Forum Moderators: open

Message Too Old, No Replies

Browser problem - adware that won't go away

         

palmpal

1:03 am on Jul 6, 2004 (gmt 0)

10+ Year Member



Hello,

I hope someone can help me. For the past week I've been having periodic problems when I try to access Google or Yahoo. The URL says Google or Yahoo but the description on the bottom says click.linksynergy.com. The screen that comes up is Coming Soon! Register.com. I also get numerous pop-ups at the same time.

I've run Adaware, Spybot S&D and Pest Patrol. Lately it is easier to manually delete all my cookies and temp files before and after visiting websites. Even then after clearing everything out and closing IE I can open the browser a short time later and sometimes I still get this screen. Virus scans are coming back clean. I'm at a loss about how to fix this.

Has anyone heard of this before? What am I dealing with?

Thanks for any help!

tedster

2:32 am on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This is relatively common Adware, and Pest Patrol explicitly claims that their application removes this one.

Don't know what else to tell you, but that's what you are dealing with. Do you need to update your adware removal apps?

tedster

2:38 am on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Lately it is easier to manually delete all my cookies and temp files before and after visiting websites.

I just re-read that sentence. Clearing cookies and temp files won't undo a new adware installation that you just picked up. Adware is not a virus, so virus scans will be clean. The only thing that will catch a new installation is running an adware removal utility.

palmpal

3:02 am on Jul 6, 2004 (gmt 0)

10+ Year Member



Hello,

I'll have to check around for some additional utilities. Ad-aware, Pest Patrol and Spybot are all updated and are still not picking this up. Good to know it's not a virus. Thanks for your response!

vkaryl

3:18 am on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



You don't say what your AdAware settings are. You do every once in a while need to have the program do a MORE than quickie scan, even if you have it set to deep scan registry, etc.

Make sure you have "Activate In-Depth Scan" selected. Then use the "customize" selection or the "select files/folders" option. Choose your WHOLE HARD DRIVE or DRIVES. It takes a LONG time to do a complete scan. If AdAware is completing a scan in under 5 minutes, it's NOT doing enough.

Then, once you've had it completely scrub through your drives once, shut down/cold boot your machine, and RUN IT AGAIN....

kaled

11:29 am on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



As a matter of routine, whenever a site doesn't behave as you expect, you should check it with an alternative browser.

It is conceivable, but unlikely, that the problem lies outside the browser, in which case it will also occur in Firefox, Opera, etc. (but popups are likely to be blocked by these browsers).

Kaled.

jcoronella

6:34 pm on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Agree with vkaryl, reboot, rerun. If adaware and pest patrol don't pick it up, you may have a new version.

2oddSox

7:01 pm on Jul 6, 2004 (gmt 0)

10+ Year Member



Also do a manual update of the ref lists for your Adware programs if you can. I know at least Ad-aware lets you do this. I've had first-hand experience of scumware overriding the ref file even tho' the 'latest' file appeared to be installed.

pixelkat

10:26 pm on Jul 6, 2004 (gmt 0)

10+ Year Member



greetings, all! - sorry this is long.

click.linksynergy.com is an external 3rd-party web tracking server that collects user information through the banner ads or other images on a a given web page, not by installing executable files that sit on your computer as spyware. adware removal software isn't equipped to seek images, only executables.

you can't really eliminate tracking images per se, as they are not dangerous until they load with the content on a web page you access, usually as a banner ad but also as an invisible single pixel gif. even if you don't click on the ads, you can be tracked by any image from an ad image server that copies itself into your browser cache with a tracking script attached to it.

These images and the script attached to them do their dirty work by caching in your browser and THEN report your browsing habits back to the "mothership" every time it is accessed by the attached script. The main purpose is to serve you ads based on your browsing habits next time you land on another (or return to the same) web page that calls its respective tracking image via the attached script (usually javascript or cgi).

another way these 3rd party tracking images nestle comfortably on your machine is email ads if you enable html email message receipt instead of the boring but safe text-only email. this is especially a problem if you use MS Outlook AND browse using MSIE, which share image caching capabilities.

but here are some things you CAN do to prevent these pesky "web bugs" from making a home on your computer:

1. if you get a lot of spam, or subscribe to lots of ad populated email newsletters, accept only text email messages. this won't affect image attachments from the sender, only images within the body of the email message, which are almost always ads! (Sometimes they are invisible single pixel gifs that you don't even know you are downloading into your cache!)

2. if you use MS Outlook, switch to a browser other than MSIE, like Mozilla or FireFox (formerly Netscape), Opera, Safari (if you are on a Mac) or any other. If you are in love with MSIE and wouldn't dream of switching, change your email application. It is the ActiveX sharing of information in MS products that make you vulnerable.

3. if you use MS Outlook, block the click.linksynergy.com domain with the 'block sites' feature and/or IE, by accessing Options > Security > Restricted Sites.

4. add it to your hosts file, but point it to your local host, 127.0.0.1 instead of its correct IP address. (if you have never worked with your hosts file as a spam/ad blocking tool, here's an excellent tutorial with sample hosts file: [beemerworld.com...]

Blocking ads and images using the hosts file prevents the images from downloading on a web page so they can't cache on your machine. In the Netscape/Mozilla browser, you just get a blank white space. In IE, you get a 404 message in the space that the image used to occupy. Often you will get a message indicating the image is trying to load but can't...just click ok.

There are a few of these 3rd party trackers that will not render the web page you are trying to access if you block their ad like qksv.net. most, like doubleclick and linksynergy just annoy you with the message that their image won't load.

this is a small price to pay to keep these insidious tracking images out of your affairs. I just accept it as part of browsing to have to hit the 'ok' button or 'enter' 15 times to acknowledge the fact my hosts file is doing its job.

as a result of this vigilence on my part, and the fact I have a very spam proactive ISP, I MIGHT get a dozen or so spam messages per year (which I immediately block and filter, add to my hosts file and report to my ISP as soon as they happen.

sorry message is so long.
hope this helps.

cheers,
kat

vkaryl

11:20 pm on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Don't apologize, kat! GREAT stuff, and explains the "1pixel.gif" pages I get occasionally with FireFox.

Thanks! You're a pearl of great price, an information princess (eh, or prince, maybe)!

palmpal

12:36 am on Jul 7, 2004 (gmt 0)

10+ Year Member



Hi All,

Thanks for the suggestions. I ran my Spyware programs more thoroughly, rebooted and scanned again and got only a few extra pests. I don't think they are related or will take care of the problem.

Pixelkat, thank you for your information. I actually did try to access some of the websites listed in the View Source screen of the "Coming Soon Register.com" screen and one did put up nothing more than a 1 pixel image. I do have both MSIE and MSOutlook. I started getting this problem when I joined a Yahoo group so perhaps that is the screen that activates the JS. I did notice JS files in addition to the cookies that this leaves behind.

I'll have to look into modifying the Host file. I did try to restrict the click.linksynergy.com site but I still can access the site. In fact all the sites I added to the list I can still access.

Also, previously when I ran Ad-aware it would catch things like Commission Junction, etc. Now these reside in my temp folder and even with a full scan Ad-aware did not catch it. Has anyone ever had this happen?

Thanks

Span

8:47 am on Jul 8, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Found this page in my bookmarks, don't know why it's there since I'm on a Mac, but it contains a lot of information and links to removal programs for all kinds of addware, scumware, spyware, homepage hijackers and diallers.
[doxdesk.com ]

Note: while I'm posting this, the link isn't working from The Netherlands. In the past two days it wasn't working from Boston, USA. But it's worth the wait.