Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Lycos popup after every Google search

Jun 16, 2004 2:03AM PDT

Hi everyone,

I got a trojan last week and have been dealing with it ever since. I eventually got rid of the trojan and all the adware it brought with it, but I am still having one problem I can't seem to get rid of. Every time I do a search on Google I get a popup window with Lycos search results for the search I entered that pops under my Google search.

I have the Google toolbar installed to block popups, but it appears something has been hijacked. I've been doing complete virus scans every day and they've come up clean for a week now, and my virus defs are up to date (using McAfee). I've installed AdAware and Spybot (and updated them so they're current), and I've cleaned up everything they've found each time, but this problem keeps happening.

Every time I run them now, I get two items that they both find besides the usual tracking cookies:

Started registry scan

Discussion is locked

- Collapse -
Re: Lycos popup after every Google search
Jun 16, 2004 3:53AM PDT
- Collapse -
Re: Lycos popup after every Google search
Jun 16, 2004 5:42AM PDT

Hi Bob,

I've already tried everything they had listed, so I guess I'll go ahead and post my Hijack This log and see if anyone can help me. It looks like they're pretty busy in the forums over there though!

I would love to lose IE, but our office standard is IE. The whole reason I ended up with the trojan is because IT hasn't applied all the latest critical updates. They think because we're behind a firewall and we use Notes for email that it's not that important (they've even removed Windows Update from our IE menu and only push out the updates to us they want us to get). My OS is Win2k and two weeks ago I was only on SP1! I needed SP4 to run Easy Media Creator 7, so I downloaded it myself. After installing SP4 I still had 17 or 18 critical updates that needed to be applied (which I did after getting the trojan).

Unfortunately, I got the trojan while surfing "non-work-related" stuff at work, so I've tried to clean up the mess myself. This last popup thing just refuses to die though. Hopefully my Hijack This log will allow someone to help me put the last nail in the coffin!

Thanks again,

Gary

- Collapse -
Re: Lycos popup after every Google search
Jun 17, 2004 12:43PM PDT

I downloaded Firefox 0.9 tonight at home and love it. I had used Firebird and Mozilla a while back, but had problems accessing my phone company's electronic payment site with them so I stopped.

It appears whatever was wrong has been fixed because I was just able to log in without a problem. I've always liked their built-in popup stopper, and now I see I can have my Google search right at the top without having the Google toolbar installed. Also, I forgot how much I liked tabbed browsing!

Thanks for the tip,

Gary

- Collapse -
About Blank Removal.
Jun 18, 2004 12:39AM PDT
- Collapse -
Re: About Blank Removal.
Jun 18, 2004 4:33AM PDT

Hi Bob,

Thanks for the link. I managed to squash my problem with the help of Hijack This! I looked at everything it listed and then went back and found the files on my hard drive and checked their dates. If found one last thing that had the date and was close to the time of my initial trojan infection. It was a dll file called sep.dll and was located in c:\program files\sep\.

I googled all over for this (getting those %#%$@$ lycos pop-unders the entire time!), but never did find an explanation of exactly what it was. When I went into the folder above, there was an unistall icon. I debated about 5 minutes about whether to delete all traces of it manually or run the uninstall, but finally decided to run the uninstall. It asked me if I was sure I wanted to uninstall "SEP", I clicked yes and it uninstalled (never offering any explanation or name of what it was). I ran AdAware again and then rebooted. I ran Hijack This again and compared my log to the one before to make sure anything new didn't show up and all was well.

So far, so good. Only Google results when I search Google now (ah, YES!) I'd love to know what the program was exactly, but haven't been able to turn anything up. I may Google it a little more tonight to see what I can find. In the meantime I'm going to check the "about:blank" think a little more closely.

Thanks again,

Gary