Solved Browser Pop up after pc boot

[Rogue Bolo]

Greetings,
Whenever I start my pc (Windows 7, 64 bit). I get a Godaddy pop up on my google chrome browser showing an westechnologies.com ad. I narrowed the location of the file source to the Sidebar for windows Gadgets (located somewhere in c:\Windows\winsxs folder). I narrowed the location by uninstalling my browser application and restarting my PC. I received a error notice stating that I did not have a program associated with this pop up. when I opened my task manager and opened the program associated with this warning, the task manager connected me to the "sidebar.EXE" file located somewhere in the "C:\windows\winsxs" folder. I verified that the problem was associated with the sidebar/gadget area by closing the gadget sidebar and restarting my PC. The pop up did not appear when the sidebar was off, but when I started the sidebar the pop up appeared. I tried several online virus scanners (Trend Micro housecalls, kapersky, and ESET). I even installed Norton internet security suite which did not remedy the problem. I am currently using Online Armor as my firewall and Avast (free edition) as my anti-virus protection. I also have Superantispyware pro running as well (superantispyware performs nightly malware full scans, and has real time protection). I also use Malwarebytes (free edition) in quick scan mode with negative results as well. Any suggestions would be greatly appreciated.

 

[cottonball]

Rogue Bolo,

Please download AdwCleaner:
http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner
Save to the desktop.

Close all open programs.

To run the program, right-click AdwCleaner.exe and select: Run as Administrator
Click on Search and confirm the prompt.
After it finishes, a text file report opens.

Please post the content of the AdwCleaner report to your reply.
(A copy of the log is also saved at C:\AdwCleaner[S1].txt)



Also download the Junkware Removal Tool:
Junkware Removal Tool Download
Save to the Desktop.

Make sure you temporarily disable your AntiVirus, Firewall, and any other security applications.
These programs may interfere with the running of JRT.

For information on how to disable protective programs, refer to this info:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - BleepingComputer.com

Right-click JRT.exe and select: Run as Administrator

The tool opens and starts scanning the system. Please be patient as this can take a while...

When done, a report (JRT.txt) is saved on the Desktop.

Please post the contents of JRT.txt in your reply.

 

[Rogue Bolo]

Cottonball

Thank you for your response and your Suggestion.
I ran AdwCleaner with only the essential software running. After which I selected "delete". results (R1, R6)

Afterwards I ran the application again with all my programs enabled (S2, S3).

From there I ran "Junkware Removal Tool". the results are in the JRT text files attached.

After all this the Pop up still occurs immediately after boot up.

Any help would be deeply appreciated.
Sorry for the delay in responding to your suggestion.

 

[Kaktussoft]

Check C:\Program Files\Windows Sidebar\Gadgets\
and post C:\Users\Ron\AppData\Local\Microsoft\Windows Sidebar\Settings.ini

 

[cottonball]

Do you have a GoDaddy account?

 

[Rogue Bolo]

Settings.ini

Check C:\Program Files\Windows Sidebar\Gadgets\
and post C:\Users\Ron\AppData\Local\Microsoft\Windows Sidebar\Settings.ini

Kaktussoft
Settings are attached as a text file. Thank you in advance.

copied from my directory; (C:\Users\Themorn2112\AppData\Local\Microsoft\Windows Sidebar)

 

[Rogue Bolo]

Cottonball

Do you have a GoDaddy account?

NO, I don't have any account with this organization.

 

[Kaktussoft]

Check C:\Program Files\Windows Sidebar\Gadgets\
and post C:\Users\Ron\AppData\Local\Microsoft\Windows Sidebar\Settings.ini

Kaktussoft
Settings are attached as a text file. Thank you in advance.

copied from my directory; (C:\Users\Themorn2112\AppData\Local\Microsoft\Windows Sidebar)

You think one of the gadgets is causing the problem? Disable one by one. Now you know witch one is causing the problem.

 

[Rogue Bolo]

copied from my directory; (C:\Users\Themorn2112\AppData\Local\Microsoft\Windows Sidebar)[/QUOTE]
You think one of the gadgets is causing the problem? Disable one by one. Now you know witch one is causing the problem.[/QUOTE]

Kaktussoft,
I don't think the problem is within the gadgets themselves, but I suspect a code that is buried in the gadgets folder. I made no changes or additions to the gadgets themselves.

 

[Kaktussoft]

copied from my directory; (C:\Users\Themorn2112\AppData\Local\Microsoft\Windows Sidebar)

You think one of the gadgets is causing the problem? Disable one by one. Now you know witch one is causing the problem.[/QUOTE]

Kaktussoft,
I don't think the problem is within the gadgets themselves, but I suspect a code that is buried in the gadgets folder. I made no changes or additions to the gadgets themselves.[/QUOTE]
Make a copy of AppData\Local\Microsoft\Windows Sidebar\settings.ini

Now disable all your gadgets, logoff and logon. Still problems? If not: enable the gadgets one by one to test.

After testing you can put back the original settings.ini. Now all gadgets are back again (after logoff/logon). Now uninstall the problem gadget or never use it again.

 

[cottonball]

Rogue Bolo,

Have you conjsidered disabling Sidebar/Desktop Gadgets in Windows 7 altoghether:
Disable Sidebar / Desktop Gadgets on Windows 7

Microsoft tells customers to disable Windows Sidebar, Gadgets - Technology on NBCNews.com

 

[Rogue Bolo]

Problem found

Rogue Bolo,

Have you conjsidered disabling Sidebar/Desktop Gadgets in Windows 7 altoghether:
Disable Sidebar / Desktop Gadgets on Windows 7

Microsoft tells customers to disable Windows Sidebar, Gadgets - Technology on NBCNews.com

Cottonball/kaktussoft,

Kaktussoft,
I have found the problem following your suggestion. The problem seems to be in one of my gadgets (181.fm) that is no longer supported by the internet radio website, but I have kept because it still plays one of music genre that I enjoy listening to. I suspect that because it is no longer supported, that goDaddy is sending out this pop up in search of someone or entity to buy this domain name. I deleted this gadget and installed a recently posted version from 181.fm (Radio 181.fm - Windows 7 Desktop Gadget), with the result being that the pop up reappeared. I have removed this gadget seeing that I found another one that plays comparable music (despite the size of the gadget being too large for it to fit with the rest of my gadgets in my sidebar).

Cottonball,
I just seen a similar article on a different forum ( Microsoft urges Windows Vista, 7 users to disable desktop gadgets - TechSpot ), Now that I know the source of my issue, and a possible cause, I am reasonably certain that my PC is secure with the firewall and antivirus protection that I use.

Thank you all for your assistance. Cottonball, Kaktussoft have been invaluable in helping me resolve this issue.