IE7 adware problem

When I start IE7 after awhile I get random ads that open a new instance of
IE7
Windoes one care was install and so called protecting when it happened
I have since installed McAfee and it doesn't find it
I've also tried difeerent spyware and adware products to no avail
Has anyone else had this problem or know a solution
thanks

IE7.........Tools............popup blocker............is it on??
peter
"Taz" <tom_snyder@hotmail.com> wrote in message
news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
> When I start IE7 after awhile I get random ads that open a new instance of
> IE7
> Windoes one care was install and so called protecting when it happened
> I have since installed McAfee and it doesn't find it
> I've also tried difeerent spyware and adware products to no avail
> Has anyone else had this problem or know a solution
> thanks

yes it's not acting like a popup it's like starting another instance of
IE7
first flash command has login.revenue as part of the command that flashes
then it goes to a different ad
sometimes games, sometimes registry editor program, sometimes spyware ads
wanting you to download their product

"pete" <pete@nowhere.net> wrote in message
news:C86E3513-BF91-4FE8-9C8A-AF51691E6809@microsoft.com...
> IE7.........Tools............popup blocker............is it on??
> peter
> "Taz" <tom_snyder@hotmail.com> wrote in message
> news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
>> When I start IE7 after awhile I get random ads that open a new instance
>> of IE7
>> Windoes one care was install and so called protecting when it happened
>> I have since installed McAfee and it doesn't find it
>> I've also tried difeerent spyware and adware products to no avail
>> Has anyone else had this problem or know a solution
>> thanks
>

Try downloading Lavasofts AdAware program and running it.
It will/should find errant adware
I personally am not a fan of McAfee I prefer AVAST and they have a free
version or Vista
I use 3 different anti spy/ad ware programs.
spybot search and destroy
spywareblaster
Adaware from Lavasoft.
all of these are available for free............dp a google.

peter

"Taz" <tom_snyder@hotmail.com> wrote in message
news:OeTueeXfHHA.2396@TK2MSFTNGP04.phx.gbl...
> yes it's not acting like a popup it's like starting another instance of
> IE7
> first flash command has login.revenue as part of the command that flashes
> then it goes to a different ad
> sometimes games, sometimes registry editor program, sometimes spyware ads
> wanting you to download their product
>
> "pete" <pete@nowhere.net> wrote in message
> news:C86E3513-BF91-4FE8-9C8A-AF51691E6809@microsoft.com...
>> IE7.........Tools............popup blocker............is it on??
>> peter
>> "Taz" <tom_snyder@hotmail.com> wrote in message
>> news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
>>> When I start IE7 after awhile I get random ads that open a new instance
>>> of IE7
>>> Windoes one care was install and so called protecting when it happened
>>> I have since installed McAfee and it doesn't find it
>>> I've also tried difeerent spyware and adware products to no avail
>>> Has anyone else had this problem or know a solution
>>> thanks
>>
>

Tried it still have the problem

"pete" <pete@nowhere.net> wrote in message
news:40CA6844-2C2F-4CC8-85B9-EA38DE2AA8B9@microsoft.com...
> Try downloading Lavasofts AdAware program and running it.
> It will/should find errant adware
> I personally am not a fan of McAfee I prefer AVAST and they have a free
> version or Vista
> I use 3 different anti spy/ad ware programs.
> spybot search and destroy
> spywareblaster
> Adaware from Lavasoft.
> all of these are available for free............dp a google.
>
> peter
>
> "Taz" <tom_snyder@hotmail.com> wrote in message
> news:OeTueeXfHHA.2396@TK2MSFTNGP04.phx.gbl...
>> yes it's not acting like a popup it's like starting another instance of
>> IE7
>> first flash command has login.revenue as part of the command that flashes
>> then it goes to a different ad
>> sometimes games, sometimes registry editor program, sometimes spyware ads
>> wanting you to download their product
>>
>> "pete" <pete@nowhere.net> wrote in message
>> news:C86E3513-BF91-4FE8-9C8A-AF51691E6809@microsoft.com...
>>> IE7.........Tools............popup blocker............is it on??
>>> peter
>>> "Taz" <tom_snyder@hotmail.com> wrote in message
>>> news:OKBZj4VfHHA.1456@TK2MSFTNGP04.phx.gbl...
>>>> When I start IE7 after awhile I get random ads that open a new instance
>>>> of IE7
>>>> Windoes one care was install and so called protecting when it happened
>>>> I have since installed McAfee and it doesn't find it
>>>> I've also tried difeerent spyware and adware products to no avail
>>>> Has anyone else had this problem or know a solution
>>>> thanks
>>>
>>
>

"Taz" <tom_snyder@hotmail.com> wrote in message
news:eC8uoMofHHA.4652@TK2MSFTNGP02.phx.gbl...
> Tried it still have the problem
>

Taz,

The last time I had to troubleshoot a very stubborn malware situation
such as yours, it turned out to be a rootkit. Go to sysinternals.com
and run theire "Root Kit Revealer". This may help you isolate the issue.

http://www.microsoft.com/technet/sys...tRevealer.mspx

Should it find a rootkit, they can be a bit of a hassle to get rid of. I use
the Bart PE Builder to create a bootable XP CD, then boot from that
CD to fix the issues on the C: drive. It is almost impossible to remove
a rootkit booted from the infected OS.

The last time I used the root kit revealer, there was no option to print
the results, you could only save to file. You will need to to that, then
boot from the bootable XP cd, open the file you saved and process
any issues it finds.

However, ask any certified security expert and they will almost always
say the only "real" way to clean your system after it has been compromised
is to re-image.

Good luck.

TDM

I took off windows live one care and put McAfee on
I then turned everything off on McAfee, ie. smart recognizer and trusted
sites and apps
I don't have the problem at this point and I'm being very careful what I
allow
I tried numerous programs and nothing found it
this has been the only thing I've tried that has worked to this point

"TDM" <rpuffd@gmail.com> wrote in message
news:%235Zld2DgHHA.596@TK2MSFTNGP06.phx.gbl...
>
> "Taz" <tom_snyder@hotmail.com> wrote in message
> news:eC8uoMofHHA.4652@TK2MSFTNGP02.phx.gbl...
>> Tried it still have the problem
>>
>
> Taz,
>
> The last time I had to troubleshoot a very stubborn malware situation
> such as yours, it turned out to be a rootkit. Go to sysinternals.com
> and run theire "Root Kit Revealer". This may help you isolate the issue.
>
> http://www.microsoft.com/technet/sys...tRevealer.mspx
>
> Should it find a rootkit, they can be a bit of a hassle to get rid of. I
> use
> the Bart PE Builder to create a bootable XP CD, then boot from that
> CD to fix the issues on the C: drive. It is almost impossible to remove
> a rootkit booted from the infected OS.
>
> The last time I used the root kit revealer, there was no option to print
> the results, you could only save to file. You will need to to that, then
> boot from the bootable XP cd, open the file you saved and process
> any issues it finds.
>
> However, ask any certified security expert and they will almost always
> say the only "real" way to clean your system after it has been compromised
> is to re-image.
>
> Good luck.
>
> TDM
>
>

PC Doctor 5 finds it as a hijacker and quarentines it but it comes right
back
It writes a file
user/tom/appdata/roaming/microsoft/windows/cookies/low/tom@cpvfeed[2].txt
if you fix that it just wrotes [3]

This is the file it writes
mgFreq
F|1|150289|1176768854437
cpvfeed.com/
1024
1290014464
29857816
4127253120
29851780
*
mgData
B|2
cpvfeed.com/
1024
1290014464
29857816
4127293120
29851780
*
myGeekConv
558343|110830|24.127.232.181|ron|24255609|1176768854437
cpvfeed.com/
1024
1290014464
29857816
4127383120
29851780
*
mgUser
1|10aecc7799c740ff9cfaf32e4f0394b2|24.127.232.181|1176768854437
cpvfeed.com/
1024
1290014464
29857816
4127423120
29851780
*
I have not been able to find the file that writes it yet

"Taz" <tom_snyder@hotmail.com> wrote in message
news:%23cHtSSFgHHA.3388@TK2MSFTNGP02.phx.gbl...
>I took off windows live one care and put McAfee on
> I then turned everything off on McAfee, ie. smart recognizer and trusted
> sites and apps
> I don't have the problem at this point and I'm being very careful what I
> allow
> I tried numerous programs and nothing found it
> this has been the only thing I've tried that has worked to this point
>
> "TDM" <rpuffd@gmail.com> wrote in message
> news:%235Zld2DgHHA.596@TK2MSFTNGP06.phx.gbl...
>>
>> "Taz" <tom_snyder@hotmail.com> wrote in message
>> news:eC8uoMofHHA.4652@TK2MSFTNGP02.phx.gbl...
>>> Tried it still have the problem
>>>
>>
>> Taz,
>>
>> The last time I had to troubleshoot a very stubborn malware situation
>> such as yours, it turned out to be a rootkit. Go to sysinternals.com
>> and run theire "Root Kit Revealer". This may help you isolate the issue.
>>
>> http://www.microsoft.com/technet/sys...tRevealer.mspx
>>
>> Should it find a rootkit, they can be a bit of a hassle to get rid of. I
>> use
>> the Bart PE Builder to create a bootable XP CD, then boot from that
>> CD to fix the issues on the C: drive. It is almost impossible to remove
>> a rootkit booted from the infected OS.
>>
>> The last time I used the root kit revealer, there was no option to print
>> the results, you could only save to file. You will need to to that, then
>> boot from the bootable XP cd, open the file you saved and process
>> any issues it finds.
>>
>> However, ask any certified security expert and they will almost always
>> say the only "real" way to clean your system after it has been
>> compromised
>> is to re-image.
>>
>> Good luck.
>>
>> TDM
>>
>>
>