Just recently this very annoying pop-up message appears on screen.

Even when nothing is running and the Desktop is showing.



What is annoying is that until I click on "Work Offline", everything stops!

There is nothing running in the Windows task Manager.

Does anyone recognize this pop-up message?

How do I find out what program is throwing it up on screen?

Thanks.

[Reply or follow-up to this message]

BTW - I use Netzero.com and Mozilla's SeaMonkey 1.1.

However, as I said, the pop-up appears when nothing is running!

[Reply or follow-up to this message]

Make sure IE is set "never dial a connection" see if that helps

[Reply or follow-up to this message]

I checked - it is set to "never dial a connection" on IE.

I also unchecked the "Indexing Services" on Disk Managenment.

I ran the defragmenter on C:.

[Reply or follow-up to this message]

it could be spyware/virus that has managed to hide itself from the task manager, run an antivirus and antispyware scan


On Friday, March 14, 2008 at 7:44 pm, traknarf wrote:
>I checked - it is set to "never dial a connection" on IE.
>
>I also unchecked the "Indexing Services" on Disk Managenment.
>
>I ran the defragmenter on C:.
>
>
>

[Reply or follow-up to this message]

I have done that over and over....when everything found is "cleaned", the popup still 
pops up!

If it is coming from something running in my tray - I cannot identify it!

I understand that Windows XP has a 'files run' thing I can use, but that
it is VERY COMPLICATED....

I may have to resort to that....

I am currently using Netzero, will soon dump it (dialer is a pain in the
butt - starts IE)...but I don't think NZ is doing it.

That is why I placed the screensave pic to see if anyone recognises it.

[Reply or follow-up to this message]

in ie, tools/internet options/delete temporary internet files/check 'delete all offline content'/ok/ok.

[Reply or follow-up to this message]

Something NEW!

Turned on computer, signed on and left.
Half hour later found IE up with this in the location box:

http://85.12.43.74/go/?cmp=nm_testnew3&uid=DBBBADD8ED8411DC892BF67607CFFFFF&rid=radip&guid=1DD6D4A4DFB94FD0BB475D56F463E7AE&affid=67607&lid=&url=

tried to run it when I was online, but nothing came up...

What the Hell...?

[Reply or follow-up to this message]

http://www.whatsmyip.org/whois/
paste the address into the whois lookup box. also, you can look into your registry to try to find the offending website and associations.

[Reply or follow-up to this message]

I realized that Google, in its infinite ability, might tell me what 85.12.43.74
is all about - so I googled it and came up with this
http://www.threatexpert.com/report.aspx?uid=d9bee199-8ba4-4366-963e-b5836a543fb3

It is from a Trojan.

Now I have to try to "get" it....and kill it.

[Reply or follow-up to this message]

Further study has found this to be "Trojan.Vundo" probably out of Russia.

These sites were found to remove it:

http://www.trojan-vundo-removal.com.removal-instructions.com/removeTrojanVundo.html

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112210-3747-99

http://www.majorgeeks.com/download4430.html

to name a few....

We'll see if any of them work.

Personally, I think writing and disseminating Trojans and Viruses should be a Capital 
Offense punishable by crucifixion.

[Reply or follow-up to this message]

I ran a 'Trojan.Vundo' remover - it said I wasn't infected.

Then I went to msconfig and studied the numerous things that load up
when I start up.

I unchecked them all and checked one at a time and started up.

Long story short - it was a NETZERO program called "exec" which 
pre-loads Netzero for a "quick start"....rubbish....

That was what kept trying to load itself and was constantly asking with 
that popup.

I am dumping Netzero.  The dialup loader is clunky, is full of ads, and
is always on top until done loading.  

Then it brings up IE whether or not I want to use it....they say they "are sorry, 
but they can't do anything about that!"

Can you believe that!?

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum