Purity Scan - Pop Up ads from Hell!

[Bagelfather]

I had a problem with pop ups that infested my computer like the plague recently after going to a tickling website. I don't think the site was responsible, I am sure some other ad popped up and was clicked on at some point where I could not notice, and thus I was infected with Purity Scan.

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Systems Not Affected: DOS, Linux, Macintosh, Microsoft IIS, OS/2, UNIX, Windows 3.x

This adware application needs to be manually installed. However, there are several known programs that have Adware.Purityscan inside of them and install it as the program itself is installed.

"Clickspring offers an affiliate program that pays
Webmasters to get people to run the program, which may
provide incentive for sites to attempt to load it in a
dishonest manner."

I haven't tried the "uninstaller" you can get from Purity Scan but personally if you are comfortable playing with your registries and can make a backup I would do so manually rather than trust their automated systems.

Unfortunately spybot and adaware will not remove this insidious pest.

Here is a guy who has posted threads on the subject and other people's experience in removing it:

http://www.psychicfred.com/clickspring.htm

Here is the symantec website which instructs how to remove it.

http://securityresponse.symantec.com/avcenter/venc/data/adware.purityscan.html

It can hide under various names that you can see when you perform ctrl-alt-del to close a program. Here are variants I have researched:

wtssvsu (the one that I had)
wintsu.exe
wnsintsv.exe
wcpsu.exe
wtssvsu.exe
wapisvcc.exe
wtstr.exe
wtssu.exe
wnscpsv
wnsinttr.exe
wtssvcc.exe
wapisvtr.exe
wintsvsu.exe
winsintit.exe
wnsapitr.exe
wcpsvit.exe
wnscpcc.exe
wtssvcc.exe

From one poster named Mark

"PurityScan is a program distributed by Clickspring LLC, an
advertising company. Its stated purpose is to scan your
computer for hidden pornographic materials and allow you
to remove them.

Upon first loading, PuritySCAN (often named PuritySCAN.exe
or sear1.exe) will scan your IE files (browser cache,
history, and cookies) for occurances of "dirty words"
relating to pornography. (To avoid getting myself branded
as a porn site, the list of words will be left to the
reader's imagination.) The program will then display a
list of any files found to contain the words. It will also
drop a copy of itself in the Windows StartUp folder
as "WINSERVS.EXE". This copy will load at start-up and
spawn massive quantities of large popup ads when the user
is online. On our test installation, the parasite spawned
14 popup windows in a 45-minute idle period, averaging one
popup every 3.2 minutes."



Before you go messing with your registry ALWAYS make a backup!

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617?OpenDocument&src=sec_doc_nam

If you delete the wrong file you can cripple your operating system! So be very very careful! My advice is to find someone who is experienced at this (if you are not computer savy enough) and buy him/her dinner in exchange for this favor.

Does anyone else have any experience in this area? This and a few other things caused some serious system problems which nearly crippled my computer while I was trying to find out what was going on.

 

[TKpervert]

Thanks for the list, I'm going to try to feed it to XP's search program and see what happens.
When I go cruising the net, I run I.E. on high security which disables activex and javascript.
If a site refuses to work with those disabled, you probably don't want to be there anyway.

 

[steph]

I'm not sure if you download screen savers but if you do, be careful. One of the gals at work always had these great ones but was getting pop ups even when she WASN'T online--it was a huge pain in the ass.

So she called help desk, they came and decided that was the problem--apparently lots of these things contain some kind of bug that infects the system. Don't know if it helps but there ya go...

XOXO

 

[Limeoutsider]

All p[op up ads are from Hell, what are you talking about?

 

[TKpervert]

If a website's programmer wants to be a dickhead, he can imbed 'onUnload' javascript in a web page which effectively disables the back button and the X in the upper righthand corner. Meanwhile he's opening more windows in rapid succession. Even ctrl-F4 can't keep up with this. You're stuck.
If you're able to bring up Windows task manager, sometimes you can kill the browser and start over.
Otherwise it's power off and reboot.

 

[ticklygirl]

Try this nice little pop up remover:
cwshredder at
http://www.spywareinfo.com/~merijn/cwschronicles.html
its safe and fast