weird pop ups

bombidol · 09-03-2005 2:22pm #1

I have XP pro on a machine here. With the most recent Ad Aware and Spybot. they have removed everything they have found on the machine. BUT...
When windows starts a Windows media player pops up and one or two internet explorer windows ask to connect to the net. is there anywhere in XP Pro to remove all this junk for a normal start up?

Thanks

gar

dudara · 09-03-2005 2:25pm

I have that problem as well!! Any suggestions from anyone? Like bombidol I have anti-spyware stuff installed as well as up to date F-Secure.

Khannie · 09-03-2005 2:31pm

Check your start->programs->startup folder. Remove anything fishy. Also do a search for startup in your regedit. There's a tool for telling you exactly what's starting at boot time, but I'm afraid I can't remember the name of it....anyone?

There was a thread on this a while ago....try the forum search too maybe.

wavin · 09-03-2005 2:32pm

maybe try running adaware in safe mode
it sometimes finds stuff that arent removable in normal mode

NotMe · 09-03-2005 2:35pm

Check the settings for Windows Media Player. There's a few settings in there like "check for updates" and "connect to the internet". Try disabling them.

skywalker_208 · 09-03-2005 2:39pm

Also try HighjackThis.. it will give you a log of all (if any) spyware browser highjackings etc

petes · 09-03-2005 2:53pm

Start=>Run=>msconfig. Go to startup tab and look for anything fishy.

Also go to regedit.Go to the following.

HKEY_LOCAL_MACHINE\Software\Microsoft\Current Version

Check the Run and RunOnce for anything that shouldnt be starting up.

stevenmu · 09-03-2005 2:57pm

Definitly run HijackThis, it'll show you all the things that Khannie and Petes suggested to try and some others all in one handy screen. If you're confident that you know what you're doing, remove anything you don't like the look of. If you're not sure about some of the stuff, post the log up here and we can have a look.

skywalker_208 · 09-03-2005 3:05pm

Yea dont delete anything your not sure off!

that can make things much worse!

jor el · 09-03-2005 4:20pm

petes wrote:

HKEY_LOCAL_MACHINE\Software\Microsoft\Current Version

Also check under HKEY_CURRENT_USER\Software\Microsoft\Current Version in the Run and RunOnce keys for anything suspicious.

You could also look in the Process list (ctrl-alt-del and task manager), sort by User Name and look for suspicious processes under your login name. You should be able to kill of most of these processes one by one without damaging your system. Typically spyware doesn't run under System user name, though they are a clever bunch.

Saruman · 09-03-2005 5:15pm

A lot of people know about "HKEY_CURRENT_USER\Software\Microsoft\Current Version in the Run and RunOnce keys" etc but under XP there is a new one. Just go into regedit and search for "startupreg" (Without the ") If it finds it delete anything that branches off it.

dawballz · 09-03-2005 6:02pm

Khannie wrote:

Check your start->programs->startup folder. Remove anything fishy. Also do a search for startup in your regedit. There's a tool for telling you exactly what's starting at boot time, but I'm afraid I can't remember the name of it....anyone?

There was a thread on this a while ago....try the forum search too maybe.

start->run->msconfig
That'll tell you whats running at startup.
Id recommend ditching IE and getting an ALTERNATE browser

weird pop ups

Comments