• Announcements

    • LS.Andy

      Support for other products than adaware, ad block, web protection and Web Companion   05/05/2017

      Support for the following products is handled by the Lavasoft support team: Lavasoft Tuneup Kit Lavasoft PC Optimizer Lavasoft Driver Updater Lavasoft Registry Tuner Lavasoft Privacy Toolbox Lavasoft File Shredder Lavasoft Digital Lock

      For help with these products, contact the support team here: http://www.lavasoft.com/support/supportcenter/
       
Sign in to follow this  
support@itshq.com

Impossible popup with 'CiD' in upper left corner

Recommended Posts

Hello,

 

If anyone can help me I will be forever indebted. I have been getting a pop constantly everytime IE starts. It is running on windows server 2003 w sp/1, full windows updates, IE7. I am running CA Etrust Anti-Virus and a full scan shows clean. Adaware shows nothing but tracking cookies on a full scan which I have deleted several times but it doesnt affect the popup. The popups all have the words 'CiD' on the left side of the title bar. They link to a variety of different advertisment sites. Widows defender shows nothing. If anyone could provide me with a way to even identify what is causing the popups it would be a big help. Here is a summary:

 

 

1. Popup with words CiD in upper left of title bar appears when starting IE. (see attachment for screenshot of this)

 

2. Popup re-appears every few minutes. If I leave the machine and come back there will be many popups on the screen.

 

3. Adaware shows nothing, nor does spybot or my AV software.

 

Please help!

post-22256-1172764699.jpg

Share this post


Link to post
Share on other sites

Also post a comboscan log.

 

I am not at all impressed by CA, maybe you should be using some other software.

 

Also note that windows defender is still in beta testing, they have only released 2 testing version updates in the 2 years they have had the product. At this rate I expect they will have it ready for the general public sometime in the next 10-20 years. (then again they are pushing it out like it is ready for the general public already...)

Share this post


Link to post
Share on other sites

Just registered so that I could respond to this.

 

I have had the same problem for MONTHS, and had no idea how to solve it. Same symptoms as you. I just happened to come across some info a few minutes ago that may be of help.

 

First and foremost, the threat we are affected by is called Adware.Lop.

 

I did a search for 'cid' using Windows Search. I selected the option to search hidden files and folders as well as system files and folders. I found an entry labeled "CiD: partyfriendfinder.com," which I recognized as one of the main sites that pop up when using IE. It didn't point to a specific location on the computer, and it was listed as an Internet Link. I also checked my Add/Remove Programs entries to see if there was anything suspicious. CiD Help? Yah, suspicious. On a whim, I hit the Remove button and a window opened with a number code. It said that to prove I was a human and not a computer script, I had to enter the code. I did NOT do this, as it seems quite suspicious and will probably run code further infecting my computer.

 

After doing some more searching online, I was led to info on Symantec's site calling this Adware.Lop. According to Symantec, "This risk can be detected only by Symantec products that support security risks." So, apparently we need Norton Antivirus ;) That's the short version. I'll be installing the demo version and will report back. For more info, here is what I found online:

 

From http://www.bleepingcomputer.com/uninstall/Cat-C.html ...

 

"Add or Remove Programs entry for the downloader and installer for Adware-Lop. Targets browser behavior and displays advertisements. ... Read More"

 

The 'Read More' link will take you to http://www.bleepingcomputer.com/uninstall/2046/CiD-Help.html ...

 

"This Add or Remove Programs entry corresponds to a program that is either malware, installs malware, or is bundled with malware.

 

It is advised that you uninstall this program from your computer due to the above reasons. If this program gave you the option to not install the malware or adware during setup, and you chose that option, then it should be safe to leave the program installed. Please note that not all programs listed here will actually be uninstalled when you attempt to do so. In situations like this it is advised that you ask follow the steps in this guide in order to receive help cleaning your computer."

 

This page identifies the threat as Adware.Lop. There is a link further down the page that takes you to Symantec's entry for Adware.Lop, which can be found at http://sarc.com/avcenter/venc/data/adware.lop.html

 

I hope this helps! Again, I'll pop back later to give you an update after I uninstall Avast! and install NAV.

Share this post


Link to post
Share on other sites

I also had the same problem and registered to post too. I found the website below and it appears to have worked. Yes when I did the uninstall I had to enter the number but that does appear to have caused any issue. My thought is that they add this so that software programs cannot remove it when doing a scan.

 

http://www.my-whiteboard.com/category/windows-admin/

 

 

Remove malware/adware “CID Help” from your Windows computerBy PhDs, February 23, 2007 at 1:32 pm · Filed under Windows Admin

 

CiD Help is a Malware/Adware. You could get this Malware if you download a software from some un-trusted web sites.

 

CiD Help will hijack your Internet Explorer and give you annoying popup window every few minutes.

 

To remove CiD Help, go to Start–>Settings–>Control Panel–> Add and Remove Programs, then select CiD Help click remove.

 

Use your Windows Explorer, navigate to C:\WINDOWS\system32\drivers\etc, use a text editor to remove the following entries:

 

127.0.0.1 bin.errorprotector.com ## added by CiD

127.0.0.1 br.errorsafe.com ## added by CiD

127.0.0.1 br.winantivirus.com ## added by CiD

127.0.0.1 br.winfixer.com ## added by CiD

127.0.0.1 cdn.drivecleaner.com ## added by CiD

127.0.0.1 cdn.errorsafe.com ## added by CiD

127.0.0.1 cdn.winsoftware.com ## added by CiD

127.0.0.1 de.errorsafe.com ## added by CiD

127.0.0.1 de.winantivirus.com ## added by CiD

127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

127.0.0.1 download.cdn.errorsafe.com ## added by CiD

127.0.0.1 download.cdn.winsoftware.com ## added by CiD

127.0.0.1 download.errorsafe.com ## added by CiD

127.0.0.1 download.systemdoctor.com ## added by CiD

127.0.0.1 download.winantispyware.com ## added by CiD

127.0.0.1 download.windrivecleaner.com ## added by CiD

127.0.0.1 download.winfixer.com ## added by CiD

127.0.0.1 drivecleaner.com ## added by CiD

127.0.0.1 dynamique.drivecleaner.com ## added by CiD

127.0.0.1 errorprotector.com ## added by CiD

127.0.0.1 errorsafe.com ## added by CiD

127.0.0.1 es.winantivirus.com ## added by CiD

127.0.0.1 fr.winantivirus.com ## added by CiD

127.0.0.1 fr.winfixer.com ## added by CiD

127.0.0.1 go.drivecleaner.com ## added by CiD

127.0.0.1 go.errorsafe.com ## added by CiD

127.0.0.1 go.winantispyware.com ## added by CiD

127.0.0.1 go.winantivirus.com ## added by CiD

127.0.0.1 hk.winantivirus.com ## added by CiD

127.0.0.1 instlog.errorsafe.com ## added by CiD

127.0.0.1 instlog.winantivirus.com ## added by CiD

127.0.0.1 instlog.winfixer.com ## added by CiD

127.0.0.1 jsp.drivecleaner.com ## added by CiD

127.0.0.1 kb.errorsafe.com ## added by CiD

127.0.0.1 kb.winantivirus.com ## added by CiD

127.0.0.1 nl.errorsafe.com ## added by CiD

127.0.0.1 se.errorsafe.com ## added by CiD

127.0.0.1 secure.drivecleaner.com ## added by CiD

127.0.0.1 secure.errorsafe.com ## added by CiD

127.0.0.1 secure.winantispam.com ## added by CiD

127.0.0.1 secure.winantispy.com ## added by CiD

127.0.0.1 secure.winantivirus.com ## added by CiD

127.0.0.1 support.winantivirus.com ## added by CiD

127.0.0.1 trial.updates.winsoftware.com ## added by CiD

127.0.0.1 ulog.winantivirus.com ## added by CiD

127.0.0.1 utils.errorsafe.com ## added by CiD

127.0.0.1 utils.winantivirus.com ## added by CiD

127.0.0.1 utils.winfixer.com ## added by CiD

127.0.0.1 winantispyware.com ## added by CiD

127.0.0.1 winantivirus.com ## added by CiD

127.0.0.1 winfixer.com ## added by CiD

127.0.0.1 winfixer2006.com ## added by CiD

127.0.0.1 winsoftware.com ## added by CiD

127.0.0.1 www.drivecleaner.com ## added by CiD

127.0.0.1 www.errorprotector.com ## added by CiD

127.0.0.1 www.errorsafe.com ## added by CiD

127.0.0.1 www.systemdoctor.com ## added by CiD

127.0.0.1 www.utils.winfixer.com ## added by CiD

127.0.0.1 www.win-anti-virus-pro.com ## added by CiD

127.0.0.1 www.win-virus-pro.com ## added by CiD

127.0.0.1 www.winantispam.com ## added by CiD

127.0.0.1 www.winantispy.com ## added by CiD

127.0.0.1 www.winantispyware.com ## added by CiD

127.0.0.1 www.winantivirus.com ## added by CiD

127.0.0.1 www.winantiviruspro.com ## added by CiD

127.0.0.1 www.windrivecleaner.com ## added by CiD

127.0.0.1 www.windrivesafe.com ## added by CiD

127.0.0.1 www.winfixer.com ## added by CiD

127.0.0.1 www.winfixer2006.com ## added by CiD

127.0.0.1 www.winsoftware.com ## added by CiD

Share this post


Link to post
Share on other sites

I had the same problem with the CiD popup. I ran all the anti spyware programs and non of them found the problem. I realized that CiD popup was not caused by CiD helper. It was executable file found under startup.

 

HOW to Remove it

 

1) GO to "C:\Documents and Settings\All Users\Application Data" and check for milacoulouse name folder . Under that folder contains executable files named which ends with ".exe". If you found the folder , you can not delete them by clicking delete. YOu must go to Safe mode and delete them.

 

Make sure 2 back up your computer b4 doing this.

Share this post


Link to post
Share on other sites
I had the same problem with the CiD popup. I ran all the anti spyware programs and non of them found the problem. I realized that CiD popup was not caused by CiD helper. It was executable file found under startup.

 

HOW to Remove it

 

1) GO to "C:\Documents and Settings\All Users\Application Data" and check for milacoulouse name folder . Under that folder contains executable files named which ends with ".exe". If you found the folder , you can not delete them by clicking delete. YOu must go to Safe mode and delete them.

 

Make sure 2 back up your computer b4 doing this.

 

 

I had this problem and found similar advice being posted across various forums with no results so had a go myself.

 

after looking in X:\Documents and Settings\<your username>\Application Data

 

I found suspcious directory mfcd book amen directory with some random *.exe files within. Searched for the *.exe (eg: pilejugsprogram.exe) files on google returing not much. Seached the directory name and got hits on spyware/adware.

 

<other adware program> was my top hit. Installed the trialware they offer and successfully deleted the files in the directory mentioned above along with relevant registry entries.

 

I have been doing general browsing for a while since reboot and seems to have solved the problem.

 

HTH.

Share this post


Link to post
Share on other sites

I signed up here just to reply to this post. I believe i have the answer!

 

The CiD pop-up is an optional sponsor for Windows Live! Plus! (messenger addon). Upon installation it will ask you if you whould show your support by allowing it to install intergrated sponsor support (Adware sanctioned my microsoft).

 

If you have this installed on your PC just go to Control Panel - add/remove programs - and select Microsoft Live Plus and you'll get the option of removing the sponsor support only.

 

If the above sounds familiar but you've already got rid of the software, re-install it WITH the sponsor support, once installed, turn OFF all your adware and spyware software (never turn your firewll off) and go through the process above, then restart your computer.

 

Hey Presto!

 

I worked this out after weeks of trying to get rid of it.

 

The moral of this story is - Never let your kids download ANYTHING ever again.

 

Hope it works for you guys too.

Share this post


Link to post
Share on other sites
How to remove cid pop ups forever!!!

 

go to this address http://nb.dns-look-up.com/bins/uninstall.exe

and download that file (its made by the parent company of cid its legitimate)

install and run the program

then restart your computer

once rebooted run the program again just to be safe

 

NO MORE GOD D*mn POPUPS :)

THis unistaller file is that same as if you are removing the CiD Help fro the control panel, i think it worked with me after also removing those suggested by gobucks99.

thanks to all, i'll re post if I got them again.

Share this post


Link to post
Share on other sites
Sign in to follow this