Hi all,

I recently got a nasty virus that has taken several sweeps to get rid of fully (zbot.gen) and since I have been getting lots of pop up ads in firefox. I am reasonably tech savvy and have checked pup up settings, and even the exceptions, and the virus doesn't seem to have done anything in there. I have run several deep scans with both my AV (vipre) and Malwarebytes, and there is not trace of anything.

Any help would be much appreciated, there is way too much stuff on my computer to do a format.

Thanks

the virus probably changed some firefox settings

check tools > options > content and make sure "block popup windows" is checked

then look in the exceptions list and remove any sites where popups are allowed, assuming you really don't want those sites to have popups

have checked pup up settings, and even the exceptions, and the virus doesn't seem to have done anything in there

I have already checked that esme, as per this quote form OP. That is what is confusing me. No trace anywhere of what is causing it.

Also these aren't pop ups that are appearing when I go to a site. They literally just appear. Like now for example The only tab I have open is this reply one, But a pop up has just randomly opened of its own accord.

Are they definitely firefox windows that are popping up, and not OS windows? Does it happen if you start in safe mode? Are the windows connecting to the net for external content? What are the ads for?

Chances are you didnt get all the nasties removed from your PC.

Time to nuke it from orbit. The only way to be sure.

Are they definitely firefox windows that are popping up, and not OS windows? Does it happen if you start in safe mode? Are the windows connecting to the net for external content? What are the ads for?

They are definitely firefox as they are just new tabs, not windows. The ads are for shopping sites withe subject matter been whatever page I have open. For example I just got one now that was for "Pop Up - Conference displays". This thread been about Pop Ups it's trying to load in context

I don't even have a windows disk as my lappy had a recovery partition, but last time I tried to use it it failed to work so installed from my friends disk. I guess this will have removed the recovery partition.

Have you had a look in the firefox about:config for anything suspicious? You're what I would call a power user - but have you run spyware/malware tools to see if you've got something? The FF popup blocker is pretty good out of the box, (check here http://www.popuptest.com/ ), so I suspect something's been written into your about:config by a nasty of some kind. Could be hard to pinpoint though, and it might be easier to export your saved passwords, bookmarks etc, and do a fresh install of FF?

Yeah Phan, 2 full deep scans with my AV (Vipre) and even downloaded malware bytes to see if vipre was missing something. I will have a look in about:config now

Does this just effect Firefox or are other browsers the same?

Tried deleting your firefox profile?

http://support.mozilla.com/en-US/kb/Profiles#How_to_find_your_profile

It seems it is just affecting Firefox although I haven't tried any of the others for long enough to say for sure. I will try deleting my profile tonight.

something has hijacked your system, sorry for missing your earlier FF checks

grab a copy of hijackthis, run it and put the results through http://www.hijackthis.de/en#anl, there's a download on the same page

if you can't make sense of the output, post the hijackthis log on one of the forums like spyware warrior http://spywarewarrior.com/index.php

grab a copy of hijackthis

Hijackthis, although still used, is a little dated.

DDS (http://download.bleepingcomputer.com/sUBs/dds.scr), also used in the Hijackthis forums, will show more information including various firefox settings. I can go through the log if you want. PM me it if you'd rather do that.

nvm i got it

Ok, edited. ;)

Waddler I PM'd you.

Thanks

I've not got it as yet?

I think is something in the logs,

Just tried posting them here and it is going to connection reset

:-O

Possibly too big in size? Is there a character limit? There is for PM's I think.

Can I e-mail to you.

Pm'd you Liam.