Had anyone come across this popup? (Pic Inside)

[mcvickj]

Has anyone come across this popup? (Pic Inside)

In the process of cleaning up a family members PC I was able to remove all of the current spyware and junk except for one piece. Here is a picture of it

This will popup if I am online or offline. The only way I can remove it is by using CTRL+ALT+DEL. Then it will return about 10 minutes later. I am not exactly sure what to call this. I did several searches on Google but with no great success. I have Ad-Adware and SpywareBlaster installed and updated with the current file but it didn't find it. I am going to bring CWSShredder and Spybot with me this Sunday. I have also tried Xclean.

I posted this problem at TechIMO and SpywareInfo.com. Hopefully someone will recognize it.

 

[HumboldtBlazer]

I see a blank page or page not found, is that the pop-up?

 

[mcvickj]

Yes. This is a picture of the exact popup. The date and time will change but the page is never found. I have no idea what it trying to display.

EDIT: What also seems strange is that the popup is trying to use Internet Explorer when Firefox is the default web broswer.

 

[Candyman]

If you right click the mouse, can you click on properties to see if any url is listed?

 

[mcvickj]

Hmmm...I'm not sure about that one. I will have them try that tonight.

 

[HumboldtBlazer]

I bet a spy or hack program is prompting you to go to a web page that no longer exsists to d/l a virus. I ran into something very similar about 6-1yr ago. Lemme do some research and see what I can find out. I would suggest running Hijackthis and posting the results on their forum. They are very helpful over there!

 

[Rolex]

By cleaning up the computer, I guess you don't plan to do a full hard disk format and system reinstall? I'm with HumboldtBlazer on this one, and I don't know how you could kill it without wiping the drive. What's with the date on top of the page? Does it change?
You might want to install Norton System and have it do a full system scan. It will probably identify it as a virus program and quarantine it, then you can delete it within Norton.

 

[mcvickj]

HB - I already did that. I am waiting to hear back. I thought it was a virus but I can't seem to find anything to fit. Again since I don't know what to call this I might be missing it during a search.

Rolex - If I can avoid burning the machine down and restarting I will. More so since I just did that about a month ago. About the date - That is a good question. I am not sure. Yes it does change. I am pretty certain NAV 03 is installed on the PC. I remember running it and it didn't find anything but I forgot to try it in safe mode. One more thing to try when I visit em on Sunday.

 

[Rolex]

If you just did it a month ago, you got it since then. In just a month, there won't be too much to back up. Just to TOTALLY get it out, I'd reformat and reinstal the OS.
With Norton System Works (not just the NAV) there are several very usefull utilities. One is Roxio GoBack. Once installed on a clean machine, if you ever have a problem or pick up a virus, NAV will quarantine, and just to be on the safe side, run GoBack till previous boot or most recent safe point. You will have many options. It will reset the comp to the point you chose, which means it doesn't even know there was a virus or worm that got in there. I also cold boot before installing a program or upgraded driver or whatever. If something doesn't work out, it's GoBack, and it's gone.

 

[Reptile]

First run hijack this , second run AD-Aware (newest version), then run AVG it will be gone guaranteed!

 

[mcvickj]

Well I believe I have the problem licked. When I arrived I booted the computer into safe mode and ran everything. Spybot, Spyware Blaster, Ad-Aware, Hijackthis, Xclean and NAV. Spybot and Ad-Aware found two things but I wasn't confident that I got rid of it. Restarted the computer and within the first 5 minutes the reminder popup returned! GAH!

So I restarted the computer one more time and when it came back up I took a screenshot of the running processes on the computer. I then waited until the popup returned and compared the two lists. I discovered a new process called "HPSdpApp.exe". After a Google search I found out this process is related to the Easy Internet Sign-Up. Some piece of software that came with their computer when purchased. After I knew what it was I searched for the file and deleted it. This is one that I won't forget any time soon.

Here is a link straight from HP/Compaq's web site relating to this.