andromeda Report post Posted October 23, 2005 I have started to get this quick frame of a pop-up that comes up about every 15 minutes or so. I can be in any program and IE does not have to be opened. I have run countless spyware scans and virus scans but they don't find anything out of the ordinary. You can see my test results in my TechExpress link. Any ideas? Share this post Link to post Share on other sites
shadowfox Report post Posted October 24, 2005 (edited) Just to be on the safe side lets do this. Download, install, update, and run Ad-Aware SE Personal SpyBot S&D Go to and run. Trend-Micro Scans. Run the all three Scans. PC Pitstop's Antivirus Scan As for the popup, I would try to figure out when it comes up and when it does, it the print screen key right when it comes up, and then go to paint, and hit paste. If you did it in time you should have a screen shot of yoru popup. As for axually apps that take screen shots I dont' know of any so i can't help you out there. Edited by Inprofile. The last thing we do around here is tell someone to post a HJT log. The other programmes you suggested may work, if not, suggest something else. We simply do not have enough HJT advisors at the forum. Edited October 24, 2005 by Inprofile Share this post Link to post Share on other sites
shadowfox Report post Posted October 24, 2005 Also Try Disabling these entrys that were in your pit test. C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE Share this post Link to post Share on other sites
flyfishingrules2 Report post Posted October 24, 2005 Edited by Inprofile. The last thing we do around here is tell someone to post a HJT log. The other programmes you suggested may work, if not, suggest something else. We simply do not have enough HJT advisors at the forum. You've got to be kidding, right? We're not to suppose to send people over for HJT scans--since when? I realize there is a problem over there, but has it gotten that bad? Share this post Link to post Share on other sites
andromeda Report post Posted October 24, 2005 Well, I think I've run every spyware/adware/virus scanner known to mankind I have already disabled that entry just before I posted this thread. I've been watching a movie the last few hours so I'm not sure if that did anything or not but so far I haven't gotten that pop up since I've been typing this reply Gotta turn it in for the evening so I'll check back in the morning to see if anyone else has a suggestion...and yes, a HJT post I'll do only if these suggestions don't work. And BTW, I've already run a HJT scan and got my boyfriend to look at it and he didn't see anything out of the ordinary but he's not a HJT advisor. :crash: Share this post Link to post Share on other sites
IntelGuy Report post Posted October 24, 2005 Are you using a popup blocker? You may want to disable it long enough to see what the popup has to say. Might give you a clue where it's coming from. Also, have you already shot the messenger? http://grc.com/stm/shootthemessenger.htm BTW, nice av.... Share this post Link to post Share on other sites
kd5 Report post Posted October 24, 2005 She already disabled Google Toolbar, it still just flashes for a fraction of a second, can't tell what it is. Also, she's running Windows ME, she doesn't have a Messenger Service on her OS. One other thing: It flashes whether IE is open or not. -kd5- (for andromeda) Share this post Link to post Share on other sites
IntelGuy Report post Posted October 24, 2005 she's running Windows ME, she doesn't have a Messenger Service on her OS. I don't know squat about ME. Can you disable almost everything from starting up? Does it do it in safe mode? (I know it's got safe mode. I just checked. ) Hey, I just had stupid idea #98,731. Video tape the screen and play it back in freeze frame??? Share this post Link to post Share on other sites
illukka Report post Posted October 24, 2005 well hows that hijackthis log then, i'd like to take a look Share this post Link to post Share on other sites
Inprofile Report post Posted October 24, 2005 You've got to be kidding, right? We're not to suppose to send people over for HJT scans--since when? Do you hear me laughing? Since August 14th, 2004. Dave - "Try HijackThis last." Andromeda, go ahead and post that HJT log. I'm quite sure that kd5 will have had you run all available malware/virus removal tools. Share this post Link to post Share on other sites
andromeda Report post Posted October 24, 2005 Log posted in the HJT log forum. Share this post Link to post Share on other sites
andromeda Report post Posted October 24, 2005 (edited) Oh and BTW...shutting off that running process: C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE didn't change anything...my mystery pop up is still flashing before my eyes... Sounds as if the pit needs to recruit some HJT advisors PDQ! Why are there no people to help anymore? Edited October 24, 2005 by andromeda Share this post Link to post Share on other sites
PORTHOS Report post Posted October 24, 2005 Sounds as if the pit needs to recruit some HJT advisors PDQ! Why are there no people to help anymore? Because Its hard work and to proctect our members we dont just let "anybody" work in that section. Share this post Link to post Share on other sites
andromeda Report post Posted October 25, 2005 Because Its hard work and to proctect our members we dont just let "anybody" work in that section. I am in no way suggesting to let just anyone be a HJT advisor...I am suggesting trying to figure out how to recruit some people that could be HJT advisors. Share this post Link to post Share on other sites
humpd Report post Posted October 25, 2005 If you are using AVG as your anti-virus, shut it off and see if the pop-up problem continues. I have experienced AVG doing what you describe but it generally happened when I turned on the computer. Its worth a try. Share this post Link to post Share on other sites
andromeda Report post Posted October 25, 2005 Thanks for that suggestion but I use System Suite 5 anti-virus not AVG. Share this post Link to post Share on other sites
faith_michele Report post Posted October 25, 2005 (edited) Do you use this? IncrediMail Xe The reason I ask is because I had a problem like this with a machine at work and this was the culpret. It was because it hadn't been activated. The only way I was able to remove it was to activate it (with their example name and phony email). Then and only then would it allow me to uninstall it.......then it wasnted to know why I didn't want to use it. Edited October 25, 2005 by faith_michele Share this post Link to post Share on other sites
andromeda Report post Posted October 25, 2005 (edited) I use IncrediMail instead of Outlook Express so it's activated. Thanks! Edited October 25, 2005 by andromeda Share this post Link to post Share on other sites
faith_michele Report post Posted October 25, 2005 Okay, I'll keep looking. Share this post Link to post Share on other sites
andromeda Report post Posted October 26, 2005 Well, I can't say exactly when the pop up stopped but I haven't seen it anymore and I don't think I would have just not noticed it because it was coming up all the time. I believe that it went away after Panda removed a trojan but I can't be 100% sure of that but I'd say it's a pretty good guess! Drives me crazy that my PAY anti-virus program didn't stop/find or remove it but a free scan on line did! Share this post Link to post Share on other sites
faith_michele Report post Posted October 26, 2005 Thats great. Share this post Link to post Share on other sites
Jacee Report post Posted October 27, 2005 Good to know you found the 'culprit'. Thanks for replying here. I'll close your HJT log topic. Share this post Link to post Share on other sites
Guest cdingler Report post Posted October 27, 2005 Andromeda, can you tell me what scan you used to find it? I've tried several and still haven't caught the little bugger that's causing this. Any help is much appreciated. C Share this post Link to post Share on other sites
IntelGuy Report post Posted October 27, 2005 Most likely it was this one: http://www.pandasoftware.com/products/activescan.htm Share this post Link to post Share on other sites
andromeda Report post Posted October 27, 2005 (edited) Use the Panda scan as Intelguy gives you the link for. It's very thorough and takes a long time. It does remove viruses but it doesn't remove spyware but it shows you what you have and I think that that was the scan that showed several spyware thingies(haha) but we had to just manually remove them. I used so many different scanners that I've lost track of what all did what...sorry! I know with 100% certainty that Panda did find a virus and removed it though! Try this one too: housecall Oh and by the way...I used Spybot, adaware, spysweeper, vcom and they didn't find anything... The full scan at The Pitstop was what first said there was a virus(I think it was actually a trojan) but the only thing that removes viruses that found anything was Panda. I hate those scans that tell you you're infected but don't do anything about it Edited October 27, 2005 by andromeda Share this post Link to post Share on other sites
