PDA

View Full Version : Flash adds on forums driving me nuts.


Audioman
11-11-2012, 09:58
Recently have been getting pop up adds on this forum and SH forum where certain words are underlined. Disabling Flash Player stops this but of course there is the inconvenience of re-enabling or re-installing to see vids. I suspect something else is goiing on though. Using Firefox with up to date Avast and pop ups blocked. Pop up blocker ineffective and no Malware detected when scanned. :scratch:
Tim
11-11-2012, 10:14
I use Firefox and visit SH and I don't get any, in fact I have never had any - sounds like you are infected with malware.
MartinT
11-11-2012, 10:37
Yes I'd agree, sounds like malware. Download and scan with Malwarebytes.
NRG
11-11-2012, 10:42
I use 'clicktoflash' on Safari that stops all flash content automatically. If you wish to see it you just click on it and it runs....maybe something similar for FireFox?
The Grand Wazoo
11-11-2012, 10:52
I think it's important to note that AoS doesn't host any such adverts.
Audioman
11-11-2012, 11:40
Scanned with anti-virus again and checked for any undesrable programmes installed. Appears to only affect Firefox and not IE. Rather than completely uninstall to get rid I found a Firefox add on called Adblock plus. This appears to be working.

Martin will try Malwarebytes but nothing else is detecting any Malware.

Paul.
MartinT
11-11-2012, 12:12
No worries, Paul.

I do find that Firefox displays more odd behaviour these days than other browsers. IE9/10 and Google Chrome are my preferred browsers and I use them a lot for testing at work.
Beechwoods
11-11-2012, 13:56
I think it's important to note that AoS doesn't host any such adverts.

That's right, I detest that kind of stuff!
keiths
11-11-2012, 14:33
This sounds very much like something a customer of mine was experiencing a while back. It turned out that he had inadvertantly installed 'Funmoods' (it was bundled with some other free software he was installing and he didn't read the 'terms and conditions' shown on installation that would have told him he was also agreeing to the installation of Funmoods).

Funmoods was not classified as malware by either Malware Bytes Anti-Malware nor Spybot Search & Destroy. He ended up manually removing as follows:

Kill processes:
funmoodssrv.exe

Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escort.D LL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortAp p.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortEn g.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlb r.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{09C554C 3-109B-483C-A06B-F14172F1A947}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4E1E9D4 5-8BF9-4139-915C-9F83CC3D5921}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{960DF77 1-CFCB-4E53-A5B5-6EF2BBE6E706}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B12E99E D-69BD-437C-86BE-C862B9E5444D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D7EE817 7-D51E-4F89-92B6-83EA2EC40800}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B36 0-05E0-4F93-8150-02891F1D8D3C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B36 0-05E0-4F93-8150-02891F1D8D3C}\Instl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B36 0-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D14 4-506D-4BE5-81DB-EC7DA1E7F840}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D14 4-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D14 4-506D-4BE5-81DB-EC7DA1E7F840}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D14 4-506D-4BE5-81DB-EC7DA1E7F840}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D14 4-506D-4BE5-81DB-EC7DA1E7F840}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D14 4-506D-4BE5-81DB-EC7DA1E7F840}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0A A-4214-4CB4-90EC-E3E07ECD04F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0A A-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0A A-4214-4CB4-90EC-E3E07ECD04F7}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0A A-4214-4CB4-90EC-E3E07ECD04F7}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0A A-4214-4CB4-90EC-E3E07ECD04F7}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0A A-4214-4CB4-90EC-E3E07ECD04F7}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DB E-B104-44AC-950A-8A5F97AFF439}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DB E-B104-44AC-950A-8A5F97AFF439}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DB E-B104-44AC-950A-8A5F97AFF439}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DB E-B104-44AC-950A-8A5F97AFF439}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DB E-B104-44AC-950A-8A5F97AFF439}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DB E-B104-44AC-950A-8A5F97AFF439}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272E C-ED9E-4ACE-A6F2-9558C7F29EF3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272E C-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272E C-ED9E-4ACE-A6F2-9558C7F29EF3}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272E C-ED9E-4ACE-A6F2-9558C7F29EF3}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272E C-ED9E-4ACE-A6F2-9558C7F29EF3}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272E C-ED9E-4ACE-A6F2-9558C7F29EF3}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719 C-7156-415E-B49D-BAD039DE4F13}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719 C-7156-415E-B49D-BAD039DE4F13}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719 C-7156-415E-B49D-BAD039DE4F13}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719 C-7156-415E-B49D-BAD039DE4F13}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719 C-7156-415E-B49D-BAD039DE4F13}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719 C-7156-415E-B49D-BAD039DE4F13}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D 0-4F2B-497C-8A71-DD41D70B07D9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D 0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D 0-4F2B-497C-8A71-DD41D70B07D9}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D 0-4F2B-497C-8A71-DD41D70B07D9}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D 0-4F2B-497C-8A71-DD41D70B07D9}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D 0-4F2B-497C-8A71-DD41D70B07D9}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D8 0F1C5-D17B-4177-AC68-955F3EF9F191}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D8 0F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D8 0F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D8 0F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C 70BCA-6E23-4A65-AD2E-1389062074F1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C 70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C 70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C 70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D 8EEF7-0E13-4000-B9C4-6603C1E912D1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D 8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D 8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D 8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295 CACB4-51F5-46FD-914E-C72BAAE1B672}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295 CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295 CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295 CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE 5C4B9-6DBE-4528-96FA-C9FF38EF1762}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE 5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE 5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE 5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C 1FDF7-02C1-4F23-B393-F48B16E071D1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C 1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C 1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C 1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{542 91324-7A3D-4F11-B707-3FB6A2C97BD9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{542 91324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{542 91324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{542 91324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C 63F11-D4E5-46E7-9B8A-EE158DCA83A8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C 63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C 63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C 63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA 22CBD-0029-4A09-B757-CF0FAFC488ED}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA 22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA 22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA 22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A 6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A 6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A 6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A 6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C05 85B2F-74D7-4734-88DE-6C150C5D4036}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C05 85B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C05 85B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C05 85B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA1 7D76B-F91D-4659-A7FD-A9F7ED375CDD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA1 7D76B-F91D-4659-A7FD-A9F7ED375CDD}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA1 7D76B-F91D-4659-A7FD-A9F7ED375CDD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA1 7D76B-F91D-4659-A7FD-A9F7ED375CDD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D82 42E89-2F81-484A-AE5B-BA8CAD5B7347}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D82 42E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D82 42E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32

Unregister DLLs:
%ProgramFiles%\Funmoods\1.5.23.22\bh\escort.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortEng.dll
%ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll


Delete files:
%AppData%\funmoods.crx
%AppData%\Google\Chrome\
%ProgramFiles%\Funmoods\1.5.23.22\funmoodssrv.exe
%ProgramFiles%\Funmoods\1.5.23.22\uninstall.exe
%ProgramFiles%\Funmoods\1.5.23.22\bh\escort.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortEng.dll
%ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll
Audioman
11-11-2012, 15:15
Keith

Whatever it is it's not Funmoods. I removed any programs that may be linked to something else. This attaches itself to the Firefox version of Flash Player. I will run Winoptimizer to get rid of any unattached traces left that may be causing this. Anyway the plugin I downloaded surpresses the problem. Frankly I have had issues with various Flash Player updates in Firefox before.

Paul.