win32:pornpopup

[essexboy]

No problem, unfortunately I will be offline for the next five days or so 

[davidwilliamburke]

Here is the Spybot report with expanded detail. I go to two sites prior to running Spybot: Forbes.com and Excite.com. I'll check back to see if you have responded. Meanwhile, I will pursue a fix for the nuisance of a virus...

[essexboy]

They are just cookies as a redirect from adbright and are not related to anything else on your system

[davidwilliamburke]

I've found that the pornpopup is not found if I stay away from the Excite.com page. So, when Spyboot does find pornpopup, that is nothing to worry about?

[essexboy]

That is correct they are cookies, and they are being saved in the history portion of the registry

[davidwilliamburke]

Essexboy, thank you for your assistance. Bottom line, system is running fine and I don't have a virus. Thanks again...

[essexboy]

My pleasure

Looking at that I am a happy bunny 

I will remove my tools now and give some recommendations, but I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

Code: [Select]

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself.  MBAM can be uninstalled via control panel add/remove along with ERUNT.  But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

   Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 21.
  
• Click the "Download" button to the right.
  
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  
• Click on Continue.
  
• Click on the link to download Windows Offline Installation (jre-6u21-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u21-windows-i586-p.exe and select "Run as an Administrator.")
  

SPRING CLEAN
 
Download and run Puran Disc Defragmenter

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

• SpywareBlaster to help prevent spyware from installing in the first place.
  Malwarebytes.  Run weekly to keep your system clean
  

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update
  

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?
Keep safe  :wave:

[emantoyaks]

try here:

www.wormblaster.net/Virus_Remover_Update.zip


Goodluck and GBU...

[Left123]

is it bad?

[Left123]

1.To stop all Win32.Pornpopup processes, press CTRL+ALT+DELETE to open the Windows Task Manager.

2.Click on the “Processes” tab, search for Win32.Pornpopup, then right-click it and select “End Process” key.

3.Click “Start” button and selecting “Run.” Type “regedit” into the box and click “OK.”

4.Once the Registry Editor is open, search for the registry key “HKEY_LOCAL_MACHINE\Software\Win32.Pornpopup.” Right-click this registry key and select “Delete.”

5.Navigate to directory %PROGRAM_FILES%\Win32.Pornpopup\Win32.Pornpopup.exe and delete Win32.Pornpopup.exe manually.

[DavidR]

I suggest that you read this topic in full, do you think if it were as simple as you suggest that essexboy the most experienced malware removal practitioner on the forums would have had to use all those tools to get rid of it; I think not.

This even more so when the topic has reached a successful conclusion.

I suggest that you follow the advice given by many monitor the viruses and worms forum if you wish to gain experience.

[Left123]

ok sir

[spybotadbrite]

Hope it's OK for me to bump this thread - it seems very close to my problem.

For the first time I noticed one win32.pornpopup cookie in my spybot scan.  This is listed as an IE cooker at username@adbrite.com/  I don't use *that* type of site - honest! - but I'm not sure whether having a win32.pornpopup cookie means I have a malware issue.  Kaspersky hasn't found anything (I have a regularly updated version of KIS 8 running).  I normally use Firefox, but have been using IE a bit more recently to go to a couple of shopping sites which weren't Firefox compatible.

MBAM full scan only found adware.bho in the item program files\eMusic Download Manager\winamp_plugin.exe (removed, but I'm pretty sure this was just adware that came with a legit music download service).

I haven't been getting any pop-ups.  I'm not sure whether I ought to be worrying and going through more thorough checks or disregard this cookie (and avoid using IE for shopping sites plastered with irritating adds) unless the cookie reappears?  I keep backups anyway, so my data should be safe.

(I know it's cheeky to ask here given that the AV package I use is a competitor to Avast.  Hope it's OK to post, though, as this thread seems a good match to the symptoms I have been having).

[turnitover]

This thread seems pretty old.  Does anyone still need the answer??  I had it on all my machines and fixed it very simply. The answer is real easy if someone still needs it I will write it out. Very non technical solution to this fix, and you can forget all that did you try this or that software.  That is not the answer and none of those software malware solutions will help you.  If you need help yet get back to me here. I hafe to write to myself if there is no one out there still looking for the solution.

[Oaktowner]

turnitover- Yes I'd like an answear.