou82]

I want to thank both of you for replying to this thread. I also want to thank you guys for pointing out those great links, specially the FAQ.

First, I would like to state that these aren't messenger service popups. Although I thank you for the Doc on disabling that ability. I've been lookin for a way to do that since it was done on my machine once by a friend and needed to do it on someone else's machine, but was never told how.

As for my users troubled system, I found the actual problem. After monitoring the popups, I came across a domain name in one of the popups, zestyfind.com. I ran a google search on this and came across a great web page that gave me a link to a VX2Finder app that searches for the VX2.BetterInternet adware/spyware. I went through the steps of removing VX2 and so far, I haven't gotten any pop-ups. I will do a restart later on today when the user has some down time. Thanks again all for your help. Just thought I'd post my solution to this problem as an archive and hopefully to help others.