Tilted Forum Project Discussion Community

- Tilted Support (https://thetfp.com/tfp/tilted-support/)

- - Popups on this site (https://thetfp.com/tfp/tilted-support/48532-popups-site.html)

Popups on this site

I'm not necessarily sure if this should be posted here but I am not sure where else to put it. I have having problems with popups on this site (I think it might be from something that was somehow downloaded on my computer without my knowledge). I would not have any problem with it if it was just a popup because I have a popup blocker but every few times I visit the main page it does not just have a popup it tries to download some sort of toolbar on my computer. I have run ad-aware (gets rid of my spyware) and I have run Norton but nothing seems to get rid of this problem. Is there anything that you would reccomend that I could do?

it didn't help man, anything else I should try?

Try Ad-aware or Spysweeper.
They all cure a lot of problems.

Are other sites giving problems?

Ad-Aware
Spy Sweeper

(edit because I was too lazy to read your enitre post first time *shame* left ad-aware link for completeness)

What OS?

It could be the Windows Messenger service.

Go here to find out how to turn it off.

still no go, I've downloaded all of that software and have checked to see if my Windows Messenger is off but the popups still come, and they only come if I pull up the main page it's really strange.

I think I get the same thing as you greyeyes. It went away for awhile but it's been coming back. It's a huge pain in the ass, I have to click to close it 4 times before it finally goes away.

Guys... screenshots.

It's the only way.

[IMG]http://groups.msn.com/_Secure/0SAAEKMEWY1rO*jGD9Te2vPBetKy62xWjfEA!FnccJLUmHdGYDj0dV4saqS8T33M9bAdpYJr5ivAhVSCTtOAdEIfVLifhqBm6QnkaixxootEAAAAAAAAAAA/untitled.bmp?dc=4675463724230550173[/IMG]
this is the first thing that pops up and then something follows it while this one disappears and something like this shows up:
http://groups.msn.com/_Secure/0SAD1A...63724900151482

THANK YOU!

It sounds like you've been infected with the Webcounter.cc variant.

Here's an excerpt of what it is:

Quote:

Behavior
Adware.SearchCounter changes Internet Explorer's search and home pages, redirects network traffic, and displays browser popup windows.

Symptoms
Attempts to connect to auto.search.msn.com are redirected to in.webcounter.cc.

The default search and home pages in Internet Explorer are changed to in.webcounter.cc.

Internet Explorer popup windows displaying in.webcounter.cc are automatically opened.

On logon, Windows error messages are displayed, stating that "fntldr.exe cannot be found."

When Adware.SearchCounter is executed, it performs the following actions:

Modifies the following registry keys as shown:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer

"Search"="<WebAddress>"

--------------------------------------------------------------------------------
Note: <WebAddress> is a variable. The adware places the value:

http:/ /%69%6e%2e%77%65%62%63%6f%75%6e%74%65%72%2e%63%63/%2d%2d/?%62%7a%62%6a%72

in the given registry location.

--------------------------------------------------------------------------------

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

"Default_Search"= [WebAddress]
"Search Page"= [WebAddress]
"Start Page"= [WebAddress]
"Use Search Assistant"="yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Styles

"User Stylesheet"="%Windir%\hh.htt"
"Use My Stylesheet"= dword:00000001

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search

"Search Assistant"="<WebAddress>"
"CustomizeSearch"="<WebAddress>"

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer

"ReconfLast"=dword:07D30C01

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer

"Search"="<WebAddress>"
"SearchURL"="<WebAddress>"

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main

"Start Page"="<WebAddress>"
"Search Page"="<WebAddress>"
"Default_Search"="<WebAddress>"
"Default_Page"="<WebAddress>"
"Use SearchAssistant"= "yes"
"Search Bar"="<WebAddress>"

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search

"Search Assistant"="<WebAddress>"
"CustomizeSearch"= "<WebAddress>"

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Styles

"User Stylesheet"="%Windir%\Web\tips.ini"
"Use My Stylesheet"= dword:00000001

Creates two identical files:
%Windir%\Web\tips.ini
%Windir%\hh.htt

These files cause a browser popup window displaying "<WebAddress>" to appear every time an Internet Explorer page contains any of these META tags:
sex
porn
adult
thehun

Adds this line to the Hosts file:

1089288654 auto.search.msn.com

This causes all the attempts to contact auto.search.msn.com to be redirected to "<WebAddress>"

Adds the following line to the Win.ini file:

run=fntldr.exe

This is designed to cause the file Fntldr.exe to be run every time you start Windows 95/98/Me. However, during testing by Security Response, the adware did not create or download the Fntldr.exe file. Instead, error dialogs appear after every logon, stating that Fntldr.exe could not be found.

Follow the link for further removal instructions @

Hope this helped,
OT

I followed the directions that your link led me through but it didn't work. That is not my problem because some of what was said didn't apply to my problem. Are there any other solutions that I could try?

Hmmm. Sorry about that. After I ran a search for an uninstaller (which I didn't find any) I thought that would be the next best thing. :o

But don't despair. After more research I've come up with CWShredder, which should remove the CWS.Tapicfg variant.

It was also called to my attention that you may have something called the Peper.a.trojan installed as well. So may want to run this utility as well: Peper Uninstaller and/or (Just to be sure).
Note: Internet connection must be on during this.

Let me know,
OT

Hell yeah, thanks man, you just solved my problem!