redirected to same ad many times during browsing

[hssstevens]

Thanks again for your advise, really helps


After the AVG-antispy expires, should it be removed from the startup tray?

PP says do not use Spybot's "tea-timer", okay to ask why? mine is on, how to turn it off.

Thanks again.

[jholland1964]

Take the AVG anti-spy out of there right now but keep the program and keep it updated. It DOES NOT need to run in the background, same goes with the Spybot Teatimer.
Tools that are excellent for scanning for malware do not necessarily serve as well the separate function of protection. The immunize, ad-blocking, and similar protective features of these programs mostly aren’t needed, don’t do much that is really helpful, and sometimes unnecessarily get in the way of how you use your computer. (If you are running Windows XP Service Pack 2, they really are unnecessary.) There are so much easier and less intrusive ways, like SpywareBlaster, to protect your computer, that it is really best to keep the scanner programs just for weekly scanning and the programs made for realtime protection updated, SpywareBlaster, and running...anti-virus, firewall.

To disable Teatimer,rightclick teatimer and select exit Spybot S&D resident.Then,open Spybot,go to mode,select Advanced Mode,then Tools->resident,and then uncheck Resident "Teatimer"(Protection of over-all system settings) active.

[hssstevens]

Hi, thank you very much. Really appreciate your help have learned so much.

[jholland1964]

Happy to help! Come back anytime!

[hssstevens]

Hi again.

Some updates about the unisilvertime ad, though not sure if the info. gathered is accurate, don't know how it was done but seems like the advertiser have somehow used the "line?" of the Internet Service Provider(s), to redirect subscribers to their ad several times during browsing. The provider has said that they've already blocked and fixed the problem (no incidents so far) and that no bad program was installed.

I'm am still concerned about this - how could they forcibly redirect you to their ad several times without installing "doing" something to your computer.

Thanks.

[jholland1964]

Hi again.

Some updates about the unisilvertime ad, though not sure if the info. gathered is accurate, don't know how it was done but seems like the advertiser have somehow used the "line?" of the Internet Service Provider(s), to redirect subscribers to their ad several times during browsing. The provider has said that they've already blocked and fixed the problem (no incidents so far) and that no bad program was installed.

I'm am still concerned about this - how could they forcibly redirect you to their ad several times without installing "doing" something to your computer.

Thanks.

Sounds as if they "hacked" the ISP...or at least that is what it sounds like they are saying.
Have you run all those tools in PP's sticky?
I don't recall seeing a HJT log from you. If you are concerned, as maybe you should be, then by all means, run those tools and then run the HiJackThis scan and post the log here.
We can usually tell by the log if there is "something" on the computer that shouldn't be there and then give you the steps to remove ti.
Bear in mind that everything showing in HJT is not bad and ALSO that some bad items can disguise themselves as something good too. So don't do any cleaning with HJT unless told to do so. But, I for one, would really like to see a log.
Judy

[hssstevens]

Have run the tools and scans turn out okay.

Got the log. thanks.

Logfile of HijackThis v1.99.1
Scan saved at 5:41:34 PM, on 12/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[jholland1964]

Hi hssstevens,
Your log looks good to me. Looks like you have some good security programs too.
I would recommend one more, if you don't all ready have it and that is SpywareBlaster
It is a super, FREE, program that will, to quote their website; Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially unwanted sites in Internet Explorer.
The nice thing is too is that it DOES NOT run in the background. Just keep it updated and it will help keep the computer clean.
Try it, I think you will like it a lot.
Judy

[hssstevens]

Hi Judy,
Thanks again, will do. Happy Holidays!