asked on

680180.net pop-up

I have a Windows XP Professional PC within my organisation which on using IE gets popup windows being opened every 5 minutes or so to www.680180.net.

The PC is behind a checkpoint firewall, is up to date with all XP patches, has McAfee installed and both Adaware and SpyBot on the machine but I am still getting the popups. I have carried out searches on the net and found a list of files to be looked for and deleted as well as registry changes and still no change.

It has become such a pain i'm going to give 500 points to anyone who can help me solve this problem.

SheharyaarSaahil

Hello Pierhouse =)

Try Disabling the Messenger Service,,,,

Click Start->Settings ->Control Panel
Click Administrative Tools
Click Services
Double click Services Scroll
down and highlight "Messenger"
Right-click the highlighted line and choose Properties.
Click the STOP button.
Select Disable or Manual in the Startup Type scroll bar
Click OK

ref >> http://www.itc.virginia.edu/desktop/docs/messagepopup/

!! GOOD LUCK !!

ASKER CERTIFIED SOLUTION

SheharyaarSaahil

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

YohanShminge

From http://computercops.us/postt45617.html

Click START & go to MY COMPUTER, right-click then click EXPLORE & click the WINDOWS folder then click SYSTEM 32 folder then find the following below & delete it. Just delete ADStartUP.exe, all the files names listed below(delete AdUpdater.exe, adupmanager.xml, data.xml, IEEnhancer.dll) & not the full links here. Also u might not be able to delete ADStartUP.exe right away but follow the instructions here below on the registry edit & u can go back & delete the ADStartUP.exe & the rest... it works coz my zamingo.com & 680180.net pop-ups disappeared. any questions send me a PM.

%Windir%\System32\ADStartUP.exe
%Windir%\System32\AdUpdater.exe
%Windir%\System32\adupdmanager.xml
%Windir%\System32\data.xml
%Windir%\System32\IEEnhancer.dll

After deleting these files from your system you will need to delete a registry entry:

Click the "Start" button on the taskbar

Click "Run..."

Type "regedit" and click the "OK" button

Click the "Start" button on the taskbar

Open the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" registry key

Right-click "Adstartup" and click "Delete"

YohanShminge

Hmm, perhaps you already tried that...just read your post again (sorry!)

SOLUTION

YohanShminge

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Pierhouse

ASKER

Thanks for the all the comments. I will try all the suggestions this morning and see what happens.

Pierhouse

ASKER

Downloaded CWShredder and HiJack this and ran them along with Adware and Spybot I had earlier put on the PC and it has seem to have done the trick so I have split the points.

paulkl

I just wanted to add a few bits to what YohanShminge said.
After deleting the files in Yohans comment and removing the registry key, the popups still kept coming back. After a bit more hunting around I found that you also needed to delete 3 other files. A complete list is below

%Windir%\System32\ADStartUP.exe
%Windir%\System32\AdUpdater.exe
%Windir%\System32\adupdmanager.xml
%Windir%\System32\data.xml
%Windir%\System32\IEEnhancer.dll
%Windir%\System32\AutoMove.exe
%Windir%\System32\Trans.exe
%Windir%\System32\Swin32.dll

and the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdStartup.

You will need to boot into safe mode to delete SWin32.dll as this is the file that recreates all of the others. I also ran a search for each file and found some of them in scattered throughout the C:\ these I also deleted just to be sure.

Pierhouse

ASKER

Also turn off system restore using using system properties before trying to remove the files as I found some of the files are retained for restoration.

jz1english

I am having this same problem 680180 and I don't see any of the files mentioned above in my system 32 directory:

Windir%\System32\ADStartUP.exe
%Windir%\System32\AdUpdater.exe
%Windir%\System32\adupdmanager.xml
%Windir%\System32\data.xml
%Windir%\System32\IEEnhancer.dll

Pierhouse

ASKER

Have you tried all the anti-spyware programs discussed in this topic?

paulkl

jz1english,

Did you search the rest of your C:\ for the files? As I posted before these files do seem to be scattered throughout the hard drive.

jz1english

Yes, I searched all of the c drive and then searched "my computer" and nothing comes up. I am also finding an adware called statblaster on my computer when I run mcafee av. In addition to the constant 680180 pop ups, I can't sign into or access certain websites. For instance, as soon as I click the sign on button in yahoo mail, the window shuts down, no error message or anything. Not sure if these are related or not.

clarkinthedark

I ran hijack this and didn't find anything too out of the ordinary. I'll post the results when I get a chance. I also looked for the adstartup.exe (and associated programs) along with the registry entries and didn't find anything... Any other ideas? cuz i'm not ready to give up on this mother yet...

paulkl

The only thing that I can think of that hasn't been suggested yet is that the problem first showed up when my user installed HotBar, although another user on another machine didn't get this problem.