Annoying pop-ups

Annoying pop-ups

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Annoying pop-ups Garry 02-11-2006
|--> Re: Annoying pop-ups Roger Abell [MV...02-11-2006
Posted by =?Utf-8?B?R2Fycnk=?= on February 11, 2006, 12:12 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi
I started to have a problem for which I can not find any explanation, the
following group of pop-ups start coming up every time I start computor or
close those pop-ups(cannot reproduce a picture sorry)

Header: 16 bit MS-DOS Subsystem
Text: C:\DOCUME~1\ADMINI~1r6d.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0544 IP:01fb OP:63 6f 6c 6f 72 Choose 'Close' to terminate
the application

I followed the address and have found a lot of .exe files (as the one in the
address above), all of which are 4 KB in size, and I think there are 2 more
files which are belong to this group - ntuser.dat.LOG and ntuser.dat.
I don't have a clue what is happened here? May be OS (XP PRO, no service
packs - this PC is more than 4 years old and can not handle SP2) problem, may
spyware or virus - Scanned with AD-WARE, Spybot, and Microsoft Antispyware
Beta - nothing helps.
Please help.
Deeply appreciate for any inside info/suggestions.
Garry

P.S. Those pop-ups looks like appearing in certain standard intervals...

Posted by Roger Abell [MVP] on February 11, 2006, 1:53 am
If you were  Registered and logged in, you could reply and use other advanced thread options
ntuser.dat.LOG and ntuser.dat are system files that are part of
your account profile (reg data).
You should leave those alone.
I cannot imagine a 2 year old system being insufficient for
loading service packs, and I am loath to imagine the state
of a machine that has been internet active without any
XP service packs. You may be best off by rebuilding the
system from a fresh format on up, including installing SP2
and turning on the firewall before the machine is first connected
to the network.

> Hi
> I started to have a problem for which I can not find any explanation, the
> following group of pop-ups start coming up every time I start computor or
> close those pop-ups(cannot reproduce a picture sorry)
>
> Header: 16 bit MS-DOS Subsystem
> Text: C:\DOCUME~1\ADMINI~1r6d.exe
> The NTVDM CPU has encountered an illegal instruction.
> CS:0544 IP:01fb OP:63 6f 6c 6f 72 Choose 'Close' to terminate
> the application
>
> I followed the address and have found a lot of .exe files (as the one in
> the
> address above), all of which are 4 KB in size, and I think there are 2
> more
> files which are belong to this group - ntuser.dat.LOG and ntuser.dat.
> I don't have a clue what is happened here? May be OS (XP PRO, no service
> packs - this PC is more than 4 years old and can not handle SP2) problem,
> may
> spyware or virus - Scanned with AD-WARE, Spybot, and Microsoft Antispyware
> Beta - nothing helps.
> Please help.
> Deeply appreciate for any inside info/suggestions.
> Garry
>
> P.S. Those pop-ups looks like appearing in certain standard intervals...



Posted by PA Bear on February 11, 2006, 4:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
1. Get WinXP SP1 and everything else Windows Updates offers you (save SP2)
installed...NOW!

Protect Your PC
http://www.microsoft.com/athome/security/protect/

2. Run a /thorough/ check for hijackware.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

3. When your HijackThis log has been given a clean bill of health, install
SP2 [1][2]

[1] You may wish to add a considerable amount of memory before doing so. I
wouldn't run WinXP (SP1) without at least 512MB; as for SP2, please see:

The hard disk space requirements for Windows XP Service Pack 2:
http://support.microsoft.com/default.aspx?kbid=837783

[2] In the not-too-distant future, your machine must have SP2 installed to
get /any/ security updates.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org

Garry wrote:
> Hi
> I started to have a problem for which I can not find any explanation, the
> following group of pop-ups start coming up every time I start computor or
> close those pop-ups(cannot reproduce a picture sorry)
>
> Header: 16 bit MS-DOS Subsystem
> Text: C:\DOCUME~1\ADMINI~1r6d.exe
> The NTVDM CPU has encountered an illegal instruction.
> CS:0544 IP:01fb OP:63 6f 6c 6f 72 Choose 'Close' to terminate
> the application
>
> I followed the address and have found a lot of .exe files (as the one in
> the address above), all of which are 4 KB in size, and I think there are
> 2 more files which are belong to this group - ntuser.dat.LOG and
> ntuser.dat.
> I don't have a clue what is happened here? May be OS (XP PRO, no service
> packs - this PC is more than 4 years old and can not handle SP2) problem,
> may spyware or virus - Scanned with AD-WARE, Spybot, and Microsoft
> Antispyware Beta - nothing helps.
> Please help.
> Deeply appreciate for any inside info/suggestions.
> Garry
>
> P.S. Those pop-ups looks like appearing in certain standard intervals...


Posted by George Hester on February 15, 2006, 4:05 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Actually you just need to get those exe files out of your temp directory.
That does not mean they will not come back but they might not. If you
cannot get them out because access is denied then boot into safe mode and
try deleting them then. If you cannot then a reinstallation will be
necessary.

--

George Hester
_________________________________
> Hi
> I started to have a problem for which I can not find any explanation, the
> following group of pop-ups start coming up every time I start computor or
> close those pop-ups(cannot reproduce a picture sorry)
>
> Header: 16 bit MS-DOS Subsystem
> Text: C:\DOCUME~1\ADMINI~1r6d.exe
> The NTVDM CPU has encountered an illegal instruction.
> CS:0544 IP:01fb OP:63 6f 6c 6f 72 Choose 'Close' to
terminate
> the application
>
> I followed the address and have found a lot of .exe files (as the one in
the
> address above), all of which are 4 KB in size, and I think there are 2
more
> files which are belong to this group - ntuser.dat.LOG and ntuser.dat.
> I don't have a clue what is happened here? May be OS (XP PRO, no service
> packs - this PC is more than 4 years old and can not handle SP2) problem,
may
> spyware or virus - Scanned with AD-WARE, Spybot, and Microsoft Antispyware
> Beta - nothing helps.
> Please help.
> Deeply appreciate for any inside info/suggestions.
> Garry
>
> P.S. Those pop-ups looks like appearing in certain standard intervals...


Similar ThreadsPosted
annoying sounds February 9, 2006, 7:15 pm
Annoying virus alert pop-up July 25, 2006, 9:00 am
PLEASE HELP remove spyware and annoying ads!!! August 15, 2006, 11:56 pm
Annoying "Restricted Sites" behavior, IE 7 February 20, 2007, 5:55 pm
Annoying "run as" >> "run this program with restricted access" pro October 4, 2007, 8:41 pm
getting rid of popups July 29, 2006, 11:35 am
Re: getting rid of popups August 2, 2006, 5:27 am
POPUPS July 18, 2007, 8:52 am
popups January 5, 2008, 2:05 am
Porn ADs and popups December 12, 2005, 6:43 pm

The site map in XML format XML site map

Contact Us | Privacy Policy