What's with these banner adds?

[tcrist]

Is is just me or does everyone see the banner adds that keep poping up on CC now.
You are the ????? visiter. Click here to claim your prize.

WTF

Terry

[computerworks]

Not on this site... you probably have an adware/malware bug in your system that is causing the popups.

If you have no detection/correction software on your PC

Try Spybot Search and Destroy ot Lavasoft's AdAware

Both have free versions that will help clean a system

[tcrist]

Ron,
I am using AdAware software and just ran it last about a week ago. I have got them before on other sites but never here. This is something new in the last couple of days. I was afraid that it might be something with my browser. My son installed the AdAware software in this computer about 2 weeks ago. Boy did it find a lot of crap.
Thanks Ron,
Terry

Edit, It is always in the upper right corner where the add keeps changing. The next time I get one I will do a print screen and e-mail it to you so you can see what I see.

Thanks again, Terry

[HI Cobra]

I am not getting any of those. Maybe Hawaii is too far away!

[Silverback51]

None here either.

I do however sometimes get a Pop Up when I look at my avatar to long.

[392cobra]

Originally Posted by Silverback51

None here either.

I do however sometimes get a Pop Up when I look at my avatar to long.

Yep,your avatar does that to me too.

[tcrist]

Here is what I am talking about. It seems only to be happening on CC.


[IMG][/IMG]

[computerworks]

Next time you get it, point in the center of the image and right-click and choose Properties.

Tell me the URLs of the Image Properties and the Link Properties.

[tcrist]

Ron,
Will do.

[tcrist]

Ron, Here is one that just poped up.

[mrmustang]

Originally Posted by tcrist

Ron, Here is one that just poped up.
http://content.yieldmanager.edgesuit...4663b756e0.gif....

These are not coming from CHR as CHR's looksomething like this "http://www.clubcobra.com/banners.php?op=click&bid=73...", you have an override script running in the background. Get the search and destroy tool that Ron mentioned above and it will remove these from your system. On top of that, while you are doing the scans, you might want to turn system restore off, clear out your browser and system cache to be on the safe side.


Bill S.

[computerworks]

Tell me the URLs of the Image Properties and the Link Properties.

[mrmustang]

Originally Posted by computerworks

Tell me the URLs of the Image Properties and the Link Properties.

Ron,

I added "..." (forgot to do this as a customer walked in the shop) on to the url for his image in my quote so you could see where it was coming from.


Bill S.

[computerworks]

Thanks...I see the Image properties but I need to see the Link Properties on his displayed item.

Edgesuite is a very big ad house that serves up legit banners.... not part of what we use, but something is substituting or routing his normal CC banner ad that would show in that spot.

[Ronbo]

Probably an ad highjack

These can be tough to get rid of since they use various worms and viruses to create multiple exe and dll files.

Restart your computer in safe mode then clear all contents from windows\prefetch folder also look at windows\system32 folder and delete recent exe files with goofy names like 16738.exe and the like. (just park them in the recycle)

Spybot and AdAware usually can catch the child files but almost never eliminate the payload file and it continually rebuilds the attack.

Highjack this! is pretty good at cleaning these out but it's not real user friendly. (you need to know what your going after) Ccleaner (crap cleaner) is a good registery cleanup tool which will help.

[Excaliber]

No popup's on my system.

[tcrist]

I'll get my son to come over and read this and see if he can make any sense of what you guys are saying because you guys have lost me on this. I had Spybot and my son told me to remove it when we loaded AdAware.
Thanks all for your help. I think that I might have woken up a gremlen when all I was trying to do was clean up and speed up my computer.
Ron, If I right click on the banner and pick properties to show it, then do a print screen, will that help with what you are asking for? How would I send it to you.

Thanks again, Terry

[computerworks]

Originally Posted by tcrist

Ron, If I right click on the banner and pick properties to show it, then do a print screen, will that help with what you are asking for? How would I send it to you.

If you can, it might. I already know the source of the banner from your earlier post... if the Properties give more link inf, then that might be another clue as to what's causing it.

It appears clear to me that you are infested with a rogue BHO (Browser Helper Object) that is causing this.

A Browser Helper Object (BHO) is a software application that runs automatically whenever you start Internet Explorer. Browser Helper Objects are typically installed by other programs such as toolbar accessories and can track internet usage, create popup windows, display additional information on a viewed page and collect information that is transmitted by you over the internet. Malicious software that exploits this technology can replace banner advertisements with other ads, monitor your actions, change your home page, etc.

AdAware is a good program to remove those.

First, we can try a test. I see you are running IE 7. There is a way to start IE7 without any add-ons.

I think it is here:
Start-Programs-Accessories - Internet Explorer (no add-ons)

Try that and see if you still get the foreign banner ads.

Results will be interesting, but it is not the fix.

Start your AdAware with all other programs closed, perform the UPDATE to get the latest def file (important!) Then scan the system, removing whatever AdAware finds in the way of BHOs.

Let me know what happens.

[tcrist]

Will do. Thanks Ron,
Terry

[tcrist]

Ron,
I think I might have found the culpret. McAfee finaly found a file called "DeepDive" in my system. It was in "2" different places. I did a search and it looks like that is what was causing my problem. Thanks all for all of your advise.

Terry