Is this a firewall problem

[gemma10]

If say I view the BBC webpages and scroll down to a hyperlink that is in a sentence and click on it, I keep getting a popup thats asking me to either buy an iphone 5 or play bingo on line. I run Norton and checked the firewall and all seems ok, but why is this getting through? I haven`t altered any settings and popups are still allegedely blocked. Anyone else noticing this?

[Saab Dastard]

That is NOT normal behaviour. Sounds like some malware has got you. A browser hijack or some such.

Malwarebytes is your friend.

Ensure that your AV program is up to date.

It's not a firewall problem it's a virus / malware problem.

Also, don't run as an Administrator equivalent - use a standard user account unless you actually need the admin rights.

SD

[Milo Minderbinder]

"I run Norton and checked the firewall and all seems ok"

Thats part of your problem
The Norton firewall (besides being useless) is so difficult to make sense of that for many its impossible to know if its working. Taken alongside the fact that the antivirus part of the Norton programmes simply doesn't work very well, then I'd suggest the problem is almost self-inflicted.....

Run both of these two programmes over the machine and see what you find

Downloads - SurfRight (http://www.surfright.nl/en/downloads)
ComboFix Download (http://www.bleepingcomputer.com/download/combofix/)

[gemma10]

Problem fixed now. The odd thing is I ran malwarebytes on Monday and it found
zilch, however ran it again last night and it said it was eight days out of date :rolleyes:,
but its sorted now. Have to say I have no confidence in this firewall whatsoever. I hear most people think Norton is the top anti virus checker etc but I remember I got a trojan horse from one of the broad sheet sport pages a while back. So which anti virus is preferred by ppruners?

[vulcanised]

I hear most people think Norton is the top anti virus checker


I think you have that in reverse. Norton seems to be universally reviled.

[OFSO]

Yeah, keep up to date. Ran AVG free earlier this week, nothing found, but as hard drive seemed busy and computer slow, I just ran MalWare today after lunch and got 6 registry key hits.

Interestingly this week I also found both IE and Chrome home pages had been switched to some search engine I hadn't heard of, so restored the original home page on both.

[Milo Minderbinder]

I've said it before, and I'll repeat it again: for most users behind a router, the default Microsoft Firewall is perfectly adequate. In most cases people don't know how to set up firewalls and end up with them disabled or incorrectly set.
Only time anything better is needed, is if the PC is directly connected to the internet, or if you have users with unsafe browsing habits.

A firewall isn't designed to protect against this kind of attack anyway: you need a good antivirus / antimalware program, preferably with some kind of HIDS detection
One of the most consistent is still the free AVAST! program, as long as you turn on the "antiPUP" scanning and automate the cleanup routines

[vulcanised]

Should you decide to remove Norton, be aware that it has hooks and tentacles which are as pervasive as any malware in your machine and requires extra removal techniques.

A simple uninstall will not touch it.

[Mike-Bracknell]

I've said it before, and I'll repeat it again: for most users behind a router, the default Microsoft Firewall is perfectly adequate. In most cases people don't know how to set up firewalls and end up with them disabled or incorrectly set.


You've been reading my old posts ;)

http://www.pprune.org/computer-internet-issues-troubleshooting/379702-selective-web-address-access.html
http://www.pprune.org/computer-internet-issues-troubleshooting/390334-pc-virus-mc-afee.html
http://www.pprune.org/computer-internet-issues-troubleshooting/434853-should-i-go-microsoft-security-essentials.html
http://www.pprune.org/computer-internet-issues-troubleshooting/392246-cpu-requires-defribulator.html
http://www.pprune.org/computer-internet-issues-troubleshooting/436304-poorly-mouse-2.html
http://www.pprune.org/computer-internet-issues-troubleshooting/381604-malware-protection-w7.html

Ho-hum :)

[Milo Minderbinder]

Sorry Mike, you can't claim prior art on this one! I've been drilling it into customers for years. Look at it as a case of conceptual convergent evolution: given similar problems, we independently came to the same conclusion

[Mike-Bracknell]

Sorry Mike, you can't claim prior art on this one! I've been drilling it into customers for years. Look at it as a case of conceptual convergent evolution: given similar problems, we independently came to the same conclusion

Not claiming prior art, just great minds, etc etc.

[gemma10]

Going back to my original post it would appear after some searching that the underlined blue text is something called intellitxt, and is created by vibrantmedia an advertising scam that hijacks just about every webpage. Further searching shows something called Greasemonkey will put a stop to it but it requires a little more computer knowledge than I have. Norton, Avast and AVG dont highlight it as a virus, and Malwarebytes ignores it. I thought at first it had worked but wrong again. No one else seen this?

[Milo Minderbinder]

Gemma

did you scan with those two tools I suggested? Hitman Pro & Combofix

they were suggested for a very good reason.....

[gemma10]

Milo, Yes I did run the Hitman Pro and it certainly got rid of browser hijackers namely Blecko and other irritants, but when I read the contents of the Combofix website I was a little apprehensive of downloading it due to the warnings. If you can assure me its safe to download and run then I will try again. Many thanks for your input.

[Mike-Bracknell]

Milo, Yes I did run the Hitman Pro and it certainly got rid of browser hijackers namely Blecko and other irritants, but when I read the contents of the Combofix website I was a little apprehensive of downloading it due to the warnings. If you can assure me its safe to download and run then I will try again. Many thanks for your input.

I can provide an independent assurance that Combofix is a genuine package and another string to our bow in fighting malware.

[Milo Minderbinder]

Combofix is an absolutely essential tool in clearing malware. I use it on a daily basis, and I suspect Mike probably does as well
Just make sure you download it from the link I posted - there are a number of fake download sites out there

[gemma10]

Combofix not available at the moment. They`re hoping to be up and running shortly

[Mike-Bracknell]

In the meantime, I wrote this guide a year or so ago and whilst it may not clear the latest most virulent viruses it's worth a try first anyway.

How to get rid of most viruses
FIRSTLY, if you get a screen saying you have viruses and the notification doesn’t appear to come
from your installed antivirus package, don’t click anywhere – just press and hold the power button
on the computer to turn it off – you will lose what work you had open, but you might have saved
yourself from a virus infection.
1) From a rebooted computer, If you can, open Internet Explorer (or Firefox, Google Chrome,
etc) and go to Google (http://www.google.co.uk)
2) Google for “Malwarebytes Antimalware” and download the free version
3) Install and update Malwarebytes (if you choose “Run” when downloading in step 2 above,
you can just follow all the instructions and it should update and run Malwarebytes for you).
4) Instead of just running Malwarebytes straight away, you need to boot into Safe Mode with
Command Prompt. This is done by:
a. Restarting your PC and hitting the F8 key approx. once per second from the time you
see the Dell splash-screen. If you are successful, you will get a black & white text
window giving you options including the Safe Mode with Command Prompt you’re
after. If you’re unsuccessful, the PC will continue to boot into Windows (and you’ll
see the Windows splash-screen) – in this case, reboot and try again. If you have lots
of problems getting to this stage, call me.
b. Once you’re able to choose Safe Mode with Command Prompt, do so. This will give
you a ‘strange’ version of your Windows desktop (as the screen resolution etc will all
be ‘wrong’) – don’t panic!
c. When you are logged in in Safe Mode, there should be a black & white text box (the
Command Prompt) in the middle of the screen – at this prompt you need to type the
following commands:
• CD \Program Files (or CD \Program Files(x86) if you’re using a 64bit
computer)
• CD Malwarebytes Anti-Malware
• MBAM
d. The above (ignoring the bullet points and noting that there’s a space between “CD”
and the rest of the command, and that you press Enter at the end of each line)
should ensure you get a Malwarebytes window open up. At this point, you should
choose the options to run a Full Scan.
e. The Full Scan will take some time (maybe up to a couple of hours depending upon
the size and speed of your computer), at the end of which you’ll be presented with a
list of viruses and/or malware that it found. At this point, note down the virus
names you find (don’t worry about duplicates) and then choose the option to delete
all the malicious files.
f. Once this has completed, exit the program then type EXIT at the command prompt.
This should restart the computer (although if it doesn’t, then you may need to use
brute force and press & hold the power button to turn it off).
5) When all of this has completed, you *should* be left with a computer that’s either 100%
fixed, or about 95% fixed. I would suggest you try and run a quick scan from Malwarebytes
(without bothering with Safe Mode) to see whether it finds anything else (it shouldn’t).

[Saab Dastard]

Mike-Bracknell,

You know the rules, no advertising or self promotion in the forums.

You are welcome to take out paid advertising on PPRuNe.

SD