开云体育

ctrl + shift + ? for shortcuts
© 2025 开云体育

Off topic on PC Popups


 

开云体育

Dan,


There are many videos that shows how to install win11 on unsupported hardware :


There are some hard requirements (4 gb ram minimum, must be able to run 64 bit os, etc.). ? So not all old hardware is physically able to run win11, but at the same time not all unsupported hardware is unable to either.

Some of those videos tells you want to check before trying to install win11 on old hardware.


Jong?




On Apr 17, 2025, at 2:55 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Here is the "Final" update.

I ran two DOS commands, sfc /scannow and chkdsk C: /f. Also downloaded, installed and ran PrivaZer. After multiple restarts, the popup was gone. I can not say which of the commands or apps got rid of the problem but it is at least gone now. The existing pc will not pass the hardware requirement for upgrade to WIN11 so he is opting for a new one. The 'end of support' date looming in October prompted him to ask me to help migrate to a new pc. I was concerned that when the user gets his new WIN 11 pc that this popup would be transferred.

Now I just have to do this again on another friends WIN10 pc. I'll separate the DOS commands from PrivaZer to determine which cleared the issue.

Thanks to all for the suggestions.

Regards,
wings515
On Tuesday, April 15, 2025 at 09:42:55 AM EDT, C. Michael Stone via groups.io <enots123@...> wrote:


I have seen pop-ups occur as the result of some installedbrowser extensions or add-ons.

You can go into the browser and turn off all the extensionsand see if the pop-ups stop.

If they stop, you then turn on each extension one at a time untilyou discover the extension that causes the pop-ups to return.

You then delete that extension.

You stated you used TeamViewer.

Does TeamViewer still limit your connection time?

I had to change to UltraViewer because TeamViewer waslimiting my connection time to 5 minutes.



Mike Stone


On Tuesday, April 15, 2025 at 06:25:36 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

Here is the "Final" update.

I ran two DOS commands, sfc /scannow and chkdsk C: /f. Also downloaded, installed and ran PrivaZer. After multiple restarts, the popup was gone. I can not say which of the commands or apps got rid of the problem but it is at least gone now. The existing pc will not pass the hardware requirement for upgrade to WIN11 so he is opting for a new one. The 'end of support' date looming in October prompted him to ask me to help migrate to a new pc. I was concerned that when the user gets his new WIN 11 pc that this popup would be transferred.

Now I just have to do this again on another friends WIN10 pc. I'll separate the DOS commands from PrivaZer to determine which cleared the issue.

Thanks to all for the suggestions.

Regards,
wings515
On Tuesday, April 15, 2025 at 09:42:55 AM EDT, C. Michael Stone via groups.io <enots123@...> wrote:


I have seen pop-ups occur as the result of some installedbrowser extensions or add-ons.

You can go into the browser and turn off all the extensionsand see if the pop-ups stop.

If they stop, you then turn on each extension one at a time untilyou discover the extension that causes the pop-ups to return.

You then delete that extension.

You stated you used TeamViewer.

Does TeamViewer still limit your connection time?

I had to change to UltraViewer because TeamViewer waslimiting my connection time to 5 minutes.



Mike Stone


On Tuesday, April 15, 2025 at 06:25:36 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

The Windows Host file is located at C:Windows\System33\Drivers\etc\hosts.

The Host file maps names to IP addresses, so I am not sure how the average computer user could figure out which entry or entries were the source of the popups.

Mike Stone


On Tuesday, April 15, 2025 at 12:07:22 PM PDT, jong kung via groups.io <jongkung01@...> wrote:


Dan,


If I remember the location of host file changed few times with the version of windows. ? So you will have to figure it out.

Normally HOST file should be empty of entries. ?When you type “Google.com” your DNS server should tell your computer what is the numerical address of “Google.com”. ? But some nefarious site might enter that Google goes somewhere else.

Oh another way they use host file is to enter 127.0.0.1 (your own computer) for popular sites like Google.com and have a fake web servers that send your browser those pop-ups. ? Here’s a brief writer-up about host file hijacking?


?= ?= ?= ?= ?= ?=?

While I was typing this, there’s also the possibility of DNS hijacking. ? Your dns entry is normally your own ISP (or one of the famous DNS). ? But sometimes an attacker might enter their own DNS server address so it will tell your browser to go to their own websites (to make pop up happen).


?= ?= ?= ?= ?= ?=?

DNS hijacking and host file hijacking would probably have the symptoms you’ve described (multiple browsers all showing pop-ups, without any virus being installed or detected).


I hope it works out and I didn’t send you down a bad rabbit’s holes.


Jong?




On Apr 15, 2025, at 3:55 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Jong,
Thanks, I think I have an idea what you are saying but can I just do a search for the HOST file. Where is it located, under Program Files?

wings515
On Tuesday, April 15, 2025 at 09:51:06 AM EDT, jong kung via groups.io <jongkung01@...> wrote:


Dan,


Look in your HOST file and see if there’s a redirect of famous sites like Google to a pop up server somewhere. ?I had this happen to me once. ? This trick (of entering redirect of famous websites) makes any browser wanting to go to Google, yahoo, cnn, etc., instead go to the pop-up sites (or any sites).

This happened to me very long ago, and I suspect modern virus scanners knows this trick. ?But check anyway, just in case.


Jong?

On Apr 15, 2025, at 3:25 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io<dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

开云体育

Dan,


If I remember the location of host file changed few times with the version of windows. ? So you will have to figure it out.

Normally HOST file should be empty of entries. ?When you type “Google.com” your DNS server should tell your computer what is the numerical address of “Google.com”. ? But some nefarious site might enter that Google goes somewhere else.

Oh another way they use host file is to enter 127.0.0.1 (your own computer) for popular sites like Google.com and have a fake web servers that send your browser those pop-ups. ? Here’s a brief writer-up about host file hijacking?


?= ?= ?= ?= ?= ?=?

While I was typing this, there’s also the possibility of DNS hijacking. ? Your dns entry is normally your own ISP (or one of the famous DNS). ? But sometimes an attacker might enter their own DNS server address so it will tell your browser to go to their own websites (to make pop up happen).


?= ?= ?= ?= ?= ?=?

DNS hijacking and host file hijacking would probably have the symptoms you’ve described (multiple browsers all showing pop-ups, without any virus being installed or detected).


I hope it works out and I didn’t send you down a bad rabbit’s holes.


Jong?




On Apr 15, 2025, at 3:55 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Jong,
Thanks, I think I have an idea what you are saying but can I just do a search for the HOST file. Where is it located, under Program Files?

wings515
On Tuesday, April 15, 2025 at 09:51:06 AM EDT, jong kung via groups.io <jongkung01@...> wrote:


Dan,


Look in your HOST file and see if there’s a redirect of famous sites like Google to a pop up server somewhere. ?I had this happen to me once. ? This trick (of entering redirect of famous websites) makes any browser wanting to go to Google, yahoo, cnn, etc., instead go to the pop-up sites (or any sites).

This happened to me very long ago, and I suspect modern virus scanners knows this trick. ?But check anyway, just in case.


Jong?

On Apr 15, 2025, at 3:25 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io<dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

Jong,
Thanks, I think I have an idea what you are saying but can I just do a search for the HOST file. Where is it located, under Program Files?

wings515
On Tuesday, April 15, 2025 at 09:51:06 AM EDT, jong kung via groups.io <jongkung01@...> wrote:


Dan,


Look in your HOST file and see if there’s a redirect of famous sites like Google to a pop up server somewhere. ?I had this happen to me once. ? This trick (of entering redirect of famous websites) makes any browser wanting to go to Google, yahoo, cnn, etc., instead go to the pop-up sites (or any sites).

This happened to me very long ago, and I suspect modern virus scanners knows this trick. ?But check anyway, just in case.


Jong?

On Apr 15, 2025, at 3:25 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io<dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

Mike,
Thanks for the reply.
First I'll check the extensions and see if any are the cause.
Second, because an older version of TeamViewer was on another friend's pc, I opted to install TV15 on this problem pc. During the 55 minute Malwarebytes scan TV kept the connection. Maybe it's because it is rev 15.
I looked at the latest version of TV and was not impressed.

wings515
On Tuesday, April 15, 2025 at 09:42:55 AM EDT, C. Michael Stone via groups.io <enots123@...> wrote:


I have seen pop-ups occur as the result of some installedbrowser extensions or add-ons.

You can go into the browser and turn off all the extensionsand see if the pop-ups stop.

If they stop, you then turn on each extension one at a time untilyou discover the extension that causes the pop-ups to return.

You then delete that extension.

You stated you used TeamViewer.

Does TeamViewer still limit your connection time?

I had to change to UltraViewer because TeamViewer waslimiting my connection time to 5 minutes.



Mike Stone


On Tuesday, April 15, 2025 at 06:25:36 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

开云体育

Dan,


Look in your HOST file and see if there’s a redirect of famous sites like Google to a pop up server somewhere. ?I had this happen to me once. ? This trick (of entering redirect of famous websites) makes any browser wanting to go to Google, yahoo, cnn, etc., instead go to the pop-up sites (or any sites).

This happened to me very long ago, and I suspect modern virus scanners knows this trick. ?But check anyway, just in case.


Jong?

On Apr 15, 2025, at 3:25 AM, Dan Kahn via groups.io <dankahn88@...> wrote:

?
Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

I have seen pop-ups occur as the result of some installed browser extensions or add-ons.

You can go into the browser and turn off all the extensions and see if the pop-ups stop.

If they stop, you then turn on each extension one at a time until you discover the extension that causes the pop-ups to return.

You then delete that extension.

You stated you used TeamViewer.

Does TeamViewer still limit your connection time?

I had to change to UltraViewer because TeamViewer was limiting my connection time to 5 minutes.



Mike Stone


On Tuesday, April 15, 2025 at 06:25:36 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

You will only be transferring the user’s personal files, music and photos.

The computer will have a new OS and you will be installing new apps, so it is very unlikely that you will transfer the infection.


Mike Stone


On Tuesday, April 15, 2025 at 06:25:36 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

Update!
I downloaded Malwarebytes and after a 55 minute scan it found 5 PUP's. I figured the problem was solved. Much to my dismay, the user opened his email account and up popped the same warning. So it was not removed. I am going to try downloading PrivaZer and see if that does the trick.
These "pop-ups" must be embedded in some registry location since it is not application related. It is on Chrome, Edge and Outlook.

As an aside, the pc does not meet the requirements for an upgrade to WIN11 so this user has requested that I do the transfer to a new PC he is buying. My concern is this Norton/McAfee popup will also be transferred to the new pc and I will have that to deal with during the install.

Is a puzzlement!

wings515

On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

You could also try Hitman Pro.



Dave

On 4/13/2025 10:54 AM, Dan Kahn via groups.io wrote:
Hard to tell. They look like popups and have a loud audio also. They can not be moved from the lower right hand corner which covers the "Settings" link on chrome. A couple of clicks and the picture goes away abut I don't have a lot of screen time to see fully what is going on. Just got one user link using TeamViewer to look at the 'Site Permissions' and found nothin listed as allowed.
I'll have to spend more time on their screen to determine more.
I did see some posting about resetting Chrome to factory default but since it is also no Edge, I don't give that much credit.

One user called McAfee and they stated what he is seeing is NOT a McAfee popup. So it must be some other hack.
I'll try on Monday to install Malwarebytes to see if there is a change.

Thanks for staying with me.


 

Hard to tell. They look like popups and have a loud audio also. They can not be moved from the lower right hand corner which covers the "Settings" link on chrome. A couple of clicks and the picture goes away abut I don't have a lot of screen time to see fully what is going on. Just got one user link using TeamViewer to look at the 'Site Permissions' and found nothin listed as allowed.
I'll have to spend more time on their screen to determine more.
I did see some posting about resetting Chrome to factory default but since it is also no Edge, I don't give that much credit.

One user called McAfee and they stated what he is seeing is NOT a McAfee popup. So it must be some other hack.
I'll try on Monday to install Malwarebytes to see if there is a change.

Thanks for staying with me.

wings515
On Sunday, April 13, 2025 at 11:07:45 AM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:
Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

开云体育

Are they actually popups from the browser or do they just look like browser popups?

Donald.

On 4/13/25 10:35, Dan Kahn via groups.io wrote:

Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

I've run CCleaner before with no change but I'll certainly do it again after Malwarebytes.

Thanks,
wings515
On Sunday, April 13, 2025 at 08:51:35 AM EDT, Jim <jrteig@...> wrote:


After running Malwarebytes try running CCleaner.


 

The quickest and easiest download for Malwarebytes is from Ninite.com.

Mike Stone


On Sunday, April 13, 2025 at 07:36:27 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


I am about to ask the users to install Malwarebytes and see if it picks it up.

wings515
On Saturday, April 12, 2025 at 07:50:26 PM EDT, C. Michael Stone via groups.io <enots123@...> wrote:


Have you ran a scan with Malwarebytes?

Mike Stone


On Saturday, April 12, 2025 at 08:56:39 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

I am about to ask the users to install Malwarebytes and see if it picks it up.

wings515
On Saturday, April 12, 2025 at 07:50:26 PM EDT, C. Michael Stone via groups.io <enots123@...> wrote:


Have you ran a scan with Malwarebytes?

Mike Stone


On Saturday, April 12, 2025 at 08:56:39 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

Donald,
I agree, these pop-ups are not from both McAfee and Norton but some other insidious hacker. Since they are on both Chrome and Edge, I would think they are imbedded in the registry some place.

I am wondering if Malwarebytes and PrivaZer might be able to find and eliminate them. I have both of these and are not plagued by these popups.

wings515
On Saturday, April 12, 2025 at 02:59:42 PM EDT, Donald H Locker via groups.io <dhlocker@...> wrote:


I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:
I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

After running Malwarebytes try running CCleaner.


 

Have you ran a scan with Malwarebytes?

Mike Stone


On Saturday, April 12, 2025 at 08:56:39 AM PDT, Dan Kahn via groups.io <dankahn88@...> wrote:


I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515


 

开云体育

I'd be strongly suspecting that these popups are not, in fact, from McAfee or Norton. McAfee has a fairly good page on spotting and eliminating fake popups:

In particular note that if setting the browser to block popups from the claimed site is not working, that is another indication that the popup did not originate with that site. (I can't tell you, off the top of my head how to identify the actual source site for popups; sorry.)

Disclaimer - I haven't use Windoze for at least five years, so my experience is quite dated.

Donald.


On 4/12/25 11:56, Dan Kahn via groups.io wrote:

I just linked in to the user PC with TeamViewer.? There are no URL's listed under the Allowed links to remove as per the YouTube video.
I also did a search to see if either Norton or McAfee was downloaded and they were not.
?
I had the user download Gaurdio or something like that and even though it stated "Free" it was only free after entering the Credit card info.? I was not going to have the user do this without knowing if this app really worked.
?
Additionally the user mentioned he has other friends with this same problem.
?
On going investigation.
?
Thanks,
wings515