Paging the Windows registry experts

IE has started putting a full-screen advert shortly after it starts up
for the first time, though the URL in the top bar appears unchanged.

It is bloody annoying.


I've recently purged the following registry areas:

HKEY_CURRENT_USER
Software
Microsoft
Windows
Current version
Run
<all stuff except default>
and

HKEY_LOCAL_MACHINE
SOFTWARE
Microsoft
Windows
Current version
Run
<deleted all except AVG8_TRAY (AV SW?)

Anything else I can remove safely?

Yes, I will backup first.

 

Yourself, from the computer, out into the sunshine, onto the bike and
up to Derbyshire.

 

Heh. So how exactly did you send that missive, hmm?

 

witchcraft.

 

Empty your prefetch folders and look in all your start menus

 

Ah, start folders. Ta.

Err, prefetch?

I've suddenly realized that in the three years that I've been with my
current employer, I've lost a lot of MS knowledge (not that I was a
Windows expert) and I probably know more about Linux now.

The shame of it.

 

Its in the windows directory , it keeps a list of all the programmes
recently accessed , ts a good hidehole for any viri

 

<fx: considers minimum safe distance from London; breathes>

 

Try Firefox.

Crap Cleaner is very good for registry cleaning.

 

Using the patented Mavis Beacon "Hunt&Peck" Technique, Pip Luscher

Whore.

 

Got it on Linux. TBH there doesn't seeem to be a huge difference
between the two on the face of it, and changing browser just because
of a bit of over-zealous adware seems a bit extreme. If it gets worse
I might consider it, mind.

So far though, Mr Robinson's suggestion of clearing the prefetch
folder seems to have done the trick.

OK, Ta. I'll look into that.

 

Advert for what?

It sounds like your system has some malware on it. Before removing more
stuff at random from the registry I suggest that you run "hijackthis"
(freeware and widely available for download). Run it and take a look at the
log it creates so that you can see if anything suspicious is being loaded by
your system at startup or linked to browser activity. To remove malware
run Spybot Search & Destroy (freeware) followed by Lavasoft's Adaware (free
version).

 

I do and I did and now some pages don't really load that well.... all
sort of basic oldie HTML type.... arrghhh...

Hj

 

I've spent half the day [1] trying to think up a suitably apt and
witty riposte to that. I failed: bang to rights yerronner.


[1] In between mostly lazing around, going to the gym and lazing
around. Today feels somewhat wasted.

 

A couple were dodgy looking 'you have mainl from 'xxxx', where 'xxxx'
was a female name. There was a 'skip this advert' hotspot at the top
of the page but the first few times I simply closed the window; I did
try it once and it seemed to work, though it's also possible I've thus
given details away by clicking it.

The last incident was a small OE window that opened spontaneously (as
far as I can recall) shortly after boot-up that contained text
suggesting that I look into using a different web browser.

I've tried Adaware; it removed (or claimed to) a lot but not this.

I'll have a look at 'hijackthis'; sounds useful. So far though, a new
day and no adverts, so I reckon that it was at least partly lurking in
the prefetch folder. This does assume that prefetch is accessed
without opening OE, given that the last advert seemed to be
spontaneous.

What's slightly suspicious is that recently AVG has been offering
updates but when I followed the update process, it kept trying to
steer me towards their (not free) registry cleaner. Odd coincidence.

 

I found that SuperAntiSpyware also managed to find malware that other
progs couldn't reach, despite its naff name

 

Ditch AVG. I found the free version gave false positives and hogged
resources.

Avast & Spybot seem to keep my home PC free of crap (both free). Even when
the sprog comes along, downloading all sorts of shit via P2P.

A spring clean with Ccleaner every now & then, which clears prefetch
amongst other stuff, seems to be worthwhile too.

 

On 18/04/2010 19:52, Pip Luscher wrote:
snip

They always do that. At least it's much better than the completely
borked system of a friends which was supposed to have been protected by
Norton.

I'd also give Spybot Search and Destroy a shot.
http://www.safer-networking.org/

Then SurfRight Hitman Pro 3 which I found particularly effective in the
above case.
http://www.surfright.nl/en/hitmanpro

 

Well, yesterday another ad popped up, so it was obviously taking a
breather ad not cured as I thought.

I gave it a go with SuperAntiSpyware which claimed to have removed
several hundred tracking cookies and one adware program. I then
*immediately* tried the free trial version of 'Hijack this', which
claimed there were another hundred or so odds including a trojan. Hmm.

Either each code house misses an awful lot or they're making out that
there's more there than there actually is.

Having said that, today no pop-ups. We'll see.