GTP infested!!

[Mistral]

What is that **** doing on my PC??! It installed a new IE toolbar and started some unknown application! It others words, I have spyware on my PC cause of GTP ads or something!

 

[VT]

Format. Reinstall.

Seriously though, unless you can give Jordan the url of the ad, he can't really do anything about it.

 

[Duke]

Any idea which ad caused it? Because Jordan gets good money from the ads and so he has good control over what we accept and don't - he'll ban the advertiser if the service is letting adware through.

 

[Jordan]

I'll need more information before I can help you out here - I have all ads with "installers" and other questionable activities blocked, although they sometimes can get through. If you can tell me which ad installed the toolbar I can stop it from happening again.

 

[Mistral]

Let's write this again...

1st : New toolbal, by YupSearch.com. Fortunately, the uninstaller is easy to get and this toolbar 's'been remove, I hope, successfully. (Need to reboot)
2nd : A lot of ads popup for online poker or something. Also "you are infected by spyware popup". I also notice that this kind of popup appeared sometimes here, randomly (as the ads banner is chosen randomly I guess).
3rd : MediaGateway.exe running in background. This EXE is related to WindUptades. Ad-Aware SE and Spybot told me.
4th : MSGSND sometimes crash (function, maybe related to MediaGateway.exe)
5th : Google Toolbar still installed, but that toolbar I already mentionned just hide Google.

I'd take more details if I had know you need more details to identify the "bad-adss".

 

[Mistral]

6th : MarketPlace search tools and a new button in the IE standard button bar.
7th : 33n.exe, some unknown application on my desktop. I erased it and it came back from no-where.
8th : I just noticed that I have no less than three new icon on my desktop, two from G-staR Entreprise and one completely unknown.

33n.exe
upzz0rs.exe
blad22s.exe

9th : Four new folders in my IE bookmarks.

 

[Famine]

Ad-Aware is good as far as it goes, but try this instead.

 

[Mistral]

After a quick reboot with Ad-Watch running asap :

 

[Mistral]

Ad-Aware is good as far as it goes, but try this instead.

I have the installer already somewhere on my hard drive. Thx anyway Famine.

 

[Iceman]

Is there any way to tell that this did infact come from GTP? Any site on he internet could be the culprit.

 

[Blackbird.]

How about ZoneAlarm?



Or am I stupid n00b and ZA does not cover spyware and adware. Educate me if so.

 

[Mistral]

Is there any way to tell that this did infact come from GTP? Any site on he internet could be the culprit.

The only other pages open was my own forum @ http://molrt.free.fr/phpBB2/index.php and maybe GTweb forum. Both doesn't have any ads. At worst, there will be Google Ads and those don't do anything, they're clean and safe. So yes, it comes from GTPlanet.

βlackbird : ZA doesn't prevent them from installing. It will only block any transmission to their respective tracker. In other words, it will block in/outcoming messages.

 

[Jordan]

I checked, but I can't find a hint of any of those companies running ads in our rotations. Also, I browse the site like a normal user (with all the ads) and I have never received any type of software installation prompt or other form of spyware. The real issue is the pop-up you mentioned...registered users who are logged into their account should NEVER see any pop-ups. So, if you were logged in and got one, it definitely did not come from this site. I suspect the source of that pop-up is also responsible for your toolbars.

 

[F1GTR]

Use Firefox

 

[Mistral]

Use Firefox

Whore...

I wish I had never see that! 👎

Jordan : If you say so. I'll continue to browse this forum normally as I'm used to do and if I get anything suspect, don't worry, I'll tell you in the shortest delay! I'm sure we all want a clean GTPlanet. IMO, it's one of the most trustful GT website in the whole community!

Viva GTPlanet!

 

[F1GTR]

Why? I just posted a acceptable suggestion and you jump on me. Seems like some people don't like being helped at all.

 

[Mistral]

It's a loooooooooooooonnnnnnnnng story...

I'm sorry if I offenced you, but I hate message like that.

 

[F1GTR]

Alright then cool

But seriously, use firefox so you can block(popup) ads.

 

[Mistral]

I just uninstalled the application named "Media Gateway" and I got major data suppression. "My documents" folder are all gone, by quick launch bar also totally erased, most of the icon on my desktop are also gone. I'm gonna reboot and hope I just need that to retrieve all my stuff back. Otherwise, I fear I will have to format and reinstall EVERYTHING... after about 19 months of loyal service... Nothing has destroyed my PC as Media Gateway just did!

 

[Jordan]

Yikes, spyware is such a shame.

 

[Mistral]

I never get a spyware of this level before. The last big one I had is a CoolWebSearch (CWS). That one was just showing annoying popup and it ended into a virus that I manage to remove with external help. Nothing has manage to make any damage to my PC, it's my first time and will never happen again, you have my words!

Btw, I just read the readme.txt that was coming with MediaGateway.exe. It really comes from GTP, I'm sorry about that Jordan.

What is Media Gateway?
---------------------
Media Gateway is free ad delivery software which provides targeted advertising offers.


How did Media Gateway get installed on your computer?
----------------------------------------------------
You downloaded Media Gateway from a Website that is able to offer its content for free because
it shows the Media Gateway ActiveX popup. The Media Gateway program is installed only once the user
has agreed on it by clicking on “yes”. Through the ActiveX, the user can review the license terms
and privacy policy before installing the software. Each and every distributor is carefully reviewed
to make sure that their distribution techniques abide by a strict code of conduct.

If you do not remember having seen an ActiveX prompt, you might have downloaded Media Gateway from a
popular free software product (screensavers, games, file sharing software, etc.). Users always will
have to opt-in before installing the Media Gateway software.


Removal instructions:
---------------------
Media Gateway supports many free software products through its advertising relevancy technology.
If you remove Media Gateway from your system, certain free software that you installed may no longer
function properly and you may have to reinstall them from a backup.

If you are sure that you want to remove Media Gateway from your computer just follow these two easy steps:

1) Click Start -> Control Panel -> Add/Remove Programs

2) Scroll to Media Gateway and click Remove


End User License Agreement:
---------------------------
Please find an up to date copy of Media Gateway's End User License Agreement at
http://www.windupdates.com/license.html

I uninstall twice this ****, it came back twice. And the second time, it also erased my own folder in "My docs and Settings". Would be surprising if there is anyway to recover all that stuff. The only possibility is Media Gateway created a backup file somewhere as uninstalling protection.

Maybe I miss something somewhere. But one thing is sure : the it poped out of no-where while I was surfing here. There's no doubt about it.

 

[F1GTR]

Did you have any internet security programs runnning?

 

[Thirdeye]

I've had a few popups and banners uninstall some nasty stuff on my machine before, it sucks, but it's usually not the fault of the site, just whoever made the malicious ad.

 

[Mistral]

@ GTRacer4 : Yes I do, but I didn't had anything running when I got infected. I have Ad-Aware SE + Ad-Watch SE with the latest definition, SpyBot - Search & Destroy, Norton 2002 with a recent virus definition (not the latest but I doubt it would have changed anything). But, as you can read in the blockquote in my last message, MediaGateway has been installed by an ActiveX applet. I suspect my ActiveX security was a but to low to protect me. After I was infected, I installed Microsoft AntiSpyware with the latest update. I scan for about 3 or 4 times in the last hour and each time I'm removing somethings, some others **** get installed. It doesn't want to stop...

@ Thirdeye : I had too and I always manage to clean my PC up. It's my first time I have "permanent" damage to my PC and a significant lost of data. It's annoying! I think I will install a firewall...

 

[amp88]

@ Thirdeye : I had too and I always manage to clean my PC up. It's my first time I have "permanent" damage to my PC and a significant lost of data. It's annoying! I think I will install a firewall...

Firewalls are essential for the average user. I'm not surprised you got infected if you were running without one

 

[Mistral]

Firewalls are essential for the average user. I'm not surprised you got infected if you were running without one

What does that mean? I concidere myself as an experience web-surfer. I manage to keep my PC clean for about 20 months, remove every spyware I previously got on this PC, virus included and never had major problem before I got this one from GTP's ads! I know what I'm doing!

 

[amp88]

What does that mean? I concidere myself as an experience web-surfer. I manage to keep my PC clean for about 20 months, remove every spyware I previously got on this PC, virus included and never had major problem before I got this one from GTP's ads! I know what I'm doing!

Prevention is better than cure. A firewall might have stopped you getting infected in the first place.

edit: I just re-read my first post and it could be interpreted as me saying that you were a n00b and that I was looking down on you. This isn't the case. I consider myself an experienced user too, but I also use a firewall.

 

[RedWolfRacer]

ActiveX is a program within IE. It was originally designed to allow IE to automatically install updates, toolbars, etc. for itself without having to "annoy" the user with dialogue boxes. However, it more or less became an easy way for ads and viruses to get through IE and directly into your computer without your knowledge.

My advice: get a firewall first and foremost, and then get another browser such as Opera, Netscape, or, my favorite, Firefox. I will admit that Microsoft has done some work to control ActiveX, especially with the rise of Firefox, but it still has it's major issues. Yes, these other browsers also have some issues but they are far safer.

...Of course, I could be wrong. Heh heh...!

 

[crazyazn7412]

even if you dotn switch over decidedly right now at least try firefox. Its much safer..for your sake

 

[Mistral]

@ amp88 : I totally agree with you. In the other hand, I had a firewall (ZoneAlarm) on my father's computer. Now you will surely understand that running a firewall such as ZoneAlarm on a Pentium II 350mhz is quite hard. It's even harder with only 128MB RAM on WinME. About my own computer, I didn't feel it was necessary to have one. It seems I was wrong.
By the way, my friend runs his own PC without any active anti-virus and firewall. He doesn't have problem. Although, I think he format a bit more frequently than me!

@ RedWolfRacer : Of course you could be wrong, but I like your explanation. 💡

@ crazyazn7412 : I agree with you that FireFox may be safer than IE, but for how long? In my opinion, the only explanation because IE is subject to spyware installation, virus, intrusion or whatever damageable it could be, it's because IE is still the top browser on the web and for commercial purpose, it's better to "attack" IE users than FireFox users. If somedays FireFox gets more popular than IE, I am sure we will se the phenomenon on FireFox as it's the case for IE right now. IE represents more than 80% of the e-market.
About me, I will continue to use IE6. I also have to say that FireFox is already installed on my PC but for devellopment purpose. I am testing website on both IE and FireFox to see if everythings is compatible in both IE and FireFox. (Latest work : GTRT )