Is the forum planting adware?

[UnrepentantSinner]

Let me preface this post/thread by stating that I'm at my wits end about an issue with one of three computers I use at work, my particularly frustating efforts to deal with our recently offshored IT support and because, as I'll note below, one of my pop-up ad incidents occured immediately after clicking on a forum thread.

Let me futher preface this by noting a few things:
- I'm not going to give more details than I feel comfortable with.
- As I noted in the OP, this issue is only on 1 of 3 different computers that I use and never occured on 3-5 others which I accessed JREF forums from.
- I ran a virus scan twice and got no hits.
- Keep in mind the fact that this only happens on 1 of 3 computers that I use, but I am even more careful about Net usage at work than any of my co-workers and they don't seem to have the same issue. I access JREF forums, Wikipedia, my Yahoo mail (and don't click on anything suspect in my inbox) and Google (but don't take links resulting from searches that I don't consider trustworthy).
- Like I said, at least 5 computers at work over the last 7 years and my 1 at home, so this is an isolated incident.

With those prefaces... in the past few weeks, on this one computer, I've been getting a pop-up spam ad for saatchi-gallery.co.uk. I'd been closing it and chalking it up to Wikipedia. A few days ago, I started getting other pop-up ads - this is with pop-up blocker. Last night I started getting 5 or 6 suddenly cropping up. Nothing bad, just (from what I could tell before I killed them) credit cards, mortgages, flowers, etc. The reason I even posted this thread is because one of these incidents happened immediately after I opened a thread on this forum. This even happened when I had IE closed down. Again, I ran a virus scan which should have caught adware, but got nothing.

I called IT, and she walked me through some steps clearing cookies, resetting some stuff on IE, etc. This was near the end of my shift. I went home, came back last night, logged on to JREF forums only... all was good for a couple of hours, and then I suddenly got the saatchi-gallery.co.uk full screen pop-up again. I closed both, cleared my cookies and history and let the comp sit. About 4 hours laterish, I got the same pop-up again. This was when I had IE closed down and was playing solitaire.

Anyone have any thoughts or suggestions?

[The Atheist]

What AV system are you running? Neither Norton nor AVG manage to pick up spyware and most commercial anti-adware programs are useless as well. Sounds suspiciously like you have a lop infection.

Do you have a Hijackthis log (http://www.spywareinfo.com/~merijn/programs.php)? If not, go get one.

[Arkan_Wolfshade]

If you are running Firefox, install Ad Block Plus and NoScript. Should not only stop the pop-ups, but also should allow you to diagnose from where they are getting called.
eta: oh, and Flash Killer

[Reality Believer]

Might be a type of trojan that is particularly deep. Not all scanners are capable of finding all threats. Here is a thread that discusses a free trojan remover.

http://forums.randi.org/showthread.php?t=104580

[JWideman]

That's very odd. That isn't a site that would normally be associated with spyware. It sounds like something somewhere in your browsing is triggering it, though without knowing more about your surf habits that is impossible to guess.
In the short term, install Firefox and stop using IE.

[Darat]

To answer the thread title's question - no.

[Rat]

That's very odd. That isn't a site that would normally be associated with spyware. It sounds like something somewhere in your browsing is triggering it, though without knowing more about your surf habits that is impossible to guess.
In the short term, install Firefox and stop using IE.
But that wouldn't undo what's already there - the OP made it clear that he wasn't browsing every time it happened, albeit that it was possibly browsing that first caused the problem. At the very best, if you made Firefox the default browser and disabled IE, you would likely just end up with the same popups being launched with the same frequency in FF instead of IE.

I agree with TA. Get a HijackThis log and post it here or somewhere else where people can look at it.

[GodMark2]

To answer the thread title's question - no.

<tinfoilhat>That's just what the Admins want you to think.</tinfoilhat>

[Rika]

I'd also strongly consider running ad-aware and spybot.

[UnrepentantSinner]

Two problems with the advice I've gotten.
1. I mentioned in the OP that this is my work computer so I cannot change the browser.
and
2. I'm allowed to (see this is my work computer in 1) download programs or installs.

To answer the thread title's question - no.

Dammit Darat, I wish I'd phrased the first paragraph of the OP/title questoin better. I wanted to use a thread title that would grab attention and solicit the most responses possible and then offer a caveat in the OP. I forgot to, and for that I apologize.

That's very odd. That isn't a site that would normally be associated with spyware.

That is my issue. I didn't even fire up IE, and yet last night, after leaving that particular comp for a few hours, returned to find 5 pop-up ads (2 from saatchi), none of which were pornographic or anything, all commercial.

It sounds like something somewhere in your browsing is triggering it, though without knowing more about your surf habits that is impossible to guess.
In the short term, install Firefox and stop using IE.

At work I check the things I noted in the OP with the addition of Netflix. When I use Google to support claims I make on this forum, I don't even link to sites Google calls up - just the results - so I can avoid downloading as much as possible. Having watched some of the stuff my co-workers browse, I'm positively paranoid compared to sites they visit.

I'd also strongly consider running ad-aware and spybot.

I'd take that advice, but see above. :(

Since following the instructions from IT (again, see OP), I've logged into JREF forums, and a few hours later had the saatchi ad pop up. Last night I never even fired up IE, but after leaving the comp to sit for a few hours, had two saatchi ads and three others.

[JWideman]

Since following the instructions from IT (again, see OP), I've logged into JREF forums, and a few hours later had the saatchi ad pop up. Last night I never even fired up IE, but after leaving the comp to sit for a few hours, had two saatchi ads and three others.

Ah ha! Then I was mistaken, and this has nothing to do with browsing at all. Adware has been installed on that computer, and probably NOT even by browsing. I say that because this is the sort of behavior demonstrated by adware that is installed along with other - usually ad supported - software. A virus scan won't catch this because it's somewhat legit, at least in the sense that whoever installed the host software should have been made aware of the presence of the adware.
Unless you have complete control of the computer to the point of knowing what software, if any, was recently installed, your only option at this point is posting a hijackthis log.

[Rat]

It's clearly not where you're going (though it may be where you or someone else has been) that's the problem, as already noted. What OS and what version of IE are you running?

Check what's running on start up in Regedit under HKCU/Software/Microsoft/CurrentVersion/Run and HKLM/Software/Microsoft/CurrentVersion/Run to see if there's something being run at logon that shouldn't. There are other places that things can launch, but they're the first place to look.

Have a look in Task Manager (Ctrl+Alt+Del) to see what's currently running. If whatever's causing the problem is running as a service, this won't help, but it's worth looking.

Also running msconfig (just type msconfig in the Run box to run it) will tell you what's being launched at startup from all locations. This will allow you to do a one-time clean boot without launching any of the crap that normally runs at startup. Doing this selectively may tell you which item is causing the problem.

The only other thing that springs to mind is Browser Helper Objects. I can't remember where these live in XP now, I'm afraid.

[six7s]

this is my work computer so I cannot change the browser

I assume that you "cannot" because someone else says so

If so, it's their problem, not yours

Back up all of your data and then demand a full fix, a formatted hard-drive if necessary

Good luck though... if your IT dept insists on using IE, then they're either lackeys of the NWO and/or inept

Either way, it's their problem, tell them to do their job and make it go away

NB: I ain't no CTist... all browsers are at risk...

However, just as inner-city bus-shelters are a prime target for graffiti simply because of the potential audience, IE is the prime target for attack and, compounding the problem, it has more bugs than a very buggy thing

Google: Results 1 - 10 of about 28,900 over the past 6 months for security flaws "internet explorer" (http://www.google.com/search?hl=en&lr=&suggon=0&safe=off&q=security+flaws+%22internet+explorer+%22&as_qdr=m6&btnG=Search)

[UnrepentantSinner]

I assume that you "cannot" because someone else says so

Sorry to snip, but you're just reiterating things I'm prescient of when it comes to this situation already. Combining your and Rat's advice, the best case scenario would be someone from local IT to come out and see exactly what I've been describing so they could deal with it directly. But out-sourcing is sooooo much cheaper. :rolleyes:

Just to reiterate what I mentioned in the OP, on the computer that is giving me problems - had pop-ups during the short time I was logged on last night. The other two computers I use? Logged on and with an IE window up the whole evening... nothing.

Is there a "grrrrr" smilie?

[six7s]

Sorry to snip, but you're just reiterating things I'm prescient of when it comes to this situation already

So, if your prescient of the fact that it's contained within an SEP field (http://en.wikipedia.org/wiki/Somebody_Else's_Problem_field), how come you can still see it well enough to be concerned about it?