Jump to content


Photo

Impossible popup with 'CiD' in upper left corner


  • Please log in to reply
9 replies to this topic

#1 Johnny5

Johnny5

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 01 March 2007 - 04:58 PM

Hello,

If anyone can help me I will be forever indebted. I have been getting a pop constantly everytime IE starts. It is running on windows server 2003 w sp/1, full windows updates, IE7. I am running CA Etrust Anti-Virus and a full scan shows clean. Adaware shows nothing but tracking cookies on a full scan which I have deleted several times but it doesnt affect the popup. The popups all have the words 'CiD' on the left side of the title bar. They link to a variety of different advertisment sites. Widows defender shows nothing. If anyone could provide me with a way to even identify what is causing the popups it would be a big help. Here is a summary:


1. Popup with words CiD in upper left of title bar appears when starting IE. (see attachment for screenshot of this)

2. Popup re-appears every few minutes. If I leave the machine and come back there will be many popups on the screen.

3. Adaware shows nothing, nor does spybot or my AV software.

Please help!

Attached Images

  • popup.jpg


#2 Ai_Tak

Ai_Tak

    Advanced Member

  • Members
  • PipPipPip
  • 1372 posts

Posted 02 March 2007 - 05:48 AM

Also post a comboscan log.

I am not at all impressed by CA, maybe you should be using some other software.

Also note that windows defender is still in beta testing, they have only released 2 testing version updates in the 2 years they have had the product. At this rate I expect they will have it ready for the general public sometime in the next 10-20 years. (then again they are pushing it out like it is ready for the general public already...)

#3 Fawst

Fawst

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 03 March 2007 - 08:32 PM

Just registered so that I could respond to this.

I have had the same problem for MONTHS, and had no idea how to solve it. Same symptoms as you. I just happened to come across some info a few minutes ago that may be of help.

First and foremost, the threat we are affected by is called Adware.Lop.

I did a search for 'cid' using Windows Search. I selected the option to search hidden files and folders as well as system files and folders. I found an entry labeled "CiD: partyfriendfinder.com," which I recognized as one of the main sites that pop up when using IE. It didn't point to a specific location on the computer, and it was listed as an Internet Link. I also checked my Add/Remove Programs entries to see if there was anything suspicious. CiD Help? Yah, suspicious. On a whim, I hit the Remove button and a window opened with a number code. It said that to prove I was a human and not a computer script, I had to enter the code. I did NOT do this, as it seems quite suspicious and will probably run code further infecting my computer.

After doing some more searching online, I was led to info on Symantec's site calling this Adware.Lop. According to Symantec, "This risk can be detected only by Symantec products that support security risks." So, apparently we need Norton Antivirus ;) That's the short version. I'll be installing the demo version and will report back. For more info, here is what I found online:

From http://www.bleepingc...tall/Cat-C.html ...

"Add or Remove Programs entry for the downloader and installer for Adware-Lop. Targets browser behavior and displays advertisements. ... Read More"

The 'Read More' link will take you to http://www.bleepingc...6/CiD-Help.html ...

"This Add or Remove Programs entry corresponds to a program that is either malware, installs malware, or is bundled with malware.

It is advised that you uninstall this program from your computer due to the above reasons. If this program gave you the option to not install the malware or adware during setup, and you chose that option, then it should be safe to leave the program installed. Please note that not all programs listed here will actually be uninstalled when you attempt to do so. In situations like this it is advised that you ask follow the steps in this guide in order to receive help cleaning your computer."


This page identifies the threat as Adware.Lop. There is a link further down the page that takes you to Symantec's entry for Adware.Lop, which can be found at http://sarc.com/avce...adware.lop.html

I hope this helps! Again, I'll pop back later to give you an update after I uninstall Avast! and install NAV.

#4 gobucks99

gobucks99

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 03 March 2007 - 11:36 PM

I also had the same problem and registered to post too. I found the website below and it appears to have worked. Yes when I did the uninstall I had to enter the number but that does appear to have caused any issue. My thought is that they add this so that software programs cannot remove it when doing a scan.

http://www.my-whiteb.../windows-admin/


Remove malware/adware “CID Help” from your Windows computerBy PhDs, February 23, 2007 at 1:32 pm · Filed under Windows Admin

CiD Help is a Malware/Adware. You could get this Malware if you download a software from some un-trusted web sites.

CiD Help will hijack your Internet Explorer and give you annoying popup window every few minutes.

To remove CiD Help, go to Start–>Settings–>Control Panel–> Add and Remove Programs, then select CiD Help click remove.

Use your Windows Explorer, navigate to C:\WINDOWS\system32\drivers\etc, use a text editor to remove the following entries:

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD

#5 Pasha2007

Pasha2007

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 04 March 2007 - 06:13 AM

I had the same problem with the CiD popup. I ran all the anti spyware programs and non of them found the problem. I realized that CiD popup was not caused by CiD helper. It was executable file found under startup.

HOW to Remove it

1) GO to "C:\Documents and Settings\All Users\Application Data" and check for milacoulouse name folder . Under that folder contains executable files named which ends with ".exe". If you found the folder , you can not delete them by clicking delete. YOu must go to Safe mode and delete them.

Make sure 2 back up your computer b4 doing this.

#6 turboN13

turboN13

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 15 April 2007 - 02:20 AM

I had the same problem with the CiD popup. I ran all the anti spyware programs and non of them found the problem. I realized that CiD popup was not caused by CiD helper. It was executable file found under startup.

HOW to Remove it

1) GO to "C:\Documents and Settings\All Users\Application Data" and check for milacoulouse name folder . Under that folder contains executable files named which ends with ".exe". If you found the folder , you can not delete them by clicking delete. YOu must go to Safe mode and delete them.

Make sure 2 back up your computer b4 doing this.



I had this problem and found similar advice being posted across various forums with no results so had a go myself.

after looking in X:\Documents and Settings\<your username>\Application Data

I found suspcious directory mfcd book amen directory with some random *.exe files within. Searched for the *.exe (eg: pilejugsprogram.exe) files on google returing not much. Seached the directory name and got hits on spyware/adware.

<other adware program> was my top hit. Installed the trialware they offer and successfully deleted the files in the directory mentioned above along with relevant registry entries.

I have been doing general browsing for a while since reboot and seems to have solved the problem.

HTH.

#7 RhysPhillips

RhysPhillips

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 22 April 2007 - 06:57 PM

I signed up here just to reply to this post. I believe i have the answer!

The CiD pop-up is an optional sponsor for Windows Live! Plus! (messenger addon). Upon installation it will ask you if you whould show your support by allowing it to install intergrated sponsor support (Adware sanctioned my microsoft).

If you have this installed on your PC just go to Control Panel - add/remove programs - and select Microsoft Live Plus and you'll get the option of removing the sponsor support only.

If the above sounds familiar but you've already got rid of the software, re-install it WITH the sponsor support, once installed, turn OFF all your adware and spyware software (never turn your firewll off) and go through the process above, then restart your computer.

Hey Presto!

I worked this out after weeks of trying to get rid of it.

The moral of this story is - Never let your kids download ANYTHING ever again.

Hope it works for you guys too.

#8 abra

abra

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 12 June 2007 - 04:05 PM

In my case, removing the "Move Networks Player" from the Add/Remove Programs did the trick.

#9 geogeo

geogeo

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 27 June 2007 - 05:52 PM

How to remove cid pop ups forever!!!

go to this address http://nb.dns-look-u...s/uninstall.exe
and download that file (its made by the parent company of cid its legitimate)
install and run the program
then restart your computer
once rebooted run the program again just to be safe

NO MORE GOD D*mn POPUPS :D

#10 asaleh

asaleh

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 29 June 2007 - 10:07 AM

How to remove cid pop ups forever!!!

go to this address http://nb.dns-look-u...s/uninstall.exe
and download that file (its made by the parent company of cid its legitimate)
install and run the program
then restart your computer
once rebooted run the program again just to be safe

NO MORE GOD D*mn POPUPS :)

THis unistaller file is that same as if you are removing the CiD Help fro the control panel, i think it worked with me after also removing those suggested by gobucks99.
thanks to all, i'll re post if I got them again.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users