MicroBell: this is the third attempt to post a quick reply. I don't know why my messages aren't taking. I'm going to save this one in notepad in case I have to repost it a fourth time. If my reply seems terse or testy it's because I've retyped it twice before, please forgive the presentation.
1. Firefox 1.07 is my popup blocker. It works.
2. You seem to be out of gas on this. Are you throwing in the towel on this? If so, that's OK just let me know so we can close the thread and I can pick up the topic on a different forum.
3. Some research led me to ContextPlus, who seems to be associated with the URLs that have been popping up. It turned up the following links:
http://www.spywareguide.com/product_show.php?id=2289
http://apropos-spyware-removal.noadwar.info/
http://forums.spybot.info/archive/index.php/t-199.html
I have not yet had time to follow the instructions. Do you want the results posted here?
Also, if this thing is using stealth techniques then it still makes sense to me to scan the drive from MS-DOS where it can't possibly be executing. The folks who normally ferret these things out have ways of digging out stealth ad-ware, why can't I do that here? What tools do they use?
There has to be some kind of debugger or profiler that tells me what's launching, what files are being opened and what sites it's polling? How is it getting out past Zonealarm?
ContextPlus.com has an email address that says they'll send an uninstall program within 24 hours - do I trust it? Do you want a copy to dissect? The only other options I see is to send an invoice to the domains issuing the popups and send bill them for advertising on my computer or spend my Christmas break reinstalling windows and all my engineering applications.
What do you advise?
Best Regards,
Lou