Recommended For You

From what you have described this is not malware and is an ad from the site you are visiting.

Noscript is probably the best solution unless someone else of another add-on to stop these.

It appears on almost every web site I visit including Sophos.  I'll send a screen shot of this on the Sophos web site if someone can tell me how to attach an image. (When I click the "insert Image" button it asks for a URL - is it possible to attach a file?)

Hello PHB,

is it possible to attach a file

only if it's very small (<10k), best option is to upload it to some image sharing site (e.g ImageShack or Dropbox) and include the URL.

Christian

DropBox - very cool

Here is the screen shot showing my problem.  The ad in the lower right slides up when I open a page & I can't scroll away from it.

Anybody?

Anybody?

I have the exact same problem...no solution yet.

Hi,

I assume that it's some sort of redirect using the host file, probably for any site using Google Analytics.

If you look in you host file, does it have a bunch of entries?

If so, take a backup of the hosts file and reset it as per:

http://support.microsoft.com/kb/972034

If there is still some active component on the machine reverting the file you might have to do more but this is a start.

Regards,

Jak

This is what is in my "hosts" file - does it look wrong?:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost

Hi,

That looks fine, I was hoping that might be a quick fix.  Searching for 

"Recommended For You" adverts

on Google reveals a few people with the same symptom, some of those posts might help.  

For example, this might help, you:

http://www.bleepingcomputer.com/forums/topic449801.html/page__p__2662588#entry2662588

If that doesn't help, the most efficient method to handle this sort of thing is probably to give Support a call so they can obtain all the info off the machine.  They may need to run a number of tools to see what's going on.

If I had the problem infornt of me I would use the following tools:
 

Autoruns:

http://technet.microsoft.com/en-us/sysinternals/bb963902

Process Explorer:

http://technet.microsoft.com/en-us/sysinternals/bb896653

Process Monitor:
http://technet.microsoft.com/en-us/sysinternals/bb896645  

to work out what is taking place to cause the symptoms you describe.  Between them you should be able to track down how it's operating.

Regards,

Jak

"For example, this might help, you:
http://www.bleepingcomputer.com/forums/topic449801.html/page__p__2662588#entry2662588 "

Wow that looks like a day long project.  Maybe I will try calling Sophos