CiD Popups frustration

[carloochie]

I am searching around and finding some over year-old posts and wondering if info has changed regarding management of this problem. Any help is appreciated.

 

[Blind Dragon]

1) Run a system scan with Hijackthis
2) Put a checkmark next to all these
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 spywareinfo.com
O1 - Hosts: 1.1.1.1 www.spywareinfo.com
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com

3) select fix checked.
4)close Hijackthis
5)Go to my computer -> C:\ Drive -> Windows -> System32 -> drivers -> etc -> Right click on your host file -> select properties -> make sure that Read Only is checked.

6)uninstall any of the following program(s) using Add/Remove Programs if they are present. To do this, go to Start > Settings > Control Panel and double-click on Add/Remove Programs. From within Add/Remove Programs highlight each one and select Remove.

Netpumper
BitRoll
CiD Help
CiD Manager
Download Plugin for Internet Explorer
Zone Media

Now please follow Viruses/Spyware/Malware, preliminary removal instructions

and post back here with the 3 requested logs

1)hijackthis
2)combofix
3)AVG log

 

[carloochie]

CiD Popups results and logs

Here's the stuff, Blind Dragon. The Panda Antirootkit found nothing. Thanks for the help!

 

[carloochie]

Blind Dragon? Awaiting your reply...popups are still happening!

 

[Blind Dragon]

Sorry for the delay, I do this with my spare time around work, and as you may have noticed there are a lot of people that need help and a lot of logs to read through.


You have a LOP infection that often comes together with Messenger Plus. To remove it we will try the simple way first.

1. Go to Add/Remove programs. Double click on "Messenger Plus!" (or click on Remove)

2. The "Messenger Plus! - Setup" is now displayed. Click on the Uninstall button. Note: options displayed on the first screen are not related to the sponsor program.

3. The sponsor screen is now displayed (if you don't see it, search for it in your Task Bar). To prove that someone is currently reading the screen, you have to type the code that is displayed. Once you enter the code, press Uninstall.

4. If you entered the code properly, the program will ask you to confirm that you want to uninstall. You must answer "Yes" to this question, else, you won't have another chance of uninstalling.

5. To complete the uninstallation, follow the instructions that are displayed (the first one is to close all your Internet Explorer windows, that's very important). When everything is complete, restart your computer and, post a new hijackthis log.

While in add/remove programs also uninstalled any of the following:
Window Search
Window Searching
Lop.com
LOP SEARCH
Browser Enhancer
Ultimate Browser Enhancer
------------------------------------------------------------------------------------------------------
In addition to the LOP infection I see something that you may have installed on purpose but I want to make you aware of how it works.

http://vil.nai.com/vil/Content/v_122344.htm

*HOW IT WORKS
BY PARTICIPATING IN THE MOVIELAND / MEDIAPIPE FREE TRIAL OFFER THE MEDIAPIPE SOFTWARE WILL ENABLE YOU TO ACCESS THE AVAILABLE CONTENT FOR THE PERIOD OF TIME THAT SPECIFIED ON THE ADVERTISMENT YOU HAVE CLICKED THROUGH.

IF YOU DO NOT PROVIDE PAYMENT INFORMATION DURING THE TRIAL PERIOD OUR BILLING SOFTWARE WILL BE ENABLED UPON THE EXPIRATION OF YOUR TRIAL PERIOD. THE BILLING SOFTWARE WILL RUN ON YOUR COMPUTER, DISPLAYING POP-UP WINDOW REMINDERS THAT PROVIDE YOU WITH VARIOUS METHODS OF PAYMENT FOR THE ANNUAL LICENSE. THESE POP-UP WINDOWS WILL APPEAR MORE FREQUENTLY UNTIL YOU CHOOSE ONE OF THE PAYMENT OPTIONS AND PAY FOR THE LICENSE. THE BILLING SOFTWARE IS SOLELY DESIGNED TO PREVENT FRAUDULENT AND UNAUTHORIZED USE OF THE MEDIAPIPE SOFTWARE."

This billing "reminder" popup component appears distinct from the other software (MediaPipe, etc.) which make up the Movieland.com service. When installing the full package from Movieland.com, which includes the billing reminder component, referenences to a privacy policy and terms of service are present.
--------------------------------------------------------------------------------------------------------
When done please post a fresh Hijackthis log and I will let you know if you need to run additional software to remove LOP

 

[carloochie]

New Hijackthis log

Sorry to be impatient. I am very appreciative of your help!

Here is a new Hijackthis log. Regrettably, I was able to find neither Messenger Plus, nor any others from the list you provided, in my Add/Remove Programs.

Thanks again for your time. I have a popups headache.

 

[kritius]

try this tip that was suggested by Blind Dragon,

1)Uninstall any of the following program(s) using Add/Remove Programs if they are present. To do this, go to Start > Settings > Control Panel and

double-click on Add/Remove Programs. From within Add/Remove Programs

highlight each one and select Remove.

Netpumper
BitRoll
Browser Enhancer
CiD Help
CiD Manager
Download Plugin for Internet Explorer
Lop.com
LOP SEARCH
Messenger Plus
Ultimate Browser Enhance
Window Search
Window Searching
Zone Media

2)Setup" is now displayed. Click on the Uninstall button. Note: options

displayed on the first screen are not related to the sponsor program.

3)The sponsor screen is now displayed (if you don't see it, search for it

in your Task Bar). To prove that someone is currently reading the screen,

you have to type the code that is displayed. Once you enter the code,

press Uninstall.

4)If you entered the code properly, the program will ask you to confirm that

you want to uninstall. You must answer "Yes" to this question,

else, you won't have another chance of uninstalling.

5)Reboot your computer

6)Run another scan with Hijackthis and attach a new log

 

[carloochie]

Thanks for your time kritius, but I have already determined that none of the programs you mentioned are present on my system. I am determined to find the culprit!

 

[susan collins]

CiD explorer

I have joined this site but am very new to using computers. Alas I have popups from all sorts of websites with CiD explorer on top of page. I saw instructions for getting rid of it on another thread but it said it was only for that person. Has any one any (simple) instructions about what I can do? Am very grateful for your time.

 

[kimsland]

Hi susan collins :wave: and welcome to TechSpot

Click HERE to create a new thread

Or run this first Viruses/Spyware/Malware, preliminary removal instructions

And then create a new thread

 

[susan collins]

CiD popups

Sorry, I have now managed to get info about disabling real time monitoring programmes. I have two of them and will now follow the instructions.
Thanks

 

[susan collins]

Hi

I think the problem may now be sorted. It appears to have come in with a Windows Messenger Update.

Thanks

Sue

 

[Blind Dragon]

Actually it's normally messenger plus! you have to uninstall it then unsubscribe from the additional sponsors