Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cellorado Pop Ups (amongst Others)


  • This topic is locked This topic is locked
8 replies to this topic

#1 Corrupt Monkey

Corrupt Monkey

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:26 PM

Posted 06 March 2008 - 11:54 AM

Hi,

I'm experienceing the same problem as a few other folk with Cellorado pop ups.
I've ran numerous spyware removers but with no positive results.

I wasn't sure whether i could follow other instructions on this subject as I believe some of the cleaners used can be destructful if used incorrectly.

Please someone help me get this muck off my system!!Its doing my head in!! :thumbsup:

BC AdBot (Login to Remove)

 


m

#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,719 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:26 PM

Posted 07 March 2008 - 05:30 PM

Hello Corrupt Monkey and welcome to BC :flowers:

I wasn't sure whether i could follow other instructions on this subject as I believe some of the cleaners used can be destructful if used incorrectly.


You were wise not to follow those other directions. Disinfection procedures are written with a specific user's computer and software setup in mind, and you can cause serious damage to your computer with some special fix tools if you don't know what you are doing. Good choice on your part.

In order to assist you, we need to more information.

What is your operating system: Windows XP, Vista, etc.?

Please tell us the names of the spyware removers you have tried.

What security programs do you have installed? Please name them.

Are you experiencing other issues besides the Cellorado pop ups?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 Corrupt Monkey

Corrupt Monkey
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:26 PM

Posted 08 March 2008 - 12:57 PM

Hi,

I'm running XP.

I have used spyware doctor, spybot search and destroy, spyware blaster, ad-aware2007, I used to have Norton installed but i've just binned that in favour of AVG free.

As well as Celldorado i get various other full page pop ups, i just had one from 50connect, but the bulk of them are celldorado.

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,719 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:26 PM

Posted 08 March 2008 - 10:41 PM

Hello Corrupt Monkey,

Thanks for the additional information. Re: Your OS, are you running the Home or Pro version and do you have SP1 or SP2 installed?

Let's try a different AntiSpyware application and see what it finds. I'd like you to do a scan with SUPERAntiSpyware in Safe Mode. You will, of course, install it in Normal Mode. You may wish to print out these directions or copy them to Notepad so you will have them available in Safe Mode.

Download and install SUPERAntiSpyware free found here: SUPERAntiSpyware

Be sure to click on the download button to the left, not on the free trial download on the right.

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:
  • Close browsers before scanning
  • Scan for tracking cookies
  • Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
Reboot into Safe Mode
On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.
Reboot into Normal Mode
To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
Click close and close again to exit the program.

Please post the log in your next reply.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 Corrupt Monkey

Corrupt Monkey
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:26 PM

Posted 11 March 2008 - 04:10 PM

Hi Again,

I'm using XP home edition, I know i have SP1 installed and when I was in Safe mode it said 'service pack 2' at the top of the screen so i guess i have SP2.

SUPERAntispyware ran as described, here is the log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/11/2008 at 08:56 PM

Application Version : 4.0.1154

Core Rules Database Version : 3417
Trace Rules Database Version: 1409

Scan type : Complete Scan
Total Scan Time : 01:32:37

Memory items scanned : 172
Memory threats detected : 0
Registry items scanned : 6042
Registry threats detected : 0
File items scanned : 71916
File threats detected : 3

Adware.Tracking Cookie
C:\Documents and Settings\Dan Stringer\Cookies\dan_stringer@www.incentaclick[1].txt
C:\Documents and Settings\Dan Stringer\Cookies\dan_stringer@login.tracking101[2].txt
C:\Documents and Settings\Dan Stringer\Cookies\dan_stringer@incentaclick[1].txt


I recognise the 'tracking101' as a regular problem I've had so thats good, but whilst typing this I've just had another pop up from our friends at celldorado.

Thank you for your assistance so far.

#6 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,719 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:26 PM

Posted 11 March 2008 - 09:23 PM

Hello Corrupt Monkey,

Thanks for posting the log. SUPERAntiSpyware found just a few tracking cookies. I'm going to consult with some others to see where to go from here in identifying what is causing your problems.

In the meantime, I encourage you to read the following about cookies and work to block such cookies.

Tracking cookies are not a threat, but there are privacy concerns. Tracking cookies are a kind of third party cookie. You can read more about the kind of cookies and how to block unwanted cookies in IE in the in this post: http://www.bleepingcomputer.com/forums/ind...st&p=702871

The links he provides will tell you how to block third party cookies in IE.

You can set up Firefox to block unwanted and unneeded cookies this way:

Click on Tools --> Options --> Privacy

Make sure there is a check mark by "Accept Cookies from Sites." Then in the box just below, make sure the window says "Ask me every time."

What this will do is that every time a site wants to put a cookie on your computer, a little window will pop up asking you if you want to accept it. The first time it shows up, click on "Show details". From then on, except when you reinstall Firefox or in some instances update it, the details will always be shown. There you can see who wants to put it on your computer and whether it is a session cookie or a permanent cookie.

You can add the site to your black list or white list by putting a check mark Use my choice for all cookies from this site and clicking on Deny which adds it to the black list or Allow for session or Allow. The latter choice means that any permanent cookies will stay on your computer until they expire or you delete them. The former choice means that the cookies will always go away when you close your browser. Either way, the sites will be added to the white list.

You can see what cookies are installed by clicking on the Show Cookies button on the privacy screen where you set the cookie options. When you click on Exceptions you will see the list of sites blocked from or permitted to set cookies. You can manually add sites to the block or allow list here, and you can also remove sites from the list.

Security programs such as Spywareblaster - prevents spyware from being installed on your PC. - Tutorial: Using SpywareBlaster will add many sites to the block list to protect you from tracking cookies.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#7 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,719 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:26 PM

Posted 11 March 2008 - 10:22 PM

Hello Corrupt Monkey,

In consulting with others, we have determined that in order to remove this infection, we will have to resort to more powerful tools than are used in the Am I Infected forum. Please follow the directions in this guide. While you may have done some of the steps, it won't hurt to do them again. If you cannot do a step, then skip it and go on to the next. Then create an HJT log, you will find the directions in step 9 of the guide.

Create a new topic in this forum, not here and give it a good descriptive title. Briefly summarize what the problems are, what you have done to try to solve it, and what worked and didn't work and paste in your HJT log. Please include a link to this thread and tell them we sent you there.

After you post your log, DO NOT make any further changes to your computer: deleting files, editing the registry, using special fix tools, installing or uninstalling software etc. as this will make it more difficult for the HJT team to help you.

Please be patient as the HJT team is very busy. DO NOT bump your log as the team may think that someone is already helping you. If you have not had a response in five days, add a response to the five days no response topic and paste in the link to your thread.

After you post your log, please paste the link as a reply to this thread so we know you are receiving assistance from the HJT forum.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#8 Corrupt Monkey

Corrupt Monkey
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:26 PM

Posted 12 March 2008 - 04:02 AM

Ok i'll give that a shot, many thanks.

#9 TMacK

TMacK

  • Members
  • 4,672 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:B.C. Canada
  • Local time:02:26 PM

Posted 13 March 2008 - 01:36 PM

Now that you have a HJT log posted in the HijackThis Logs and Malware Removal forum, you shouldn't make any changes to your system.
Doing so, could change the results of the posted log, making it difficult to properly clean your system.

At this point, the HJT Team should be the only members that you take advice from
, until they have verified your log as clean.

This topic will now be closed, since you have an open log posted.
If you have any questions, feel free to send me a PM.
Chaos reigns within.
Reflect, repent, and reboot.
Order shall return.

aaaaaaaa a~Suzie Wagner




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users