Spyware

[Farangchopthai]

I am getting this annoying Pop up for the last 24 hours from http://66.48.81.166/bonus.php

Spybot does not detect nor Avast anti virus any other solutions ?

I am running Xp pro .

[Monroe]

I am getting this annoying Pop up for the last 24 hours from http://66.48.81.166/bonus.php

Spybot does not detect nor Avast anti virus any other solutions ?

I am running Xp pro .

Give Norton a try.

Here's a link for a free trial:

http://shop.symantecstore.com/servlet/Cont...ductID=63489500

*Edit*

Before anyone asks, Symantec is the parent company of Norton and I'm not just trying to sell something. Above isn't a direct link to the download, but it's halfway there, you just need to fill in some of the information in the later stages, etc...

Also, Norton is pretty well known and possibly the most widely used in the US by people who can afford it and the annual subscription fee, but the link I've given you is only for a 15-day free trial of the full product.

Edited July 16, 2007 by Monroe

[Mid]

it's not on your comp ,

get yourself a pop-up blocker ,

most likely just a case of turning it on ,

what browser are you using ?

[cdnvic]

It's resolves to Clicksor and the IP is owned by Verizon so it likely won't be spyware.

For god's sake don't put that fool program (Norton) on your system. It's the first thing I uninstall when buying a new PC. Resource hungry, cumbersome, and bloated. You'd be better off with most spyware IMO.

[Farangchopthai]

it's not on your comp ,

get yourself a pop-up blocker ,

most likely just a case of turning it on ,

what browser are you using ?

Have both IE and Mozilla and Pop up blockers activie on both

[Monroe]

It's resolves to Clicksor and the IP is owned by Verizon so it likely won't be spyware.

For god's sake don't put that fool program (Norton) on your system. It's the first thing I uninstall when buying a new PC. Resource hungry, cumbersome, and bloated. You'd be better off with most spyware IMO.

Meh, but it's good for at least one use =/ Then you can delete it knowing full well that you're computer's been purified =)

I, personally, choose to keep it on and have my father cough up the subscription money =) woo

*edit: spelling and grammar*

Edited July 16, 2007 by Monroe

[Mid]

Have both IE and Mozilla and Pop up blockers activie on both

cdnvic , your up

[Farangchopthai]

It's resolves to Clicksor and the IP is owned by Verizon so it likely won't be spyware.

For god's sake don't put that fool program (Norton) on your system. It's the first thing I uninstall when buying a new PC. Resource hungry, cumbersome, and bloated. You'd be better off with most spyware IMO.

I agree about Norton,,,,,,over my dead body ,,,,,,,etc........I was probably wrong to call it a pop up it's a window that opens with that initial Url , then converts to Clicksor ,then opens a variety of Porn sites ! it

[cdnvic]

If running Firefox, get the Adblock-plus addon and add http://66.48.81.* to the list of blocked items

https://addons.mozilla.org/en-US/firefox/addon/1865

[Farangchopthai]

If running Firefox, get the Adblock-plus addon and add http://66.48.81.* to the list of blocked items

https://addons.mozilla.org/en-US/firefox/addon/1865

"Adblock Plus 0.7.5.1 could not be installed as it's not compatible with my version of Fire fox only compatiable with Firefox 1.5 to 3.0a7"

I have version...1.0.7.0 ,of Firefox ......How can I update to a compatible version ?

Also any solution for the same problem on IE ?

Thanks

[cdnvic]

Upgrade to the latest Firefox. Your popup blocker will likely work better too.

[Farangchopthai]

Upgrade to the latest Firefox. Your popup blocker will likely work better too.

Updated and installed Adblock

Ran spybot and it detected TagASaurus ........ and Statcounter,,,,,,,,,,said it "fixed it" but the offending website promptly popped up again on IE.......

I.E was not open at the time !!

[cdnvic]

You need to do the scan/clean in safe mode. Reboot and hit F5 or F8 as Windows loads on most computers to go into safe mode.

Go through the scan/clean and reboot again.

If that fails, here are the manual removal instructions:

TAGasaurus manual removal:

Kill processes:

cczoop02.exe, cczoop05.exe, checks02.exe, gege15x.exe, gltudqz.exe, gltudqza.exe, gogo15x.exe, ms[X1].exe, pf78.exe, pf78bb.exe, pms111x.exe, setup[X2].exe, sms112x.exe, srvtlmxstn.exe, srvwunoaxy.exe, sysc00.exe, sys[X].exe, tagasaurus.exe, tagasuarus2.exe, tagasaurus5.exe, tagasuarus7.exe, tagasuarus97.exe, uninst104.exe, unin101.exe, uni_eh.exe, uni_ehhh.exe, uni_ehhhh.exe, visfx500.exe, vsg21-d.exe, win[X].exe, 803_105.exe, 912_121.exe

Help: how to kill malicious processes

Delete registry values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Currentversion\Run\ms[X]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Currentversion\Run\sys[X]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Currentversion\Run\win[X]

HKEY_LOCAL_MACHINE\SOFTWARE\System\sysold

Help: how to remove registry entries

Delete files:

cczoop02.exe, cczoop05.exe, checks02.exe, gege15x.exe, gltudqz.exe, gltudqza.exe, gogo15x.exe, ms[X1].exe, pf78.exe, pf78bb.exe, pms111x.exe, setup[X2].exe, sms112x.exe, srvtlmxstn.exe, srvwunoaxy.exe, sysc00.exe, sys[X].exe, tagasaurus.exe, tagasuarus2.exe, tagasaurus5.exe, tagasuarus7.exe, tagasuarus97.exe, uninst104.exe, unin101.exe, uni_eh.exe, uni_ehhh.exe, uni_ehhhh.exe, visfx500.exe, vsg21-d.exe, win[X].exe, 803_105.exe, 912_121.exe

Help: how to remove harmful files

Misc:

[X1] is a combination of random letters and digits.

[X2] is the version number.

Exact file location:

visfx500.exe - C:

setup[X2].exe, tagasuarus2.exe, tagasaurus5.exe - C:\WINDOWS\System, C:\WINDOWS\System32 or C:\WINNT\System32

cczoop05.exe, checks02.exe, gege15x.exe, ms[X].exe, pf78.exe, pms111x.exe, sms112x.exe, srvwunoaxy.exe, sysc00.exe, sys[X].exe, uninst104.exe, unin101.exe, uni_eh.exe, uni_ehhh.exe, uni_ehhhh.exe, vsg21-d.exe, win[X].exe - C:\WINDOWS or C:\WINNT

From: 2-spyware.com