Avenue A Inc.

[Alan]

Are any of your advertisers using Atlas DMT (formerly Avenue A Inc.) for "marketing" purposes, 'cos I keep on getting Avenue A Inc cookies and ATDMT cookies put on my computer and Spywatch sometimes lights up when I log onto Hexus.net.

This is part of a bigger problem where up to 60 registry keys can be added to my comp by adserve.internetfuel.com and also their wonderful exitfuel cookie as well.

I remove them as soon as they appear but can anyone suggest a way of eliminating them altogether?

[DR]

Atlas do the adverts for Crucial for th site. They do not spy or damage your system at all as far as I know, but I will direct them to this thread.

I would urge you to support the site fully since without the advertisers we would not be able to afford to run the services which we do.

[Alan]

I accept that absolutely David but I have a host of cookies and registry keys, most of which are trackers. Now I have read that the Avenue A tracker is fairly inoffensive but the Exitfuel cookie has begun to appear as well and this is from internetfuel.com which I don't think is the same company (as Atlas DMT).

I am a creature of habit and visit only a handful of sites. What worries me is that I have a hardware firewall, a software firewall, ad blocking is on, no pop-ups is on, I have specifically blocked access to and from these web sites including java and Active X- and still they damn well appear!

Hexus was not available to me this afternoon (was the site down?) but before I started my web browsing this evening, I ran a spyware/adware remover and "cleaned" my PC. Hexus was my first port of call and immediately upon the site opening, the Avenue A Inc. cookie attempted to deposit itself on my PC.

I'm not happy and if anyone has even a partial solution, I would be most grateful.

[Steve]

Cookies are going to happen - unless you block them.

Registry keys can't be added unless you run a program, or click "yes" to something - a cookie AFAIK cannot do this.

Don't worry about cookies - they can't harm anything on your computer, just track the odd thing.

I run anti-spyware tools too, and regularly end up removing the same handful of cookies - no biggy.

*Clicks advert for good measure*

[Enverex]

Make sure that on whatever browser you are using, you have "Enable cookies only for the originating site" so that adverts and such cannot create cookies, only the actual site that you are on (i.e. On Hexus, only Hexus could make them, not one of the adverts which is called from another site).

[Alan]

Thanks for that Enverex - that setting wasn't selected. unts, I'm not clicking on "Yes" for anything. Sometimes, when I first log onto the web, and it doesn't matter whixh web site, another button appears on the task bar. If I switch to that window, nothing is displayed and when I close it, another button appears with "www.adserve.internetfuel.com/cgi.bin..." and some other stuff.

If I run a cleanup program then, there are always a minimum of fifteen new registry keys. Could closing that first task bar button be running a program?

[Iain]

A web site can't set a registry key unless you allow an exectuable to run from the site and I can assure you that we don't have anything like that on Hexus or our affiliates.

Spyware applications do look for cookies from certain sites as cookies can be used to track your online viewing habits but in no way can they damage your PC.

If you have registry keys being set then I strongly suggest you run a full virus scan as you have either obtained a virus/trojan or have allowed an web based executable to run on your PC.

If you are having difficulties then post a couple of the registry key names up here and I will see what I can uncover

Let me just re-stress though, Hexus cannot and will never set a registry key on your PC from our site. We may at some point in the distant future provide a screensaver or some such which is an executable you would run but that would need your permission to be run, we cannot do it by any hidden means.

[Alan]

It's OK Az, no accusations have been made - this latter carry on sometimes happens REGARDLESS of the web site - it seems to be simply the act of connecting to the web.

I am up to date on Norton anti-virus but I'll run a full scan anyway.

[Zak33]

as most of thegood chaps here willpoint out, I am clueless on this subject......but because I have a long nose and look a bit like Victor Meldrew.....

do you have any ability to use an old hard drive, reinstall FRESH with no other HDD attached and then try it......

cos every single thing Ihave installed recently (camera software, media type players, grpahics package etc) have had a damn good go at waving their little flags on the internet....

and for the use of an old HDD and a fresh install of XP then a visit back here, you'd know if it was anything"nasty" on your current system.,.,,,,cos as we all know...Trojans and Viruses are a few steps ahead of the Anti Virus boys....and you might have a new one

[Mart]

Have you checked for apps that run when windows starts from the reg key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

Check the timestamps on all exes mentioned in here and look at the company name, product name etc using the props window in Windows explorer . If the file is only a couple of months old and looks like a system file e.g loader.exe but company and product name are blank (instead of Microsoft) then it is probably bogus.

Deleting all the suspect values in this key should stop em starting.

Another place to check would be c:\WinNT\system and sort by file date, again if there is anything that is newish it could be fishy.

To find which apps are writing to the registry you can use regmon from sysinternals.com http://www.sysinternals.com/ntw2k/source/regmon.shtml

It has a log bootup option that will log every registry access as the system initializes. If you know the reg keys that get written then you can filter on this and identify the .exe doing the writing.

[Alan]

Thanks Mart, I'll try that. Zak33, sadly I have no spare drive but I was thinking of doing it to my only drive anyway.

I checked, there is nothing in the RunOnce or RunOnceEx.

[Steve]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] is the key you actually want, I think.

Or run MSConfig to get the list.

[Alan]

I tried Run as well when I was checking the others - it is clean too. I don't have msconfig. Is there a 2k Pro version?

[streetster]

how about in HKEY_CURRENT_USER\ rathern than local machine?

does seem a bit odd really..

mark

[Alan]

My machine crashed while playing a game, it re-booted and when I logged back onto the web (just by chance it was Hexus), I got the extra task bar button, then there were two and each of them said "www.nitrous.internetfuel.com..." this time. They closed themselves as O looked at it and up popped the old friend - again a button on the task bar- adserve.internefuel.com etc.

These are the 15 registry keys they put on my P.C.



I hope you can read this, I shrank it too much to reduce file size.

[Alan]

This will be a bit easier to read. I am beginning to uspect that some of these are not spyware of any kind!