[Archived] Ie Advertising Windows

[Paul]

Over the last week we have become plagued by a series of pop-up windows in IE that I''ve not experienced before. These open randomly behind the window I'm viewing and always have an address like this:

http://www.life.cover.net/?A=eye4 - Life Quotes - Windows Internet Explorer

The address is always the same but the bit between "www" and "Windows...." varies according to the advertiser. No porn so far, just competition prizes, windows (glass) and insurance etc.

I'm firewalled, pop blocker running, AVG is up to date with only two virus infections this year last one in July, Adaware, Spybot, and CA Yahoo, all updated and run last night, cleaned out some Tracking Cookies and MRUs. Despite this it is still happening.

I think it's something to do with Microsoft? My lad recently installed a new version of MSN and I think it started around the same time. Any suggestions as to where else to look or what to do? I have a restore point at the MSN update but haven't tried rolling back to there yet.

[Cocker]

Run this - Click (the green download icon should sort you out)

Latley I have found that Adaware and Spybot havent been able to get rid of certain things but this little chap seems to work a treat.

Remember to turn off system restore and restart in safe mode and then run the scans (if you dont and the threats are removed they may just be loaded again when you next reboot) Obviously turn system restore back on when you restart normally.

You could also check things like add/remove programmes - if anything dosent look right in here then remove it (it will probably jump out at you but dont just delete anything - google check it first if your not sure what it does)

You could also have a look in the process list (ctrl/alt/del) menu and see if there is anything strange in there - again, dont just kill it - ask google what it is first.

Hope that helps

[Paul]

Thanks Cocker I'll try that later

[Paul]

Well I ran that in Safe Mode with System Restore switched off and found a few bits I hadn't seen before. Also ran Adaware and Spybot afterwards. Adaware found a load of cookes and MRUs but nothing else. Followed this up with a full system scan with AVG and that found nothing. Then shut down rather than just restarting. So far there has been no recurrence of the unrequested advertising windows.

On start up I got this window:

The Window is called (i.e the blue banner at the top) Microsoft Visual C++ Runtime Library

and the messae it carried was:

Runtime Error

C:\Program Files\Kontiki\Kservice.exe

R6025

- pure virtual function call

I gather this is to do with BBC iPlayer so I guess it will fix itself at some point?

This suggests it is not me: http://support.microsoft.com/kb/125749

***************************************************************************************************

Spybot came up with this attempt at a Registry Change, which I denied:

C:\documents and settings\myname\local settings\application data "zmsfjf.exe" zmsfjf

A search then found in C: \Windows\Prefetch folders - ZMSFJF.EXE-12F7A7AC.pf

So do I remove this little .exe file or do I leave it where it is?

[Cocker]

Paul,

I am pretty sure the info that you need to stop this is in here - Click

[Paul]

Recently we've been plagued with advertising pop ups again, mostly from well known high street names. No amount of running spyware, checking this that or the other was effective. All the pop up windows are prefixed with CiD.

Quick tip for anyone else with this problem. If you have recently downloaded Windows Messenger 3 the CiD programme is bundled in with Messenger. To stop it go to Control Panel, Add/Remove Programmes, Windows Messenger. You will then have the option to remove the CiD software which runs these annoying little popups.

While doing this I also found a programme called Favorit which I haven't installed. Anyone know what this is? Google hasn't shown much yet.

[Paul]

While doing this I also found a programme called Favorit which I haven't installed. Anyone know what this is? Google hasn't shown much yet.

Got it. Another little pop up .exe that needs deleting