"premium offers" pop ups

[susienews]

There are a lot of questions regarding pop-up ads, but none matched my problem too closely. I have IE 5.0 and constantly get ads with Internet Explorer in the top blue bar with the small print at the bottom of the ad reading "this ad has nothing to do with the site you are visiting." Most of them are also affiliated with "Premium Offers," whatever that is. I've tried Pop-Up Stopper, but that only succeeded in blocking the pop-ups I wanted by clicking on links. A friend suggested that I may have inadvertently downloaded Gator or something, which leeches itself to your computer and does nothing but annoy the heck out of you. I hear the company's being sued. I also downloaded Comet Cursor at one time, which I no longer use that he suggested may also have created the pop-up problem. If these programs are in fact the problem, how do I get rid of them? I don't believe that pop-up stoppers will work for my pop up problem, but if you have one in mind that you think will, I'll keep an open mind.
By the way, I love this site. What a brilliant idea! After several attempts, I couldn't get Microsoft to help me (no surprise), so this is great!

 

[belenus]

Hi susienews.

It sounds as though you've got some spyware running on your system. Spyware are programs that track what you're doing and report back, then advertising and stuff can be directly aimed at you. Comet Cursor is one of those programs that tends to have a little bit more than you realize attached to it.

You can download a program called, "Spybot - Search and Destroy" from HERE That will help you to clear your system of any spyware on it.

Hope that helps,

belenus

 

[steamwiz]

Hi susienews

Some programs should be removed from the control panel before running spybot

If you post your startup list we may be able to spot something

Please post your startup list by doing the following :-

Please go here and download startuplist 1.51 :-

http://www.lurkhere.com/~nicefiles/

Download to any folder or your desktop
Unzip the zipfile
Double click the exe file
go to Edit - select all - copy - and paste the results in a new post here

steam

 

[susienews]

Here ya go....

StartupList report, 2/5/2003, 8:12:48 AM
StartupList version: 1.51
Started from : C:\DOCUME~1\SOUTHB~1\LOCALS~1\Temp\StartupList.EXE
Detected: Windows 2000 SP1 (WinNT 5.00.2195)
Detected: Internet Explorer v5.00 SP1 (5.00.2920.0000)
* Using default options
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\DMI\bin\dmisrv.exe
C:\WINNT\System32\svchost.exe
C:\DMI\bin\delldmi.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\DMI\bin\win32sl.exe
C:\WINNT\Explorer.Exe
C:\DMI\bin\nic.exe
C:\DMI\bin\coo.exe
C:\DMI\bin\dnar.exe
C:\DMI\bin\nodemngr.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINNT\System32\SxgTkBar.exe
C:\WINNT\loadqm.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
C:\Program Files\Hotbar\bin\4.1.8.0\Hbinst.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
C:\Program Files\Navnt\navapw32.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\PROGRA~1\HEWLET~1\HPOFFI~1\bin\hpoevm07.exe
C:\WINNT\System32\hpoipm07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOSTS07.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\HPOFXM07.exe
C:\bcn\bcnQ2.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hotbar\bin\4.1.8.0\HbSrv.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\SOUTHB~1\LOCALS~1\Temp\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
TCASUTIEXE = TCAUDIAG -off
MULTIMEDIA KEYBOARD = C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
SxgTkBar = SxgTkBar.exe
NAV DefAlert = C:\PROGRA~1\Navnt\defalert.exe
NPS Event Checker = C:\PROGRA~1\Navnt\npscheck.exe
LoadQM = loadqm.exe
HPAIO_PrintFolderMgr = C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
Norton eMail Protect = C:\Program Files\Navnt\POPROXY.EXE
Pop-Up Stopper = "C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
Hotbar = C:\Program Files\Hotbar\bin\4.1.8.0\Hbinst.exe /Upgrade

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

GoogleDCClient = C:\Program Files\GoogleDCC\dcclient.exe -startup
Yahoo! Pager = C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
Hotbar - C:\Program Files\Hotbar\bin\4.1.8.0\HbHostIE.dll - {B195B3B3-8A05-11D3-97A4-0004ACA6948E}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[YInstStarter Class]
InProcServer32 = C:\Program Files\Yahoo!\Common\yinsthelper.dll
CODEBASE = C:\Program Files\Yahoo!\common\yinsthelper.dll

[HbInstObj Class]
InProcServer32 = C:\Program Files\Hotbar\bin\4.1.8.0\HbInstIE.dll
CODEBASE = http://installs.hotbar.com/installs/hotbar/programs/hotbar.cab

[{6CB5E471-C305-11D3-99A8-000086395495}]
CODEBASE = http://toolbar.google.com/data/en/deleon/1.1.56-deleon/GoogleNav.cab

[Update Class]
InProcServer32 = C:\WINNT\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37641.5527083333

[CV3 Class]
InProcServer32 = C:\WINNT\System32\wuv3is.dll
CODEBASE = http://windowsupdate.microsoft.com/R768/V31Controls/x86/nt5/en/actsetup.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------
End of report, 6,054 bytes
Report generated in 1.972 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

[steamwiz]

Hi susienews

Remove "Hotbar" from add/remove programs in the control panel

If you are in any doubt about this - see this thread and read the links in it

http://forums.techguy.org/t116616/s.html

Then run spybot

Please Download and install SpyBot,

http://www.lurkhere.com/~nicefiles/

click the online tab to search for and download the updates, then shut down and relaunch SpyBot.

Go to the Settings tab > File Sets, and uncheck 'System Internals' and 'Tracks' .
These aren't needed for our present purpose, and you can always experiment with them later on.

Finally, after closing down Internet Explorer, click 'Check for problems', and have SpyBot remove all it finds 'Fix selected problems'

you may have to run spybot more than once to clear everything

Remove everything pre-ticked in Red

steam

 

[susienews]

I downloaded spybot (and as soon as I can want to give that guy a few bucks) and got rid of hotbar. I'll let you know in a few days what the pop-up situation is. I also let hotbar know why I deleted their product. You guys are all gems! May you be blessed for all eternity!

 

[susienews]

PROBLEM SOLVED! No more pop-ups! Thank you! Thank you! Thank you!

 

[steamwiz]

Hi susienews
<marquee>
<img src="http://forums.techguy.org/attachment.php?s=&postid=608976">you're welcome from Steam
</marquee>

 

[Grasshopper2]

Found this thread through a search function...

Thank you so much! I was about to resort to formatting my hardrive because of those popups. For those who have experienced Premium-offers...you know what I'm talking about.

The most irritating experience was when they'd appear while I was entering text on a site...I'd only realize that nothing I typed went through because of the popup.

I consider this a "con", for whatever that's worth, since the affiliation between Hotbar and Premium-Offers was never displayed...before the download or in the ads. Thus, users are decieved into accepting the incomplete/ambiguous terms of the software.

Anyhow, hope everyone with this popup problem finds this thread.

Thanks again!

 

[steamwiz]

Hi Grasshopper2

<marquee>
<img src="http://forums.techguy.org/attachment.php?s=&postid=608976">you're welcome from Steam
</marquee>