[kegswindows] Re: Casino pop-ups

  • From: "David C Abernathy" <davea@xxxxxxxxxxxxxxxxxxxx>
  • To: <kegswindows@xxxxxxxxxxxxx>
  • Date: Wed, 3 Jul 2002 12:16:28 -0700

Check to see what the "Home" page is, some will change  their site to be
the Home page. 

Remove ALL cookies and internet files.  There has been a method where on
reboot a startup file will change the home page, so check out the
startup group and  run 'MSConfig' to see what is being started.

David C Abernathy
Windows XP associate eXPert 

-----Original Message-----
From: kegswindows-bounce@xxxxxxxxxxxxx
[mailto:kegswindows-bounce@xxxxxxxxxxxxx] On Behalf Of Lee Gentry
Sent: Tuesday, July 02, 2002 9:43 PM
To: kegswindows@xxxxxxxxxxxxx
Subject: [kegswindows] Re: Casino pop-ups

Thanks Dave..I kinda know where the script came from...but being
polite..client insists she NEVER visits such sites.  I just smile and
tell her she's lucky it wasn't porn site.

Anyway...regardless of how it got there, we've got a file somewhere that
opens Internet Explorer and starts downloading page after page of casino
sites.  Can't close the screens fast enough...it seems for every screen
you close, 2 more pop up.  Only way to stop it and resume the legitimate
work at hand is to reboot the computer.  Computer is fine then..until
the "nasty" triggers and starts it all over again.  So far I have not
been able to determine what triggers it.  I've gone so far as to cold
boot the machine and do NOTHING..not even one mouse click.  Leave it a
few minutes and here come the casino sites.

I have installed a popup killer as a temporary measure...seems to work
ok, but as you say..the popup killer also interferes with some
legitimate web work.

Back to the problem at hand...how do I find this malicious file and get
rid of it?  I've tried Norton after clearing the Exclusions list without
any luck.

Got any ideas....other than "fdisk"??

Lee Gentry
425-343-2295 (cell)

-----Original Message-----
From: kegswindows-bounce@xxxxxxxxxxxxx
[mailto:kegswindows-bounce@xxxxxxxxxxxxx] On Behalf Of David C Abernathy
Sent: Tuesday, July 02, 2002 8:16 AM
To: kegswindows@xxxxxxxxxxxxx
Subject: [kegswindows] Re: Casino pop-ups

"We have no idea where the "nasty" came from" 
These come from the sites that you are visiting. There is a script that
gets started when you visit these sites which is to open another.
Besides the popupkillers just do NOT visit these site that have this
type of scrip running.

Be careful, some of the popup killers will block other sites, such as
some banking, Windows Update, AV downloads and etc. So if you start
seeing things like this, it MAY be your popup killer.

David C Abernathy

-----Original Message-----
From: kegswindows-bounce@xxxxxxxxxxxxx
[mailto:kegswindows-bounce@xxxxxxxxxxxxx] On Behalf Of Lee Gentry
Sent: Monday, July 01, 2002 8:26 PM
To: kegswindows@xxxxxxxxxxxxx
Subject: [kegswindows] Casino pop-ups


Got a Win98 computer with a mind of it's own.  Internet Explorer will
suddenly open and start downloading assorted casino websites. Of course
everytime you try to close a screen more will pop up ..the task bar
fills with pop up screens.

Have used Task Manager to close EVERYTHING listed except Windows

Have run and re-run Norton AV 2001 to see if it could pick up anything
with no luck.  I cleared the Exclusions list in case the "nasty" was
hiding from Norton that way.

Computer is inline with DSL thru a NAT "firewall" router (Linksys).

Whatever triggers the "nasty" to start opening casino sites does not
seem to be related to internet use.  Simply booting the computer and
waiting a while is enough.

Right now I am using a pop-up killer to suppress the casino
screens...the computer is unusable without it.

Anybody else seen anything like this?  We have no idea where the "nasty"
came from.  The computer user swears she has never visited a casino

Regardless of how we got it, we have some sort of malicious program that
uses IE and web sites to make the computer unusable and I really need to
get rid of it.

HELP...any ideas less painful than "fdisk"

Lee Gentry

Other related posts: