SOLVED IE11 is Ad-Infested

[neo668]

I had IE11 on all my computers for a couple of weeks now. It seems to link ads to all keywords on a web page, which means, you have ad boxes opening up all over the page when you move the mouse. Got fed up with it and uninstalled IE11 on all my computers in "Programs and Features". I now have IE9 on some computers and IE10 on others. I also made sure I don't see IE11 ever again by hiding its update. I hope M$ removes this ad feature in IE12.

Yeah. I know I should move to Chrome or FireFox. But I'm used to IE and old habits are hard to break.

 

[mimart7]

I doubt that will happen in future release if IE. Ad will only become more trageted based on your browsing habits.

 

[papadan]

I had IE11 on all my computers for a couple of weeks now. It seems to link ads to all keywords on a web page, which means, you have ad boxes opening up all over the page when you move the mouse. Got fed up with it and uninstalled IE11 on all my computers in "Programs and Features". I now have IE9 on some computers and IE10 on others. I also made sure I don't see IE11 ever again by hiding its update. I hope M$ removes this ad feature in IE12.

Yeah. I know I should move to Chrome or FireFox. But I'm used to IE and old habits are hard to break.

I've had IE11 on my sig. computer now for about three weeks & haven't seen what you are describing. Is it only in certain sites?

Now that you bring this up I'll play around a little to see if I can duplicate.

 

[neo668]

I've had IE11 on my sig. computer now for about three weeks & haven't seen what you are describing. Is it only in certain sites?

It happens on any web page, any site. The most annoying word to me is "best" because it occurs all the time and it will for sure be linked to an ad. The ad linked words will change color and next to the word is a small circle with an arrow sticking out at the top end of the word.

 

[papadan]

It happens on any web page, any site. The most annoying word to me is "best" because it occurs all the time and it will for sure be linked to an ad. The ad linked words will change color and next to the word is a small circle with an arrow sticking out at the top end of the word.

I've played around since my last post & I'm not seeing anything you are describing. I really don't know what's going on. What version is yours? Mine (11.0.9600.16428)

Dan

 

[neo668]

I've played around since my last post & I'm not seeing anything you are describing. I really don't know what's going on. What version is yours? Mine (11.0.9600.16428)

That's strange. I got IE11 through Windows Update but I have uninstalled it now. So I don't know what version it was. You've just made me more curious. Could it be because we are at different locations? I'm in Hong Kong btw.

 

[papadan]

That's strange. I got IE11 through Windows Update but I have uninstalled it now. So I don't know what version it was. You've just made me more curious. Could it be because we are at different locations? I'm in Hong Kong btw.

Different locations? That's why I was thinking that the versions might be different.

 

[c627627]

I'm used to IE and old habits are hard to break.

When I started using Firefox before it reached version 1.0 back in the day, one of the things that attracted me to it is its customization abilities. I figured out how to make it behave like Internet Explorer to make the transition easier.

Today I stick with it because it still has the best add-ons available. It's nice how I can backup a single folder which stores all info so that when (not if) something messes up, I delete that folder and copy-paste the backed up version of it and things are just like they used to be when I first set up the browser to be like I want it to be.

 

[papadan]

When I started using Firefox before it reached version 1.0 back in the day, one of the things that attracted me to it is its customization abilities. I figured out how to make it behave like Internet Explorer to make the transition easier.

Today I stick with it because it still has the best add-ons available. It's nice how I can backup a single folder which stores all info so that when (not if) something messes up, I delete that folder and copy-paste the backed up version of it and things are just like they used to be when I first set up the browser to be like I want it to be.

So far IE11 is working good, no problems. I do think it is loading pages a little faster than IE10. I used Firefox some years ago & I really don't remember why I stopped using it. it was good.

 

[RJARRRPCGP]

Sounds like malware. I don't think it's Microsoft.

 

[neo668]

Sounds like malware. I don't think it's Microsoft.

You are right. Thanks. Sorry M$.

I was still getting ad links with IE9. When I read your post I decided to dl Malwarebytes, did a quick scan and deleted all the infected items it found. There were no more ad links in IE9. Reinstalled IE11. And it appears clean.

Thanks again.

 

[papadan]

You are right. Thanks. Sorry M$.

I was still getting ad links with IE9. When I read your post I decided to dl Malwarebytes, did a quick scan and deleted all the infected items it found. There were no more ad links in IE9. Reinstalled IE11. And it appears clean.

Thanks again.

Great to hear you figured it out Are you using Microsoft security essentials? It works good on malware for me.

 

[neo668]

I've been using MSE on all my computers since it first came out. I really liked it and I still do. So it never occurred to me that I might have been hit by malware until RJARRRPCGP pointed this out to me.

Unfortunately, MSE is not as water-tight as I thought it was. And I needed Malwarebytes to rescue me. I must say Malwarebytes is one great program. After scanning with Malwarebytes I was surprised to find that all my computers were affected by malware even though they were all protected by MSE.

I'll still keep MSE as before but perform a quick scan with Malwarebytes every once in a while.

 

[papadan]

I've been using MSE on all my computers since it first came out. I really liked it and I still do. So it never occurred to me that I might have been hit by malware until RJARRRPCGP pointed this out to me.

Unfortunately, MSE is not as water-tight as I thought it was. And I needed Malwarebytes to rescue me. I must say Malwarebytes is one great program. After scanning with Malwarebytes I was surprised to find that all my computers were affected by malware even though they were all protected by MSE.

I'll still keep MSE as before but perform a quick scan with Malwarebytes every once in a while.

That's good to know, I'll have to keep a lookout for problems. I'm going to check my system also. Thanks

 

[c627627]

I've been using MSE ... So it never occurred to me that I might have been hit by malware.

Unfortunately, MSE is not as water-tight as I thought it was.

Microsoft Security Essentials is definitely better than nothing and is famous for its ease of use. MSE definitions however, are not stellar, and so from the point of view of best antivirus definitions that best combat a brand new most recently created virus, you would have to look elsewhere.

There is only one Freeware with definitions that can match and most of the time beat the most expensive pay-for antivirus software:
http://www.avira.com/en/download/product/avira-free-antivirus


It is not as easy to use as MSE, but if setup correctly, you will not have to look at ads this freeware comes with. (You can also buy the ad-free professional version).

I stopped updating Avira with version 13.0.0.2832 because it is the last version on which you can disable Avira product updates. I chose to give up product updates because of the way anti-virus software is integrated with the system. A bug in a new product update can affect the entire OS. So I get definition updates but not product updates and this is how I set up the old version, new versions should be similar, except product updates are mandatory on them:

Spoiler

Avira AntiVir Personal 13.0.0.2832

(Compatible with Windows 8 but not Windows 8.1. Install version 14 or later for Windows 8.1 compatibility.)

[Follow-up Build 2890 does not have the option to disable product updates. It is important to disable automatic product updates (but leave definition updates ON). Product updates may affect the Windows operating system. They should preferably be downloaded only *after* imaging the operating system partition so that if they cause problems you can reimage back to the state before product updates were installed.]


Disconnect Internet connection. Double click on Setup.exe to install the program.
Ignore Avira's warnings to uninstall Comodo Firewall or similar programs which intercept phone-home attempts.

SELECT: Custom and CHECK: I accept the End User License Agreement > Next >

UNCHECK everything when asked to install Avira Toolbars > Next > Next > Next > Next


Welcome to the Configuration Wizard > Next > Next >

Allow the configuration wizard to keep the default Express Setup options. [Do not Select All.]
(UNCHECK: Application, Games, Jokes, Programs that violate the private domain, and Unusual runtime compression.) > Next > Next >

UNCHECK: Performs a quick systems scan after the installation

Next > Finish >

*ABORT any update process when it automatically pops up!* (If you haven't disconnected Internet connection as instructed above.)


Setup the program before connecting to the internet [then block apnstub.exe and ipmgui.exe from accessing the internet].


Subscription to new virus definitions for this program is renewed automatically when you right click on Avira icon in the task bar > Start update

or download the latest key file from:
http://personal.avira-update.com/package/peclkey/win32/int/hbedv.key

and either copy it to
C:\Program Files (x86)\Avira\AntiVir Desktop
and restart or go to Help > License management > click on the blue hbedv.key link > browse to the new downloaded hbedv.key > Open.


Options:
C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe



System Scanner (upper left) > Configuration (upper right) > Yes >
UNCHECK: Follow symbolic links (on right) > System Scanner > Scan > Action on detection >
Set for Automatic, Primary action: Ignore [if you want to just scan folders and get a scan report without deleting files or being prompted what to do if virii/malware are found.]


> Click on + next to Update > Product Update > Do not download product updates.
[This option is only for Avira Antivir product updates (Antivirus definitions will still be downloaded automatically.) Product updates should be downloaded manually by going to Update > Start product update... because they may affect the Windows operating system. They should preferably be downloaded only *after* imaging the operating system partition so that if they cause problems you can reimage back to the state before product updates were installed.]


> General > Security >
Disable being notified every time USB drive has an AUTORUN.INF file:
UNCHECK: Block autorun function
> General > Events > Select: Limit size to max. >
> General > Reports > Select: Limit number to max. >
> General > Alerts > UNCHECK everything except Dial-up connection is used

> OK

> Scheduler [on lower left] > UNCHECK everything.


Set Avira Free Antivirus to Always show in Windows Taskbar.


To disable Notifier nag screen: Windows 2000/XP Control Panel > [in Windows 7/8, click on (view by Category) System and Security first] > Administrative Tools [fourth from bottom] > Local Security Policy > Right click on Software Restriction Policies > Create New Policies SO THAT ADDITIONAL RULES SHOWS UP UNDERNEATH > Right click on Additional Rules > New Path Rule... > Browse... to the path of avnotify.exe default is
C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe
or
C:\Program Files\Avira\AntiVir Desktop\avnotify.exe

> Set the security level to Disallowed > OK

Also block these two files from accessing the internet, using Comodo Firewall or similar software:
C:\Program Files (x86)\Avira\AntiVir Desktop\apnstub.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe

or

C:\Program Files\Avira\AntiVir Desktop\apnstub.exe
C:\Program Files\Avira\AntiVir Desktop\ipmgui.exe

The blocked files are to block Ask toolbar check and to block a popup nag.


apnstub.exe is related to a Toolbar check. AntiVir software checks whether the ASK-Toolbar is already installed on your computer. If the Toolbar is already present, AntiVir will not bother you with a slide-up alert asking you to install it. The apnstub.exe utility will do this check three times (the next three times that you reboot your computer). An additional check is done whenever the AntiVir setup dialog is displayed, in order to once again confirm the presence or absence of the Toolbar. If the ASK-Toolbar is already present, AntiVir will not offer you the setup option for installing the Avira-Toolbar.

ipmgui.exe is related to Avira messaging popup nag.



For Windows XP Home or Windows 8 (non-Pro version) you would need to boot into Safe Mode and log in as Administrator, then
go to
C:\Program Files\Avira\AntiVir Desktop\avnotify.exe
and right click on it >
Properties > Security TAB >
[Under Group or usernames] SYSTEM > Edit button > CHECK: Deny for Read & execute > Apply > OK > OK

Make sure SYSTEM is set to Deny for Read & execute before rebooting.


To submit a suspected virus, go to
http://analysis.avira.com/samples/
to upload it.


You can scan multiple drives inside program options: Local Protection > Scanner > CHECK drives you wish to scan. The premium version also offers the option to scan multiple folders here. The free version does not.


In case of error message:

The procedure entry point ?_Xbad@tr1@std@@YAX4error_type@regex_constants@12@@Z could not be located in the dynamic link library MSVCP90.dll

download and install Microsoft Visual C++ 2008 SP1 Redistributable Package
http://www.microsoft.com/downloads/...FamilyID=a5c84275-3b97-4ab7-a40d-3802b2af5fc2


Manual updates can be downloaded from:
http://dl.antivir.de/down/vdf/ivdf_fusebundle_nt_en.zip
Unzip the downloaded file and copy all the contents to
C:\Program Files\Avira\AntiVir Desktop


Using two Antivirus programs at the same time:
If there are two Antivirus programs installed, you should not have two Antivirus *Guard* programs active at the same time because this would slow the system down, Windows may even have problems booting with two Antivirus guard components being active. So if installing AntiVir on a system where there already is an Antivirus program installed, do not install AntiVir guard.

Also disable the guard component of one program if using another program to scan an entire disk drive.


Default log file location is
C:\ProgramData\Avira\AntiVir Desktop\LOGFILES
or
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES

 

[papadan]

I downloaded & ran Malwarebytes & it found 24 items that MSE missed or didn't think was a problem. I suppose it's all in the way the two programs defining what is malware.
I will probably run Malwarebytes every once in awhile.

 

[Robert17]

Any One security application doesn't seem to cut it. I use MSE and run Malwarebytes from time to time. Between them I seem to have no malware problems. I guess you could call it "getting a second opinion". In fact I ran Malwarebytes this a.m. and it caught 9 problem files and registry entries that MSE missed. I'd been out of town for a couple of days and my wife had used Unit 1 for something or other instead of Unit 2 (her's + HTPC); and she doesn't surf while wearing shark repellant.

 

[c627627]

At which point are we going to conclude that MSE definitions are vastly inferior to other aniti-virus software?


While it is true that it is difficult to say which antivirus program is "The Best" - we have a pretty good idea which ones are not. Without speculating how bad they are, MSE definitions are nowhere near Top 10. Other definitions that suck are AVG's and Avast's (by the way.)

 

[papadan]

Any One security application doesn't seem to cut it. I use MSE and run Malwarebytes from time to time. Between them I seem to have no malware problems. I guess you could call it "getting a second opinion". In fact I ran Malwarebytes this a.m. and it caught 9 problem files and registry entries that MSE missed. I'd been out of town for a couple of days and my wife had used Unit 1 for something or other instead of Unit 2 (her's + HTPC); and she doesn't surf while wearing shark repellant.

I believe I'm going to use the two program approach also from now on.

I know what you mean about the wife!!!

 

[papadan]

At which point are we going to conclude that MSE definitions are vastly inferior to other aniti-virus software?

It will probably take me until I get some serious problem. I tend to keep something as long as it works.