Automatic popup windows in IE

This is a discussion on Automatic popup windows in IE within the Windows Programming forums, part of the Platform Specific Boards category; I think I have some spyware on my computer. Every time I open IE and load up a page, any ...

  1. #1
    mustang benny bennyandthejets's Avatar
    Join Date
    Jul 2002
    Posts
    1,401

    Automatic popup windows in IE

    I think I have some spyware on my computer. Every time I open IE and load up a page, any page, another IE window pops up and quickly closes. What causes this to happen? Is there a relevant part of the registry I can look at to get rid of this problem?
    benforbes@optusnet.com.au
    Microsoft Visual Studio .NET 2003 Enterprise Architect
    Windows XP Pro

    Code Tags
    Programming FAQ
    Tutorials

  2. #2
    Sweet
    Join Date
    Aug 2002
    Location
    Tucson, Arizona
    Posts
    1,801
    Have you tried ad-aware benny?
    Woop?

  3. #3
    Registered User
    Join Date
    Sep 2004
    Location
    California
    Posts
    3,246
    Run both Ad-Aware and Spybot S&D. Chances are you have an unwanted BHO loaded into IE.

  4. #4
    mustang benny bennyandthejets's Avatar
    Join Date
    Jul 2002
    Posts
    1,401
    Yes I know I could do that but naturally as a programmer I would like to know what's going on underneath the hood. Of course, Windows and IE are so stupidly complex that something simple like this isn't obvious. I'll bet Mozilla and Firefox don't have these problems.
    benforbes@optusnet.com.au
    Microsoft Visual Studio .NET 2003 Enterprise Architect
    Windows XP Pro

    Code Tags
    Programming FAQ
    Tutorials

  5. #5
    Registered User
    Join Date
    Sep 2004
    Location
    California
    Posts
    3,246
    "I would like to know what's going on underneath the hood"
    Do a search for BHO (Browser Helper Objects). That should give you an idea of what is going on.

  6. #6
    Registered User Rare177's Avatar
    Join Date
    May 2004
    Posts
    214
    or you could find out what spyware it is and then do a search on google..that could maybe give you some info.
    i believe hijackthis is suppose to be a good spyware remover for browsers.

  7. #7
    Registered User
    Join Date
    Sep 2004
    Posts
    123
    Yes, HijackThis is a good tool for detecting malware.

    Basically it works by scanning certain areas of your system Registry and other area where bad things are known to lurk.

    But there's a warning - much of what it lists is either harmless or essential to the running of your system, so you really have to know what you're doing in order to know what to remove!

    Some of the latest variants of a particular parasite known as CoolWebSearch (CWS) are especially difficult to remove, and cannot be removed using HijackThis alone.

    They work by installing a "super-hidden" DLL file, which is loaded on WinXP systems with very strange permissions. This causes it to become invisible within Windows. But it can still be executed, and it will create a randomly-named BHO along with all the usual search / home page hijackings. Fix these and the randomly-named BHO only gives a few hours relief at best because the "super-hidden" DLL, the primary infection if you like, is still at large.

    Another trick it uses is to add a new 'service' - visible in the services.msc functionality. Look for one called Network Security Services or one with a random, non-English characters in its name, and if present, disable it.

    But before getting this agressive, try this. Download a little utility called CWShredder from my mirror here: www.angmail.fsnet.co.uk/angoid/CWShredder.exe. Save it to your Desktop. It was written by Merijn, the same Merijn of HijackThis fame.

    Close ALL applications down, including and especially browser windows and Explorer windows, then run CWShredder. Let it run its course. When it has finished, you must reboot your system.

    As an aside, make sure you're using Ad-Aware SE (6.181 is now out-of-date) and Spybot S&D version 1.3 (1.2 is no longer being maintained).

    Here are some good forums where HijackThis logs are routinely analysed: Go here if you are still having problems or if you disabled the service mentioned previously.

    www.spywareinfo.com (may be inaccessible due to an ongoing DDoS attack)
    www.tomcoyote.org
    www.suggestafix.com - under Viruses and Malicious Code

    plus others.
    Last edited by Driver; 09-09-2004 at 06:35 AM.

  8. #8
    It's full of stars adrianxw's Avatar
    Join Date
    Aug 2001
    Posts
    4,831
    As I often do, and in particular when dealing with threads on a subject like this, I would advise caution downloading and running an unknown .exe.
    Wave upon wave of demented avengers march cheerfully out of obscurity unto the dream.

  9. #9
    Registered User
    Join Date
    Sep 2004
    Posts
    123
    As I often do, and in particular when dealing with threads on a subject like this, I would advise caution downloading and running an unknown .exe.
    A sentiment with which I wholehertedly agree.

    However, I've recommended the use of CWShredder on other boards (such as the ones I referred to) and I'm not like that - to recommend 'fixes' that I know do more damage.

    I read HJT logs over there, but need to keep a lid on the forums I do so otherwise you get overloaded with forums and never get to do anything else.

    I've mirrored the program on my site simply because SpywareInfo, which usually hosts it, is under a persistent DDoS attack. Many others who have helped with spyware problems have done the same.

    Clearly advice given here can be followed or left - but please be aware that not all spyware cleaners do what they say they will do.

    CWShredder was written by Merijn, the author of HijackThis, and run the program from time to time on my own machine 'just in case'.

    Again, if you don't believe me, just do a Google search for CWShredder and follow a few of the links you get.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. how to make a windows application
    By crvenkapa in forum C++ Programming
    Replies: 3
    Last Post: 03-26-2007, 09:59 AM
  2. Script errors - bool unrecognized and struct issues
    By ulillillia in forum Windows Programming
    Replies: 10
    Last Post: 12-18-2006, 03:44 AM
  3. Question..
    By pode in forum Windows Programming
    Replies: 12
    Last Post: 12-19-2004, 06:05 PM
  4. Manipulating the Windows Clipboard
    By Johno in forum Windows Programming
    Replies: 2
    Last Post: 10-01-2002, 09:37 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21