I'm Getting Pop Up Windows (just here in this forum).

[Suzy]

For the last couple of weeks I keep getting pop up windows every single time I enter IIS. :shrug:

It's called Ad.Server and I get two windows- one saying Ad Server Plus and the other pop up window is to play a game (which changes regularly).
I haven't clicked on anything.
No where else I surf the net does it pop up- just here.

I'm wondering if I have a virus or is this a new thing to IIS?

My virus detector programme isn't picking it up. :shrug:

[Octane]

Sounds like you're infected.

Head on over to Trend Micro's web site and run the House Call online antivirus scan.

If it finds something, it'll advise how to fix it.

H

[iceman]

Certainly nothing from IIS would be causing this.

I hope you find the problem.

[Suzy]

Ah I see.
Thanks Mike & H, and I'll take up that advice to have a look at Trend Micro site. :thumbsup:

[iceman]

Sorted it out Suzy?

[Suzy]

No :sadeyes:

Russ just bought Nortons yesterday for all of us and it's running it's first scan on my lappy as I type this. When I came here to answer your msg, I got hit with 3 pop up windows while the scan is running and I said to it, there it is, sick 'em rex! :lol: Hope I get some success soon.

Thanks for asking, Mike.:)

[OICURMT]

Suzy:

PM'd you...

OIC!

[OICURMT]

Suzy

No response, so I thought I'd bump this...

Did you finally solve your problem?

OIC!

[mithrandir]

Suzy, the other tools no trojan hunter should be without are Malwarebytes (http://www.malwarebytes.org/), Spybot S&D (http://www.safer-networking.org/en/download/index.html) and Hijack This (http://sourceforge.net/projects/hjt/).

Hijack This is for the experts. You can really break things if you don't know what you are doing.

[Suzy]

My big apologies OIC for not getting back to you earlier- I've been meaning to but have been very busy working on the big list of observing targets for July/Aug which I just posted in the obs. forum last night.
Thank you so much for your help via pm- I appreciate it.

Yes I still have the virus- it's very annoying! We've just bought Norton's & have it running but it didn't pick up the virus. Russ is determined to re-load the computer- wasn't something I wanted to do lightly as it's such a huge process by the sounds. He said it's no use putting Norton's on without re-loading the computer as there could be viruses it doesn't pick up that are already existent- which is what's happened. So I'm going to be busy backing up stuff for a while in readiness for it. :mad2:

Many thanks Andrew- I will look into what you suggested. :thumbsup:

You guys are the best! :)

[MikeyB]

Norton's is a useless, memory-hogging joke - money wasted unfortunately, as you are already finding.

Re-loading the computer (re-installing Windows?), should not be necessary, just download free Malwarebytes as recommended by Andrew and do a complete system scan.

[mithrandir]

Slight comment on Norton. Better than some. Worse than others.

You might find you have to reboot in safe mode. Some of these trojans stop the detection programs running.

You could also have to get a copy of UBCD (http://www.ultimatebootcd.com/) or UBCD4Win (http://www.ubcd4win.com/) or similar and run a scan from there against your PC. UBCD4Win you have to build yourself on a clean PC by following the instructions. This is because of licensing restrictions.

[Colin_Fraser]

Hello Suzy,
Seems you have a bit of a problem there. It's not a virus as such so it's hard to detect using virus checkers. This trojan is difficult to get rid of but it's possible once you know what the name of it is.
Next time it pops up, use Ctl-Alt-Del and work your way to the task manager and look in Processes or Services. The popup should be visible in the list. See if there is a file running called random.exe, that is the usual name for this trojan.
If it's there, find it's location and delete it. If it running as a Service, you can disable it there as well.
Unfortunately, that's not the end of it. Some variations hook themselves onto Java runtime library and Firefox. Delete them both and re-install them.

If you have difficulty, download and run HijackThis and look through the log file for programs running that do not look familiar.

Notice you now have Nortons :( Sorry to hear that.

[Suzy]

Hi guys
Oh dear, Nortons not popular at all it seems hmmm...:confuse3:
I've been a bit busy lately so I haven't tackled anything yet, but the pop-ups are getting worse- now I'm getting them elsewhere other than just here and sometimes I have trouble getting rid of them; I have to click the cross a few times to get it off because it just keeps coming back. The other day, even that didn't work and I had to shut down and re-start. It's called "Ad Server Plus" and wants me to play a game (in case anyone missed it when I mentioned it earlier).

Thanks for your input Mikey, Andrew and Collin and I will look in to what you all have suggested- I'm going to have to do something soon.

[bartman]

Hi Suzy,
I did a bit of a google search and found acouple of sites that show how to tackle the problem. Some look very complicated, others not so.
I think this one might help you along:
http://guides.yoosecurity.com/how-to-remove-ad-adserverplus-com-virus-ad-adserverplus-redirect-removal-help/
Do a ggogle search for " how to get rid of adserverplus popups"....
Looks like a doozy!
Good luck
Bartman

[Suzy]

Many thanks Bart,
I'll look into it along with the others mentioned. :)