Attention: The forums will be placed on read only mode this Saturday (Oct. 20, 2018)

During this outage (6:30 AM to 8 PM PDT) the forums will be placed on read only mode. We apologize for this inconvenience. Click here to read details

Spyware, Viruses, & Security forum

General discussion

Inappropriate popups, Norton not removing

by violettj / March 22, 2006 4:20 AM PST

My win xp home pc with sp2 has apparently been infected. I just installed Norton 2006 and noticed that I get random window popups to inappropriate site. These popups are the same size as my browser window and are directly on top of the window I'm using.

I also occassionally get the "Black Worm" infection warning.

Norton said I had Adware.wintaskad and Adware.winupdates problems and it wouldn't remove them.
While scanning with Ad-Aware, I got a norton warning about adstatservx trying to do some funny stuff.

I ran the online scans by panda and bitdefender. They did not remove anything but I deleted the files they identified in the log report.

Norton no long reports the spyware, but the popups are still occuring.

What do I do next? I need to do my taxes and I'm worried about doing it with this problem on my pc.


Discussion is locked
You are posting a reply to: Inappropriate popups, Norton not removing
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Inappropriate popups, Norton not removing
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Scan using Ad-aware SE and Spybot S&D
by Donna Buenaventura / March 22, 2006 4:40 AM PST
Collapse -
In addition
by tomron / March 22, 2006 6:25 AM PST

Click HERE to install Ewido.

Don't forget to update.


Collapse -
It Sounds As If You Have A Few
by Bugbatter / March 22, 2006 10:36 AM PST
In reply to: In addition

Hi, John,
It sounds as if you have/had multiple infections.
Did you try a scan with your Norton in Safemode or with Ewido as suggested above?

''I also occassionally get the ''Black Worm'' infection warning.''
If you have all your Windows updates, this ''Black Worm'' warning may be bogus.
For this you will probably need VundoFix 4.2.35:
* Double-click VundoFix.exe to run it.
* Click the Scan for Vundo button.
* Once it's done scanning, click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.

You also will most likely need to update your Java if you are not using version 1.5.06.
The contents of C:\vundofix.txt will tell you what version you are are running.

To update Java:
Please follow these steps to remove older version Java components:

1. Close any open programs you may have running, especially your web
2. Click Start > Control Panel
* Depending on your OS or configuration, you may have to click Start
> Settings > Control Panel
3. Open Add or Remove Programs
* If you have Windows 98 or Windows 2000, open Add/Remove
4. Click once on any item listing Java Runtime Environment in the name
* Not every version of Java will begin with ''Java'' so be sure to read
each entry in the list
5. Click the Remove or Change/Remove button
6. Follow steps 4 and 5 as many times as necessary to remove all
versions of Java. ** If at any time during the uninstallations, you are asked to reboot, do so. Then return to Add/Remove and continue removing any other versions of Java until all components of Java have been removed.
7. Delete the Java folder in Program Files.
8. Proceed with reinstalling Java

Continue Step 8 by going to and install the latest version from the website .

Good luck Happy

Collapse -
Looking Better, Vundo!
by violettj / March 23, 2006 10:02 PM PST

I ran several scans. A2, ewido, vundo, bitdefender online (again), ad-aware, spy-bot, Norton, stinger.

It looks like vundo found one, and ewido and A2 may have as well. I also updated Java. I will have to run the scans again tonight just to be sure.

ewido seems to be running in the background. Should I leave it? it takes a lot of memory. I've got 512 meg, but I'd like to not use it if I have to for backgroud programs.


Collapse -
by tomron / March 24, 2006 12:06 AM PST
In reply to: Looking Better, Vundo!

I disabled the guard,i have 128 MB.

Open Ewido,under additional>disable the guard.


Collapse -
by Bugbatter / March 24, 2006 11:49 AM PST
In reply to: Looking Better, Vundo!

Disable the realtime monitoring. It may interfere with changes made by your scans.
From within Ewido -
Under 'Your security status', if the real time protection is active, deactivate it by clicking 'real time protection' until the status says 'inactive'.

Collapse -
Bad luck so far...
by violettj / March 22, 2006 10:32 PM PST

Ok, I get home, boot in safe mode, run Ad-Aware and remove 2 cookies and 14 MRU's.

Rebooted in safe mode again, ran spy-bot. No detections there.

Rebooted in safe mode again, ran MS Defender. No detections there.

Rebooted in safe mode again, ran Norton AV. No detections there.

Rebooted in normal mode. Attempted on-line scan with bitdefender. This was taking over 2 hours to run with an estimated of over 3 hours to complete. My task manager said I was running at 100%, so I waited a while longer and killed it. I needed to get to bed.

I ran bitdefender on Monday and it found a few items but could not remove them. I followed the links and just deleted the items and emptied the recyler. Bit defender did not take more than 1.5 hours to run.

I also ran the Panda online scanner on Monday and it found a couple of items that I also had to delete manually. Panda scan took less than 1 hour to run.

Ad-Aware, Spy-Bot, and MS Defender were all updated on Tuesday. I did not check for updates last night.

I was getting some kind of error when shutting down last night, could not duplicate this morning before work.

I may try this whole process again tonight.


Collapse -
by violettj / March 27, 2006 10:26 PM PST

Ok, thanks for all your suggestions. I think Vundo was the culprit. But I had run so many different spyware removers, I can't be sure (ewido, a-2, spy-bot, ad-aware, stinger, norton...).

Now a slightly different question, I'm running norton firewall (2004?). I look at the logs after startup and it shows that security is disabled in the log, but the norton app says it is enabled? Can anyone check their logs to see if this happens to you after startup?


Popular Forums

Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!