# Root of These Pop-Ups? (See Inside)

**URL:** <https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624>\
**Category:** Factual Questions\
**Created:** [August 26, 2004, 5:06pm UTC](https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624 "2004-08-26T17:06:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jinx](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@Jinx](https://boards.straightdope.com/u/Jinx)\
**Post date:** [August 26, 2004, 5:06pm UTC](https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624/1 "2004-08-26T17:06:44Z")

</div>

I have a pop-up blocker, and it can be diabled for a moment in order for me to click on legitimate links. While doing so, I was hit by an almost endless stream of pop-ups warning me about spyware. (Window after window after window…) Once under control, it seemed any window I opened then after would trigger a similar response. (Have you experienced this, too?)

I suspected some executable file got installed on my PC. I then used MacAfee Virus scan to locate/identify any rogue files. It did find ossproxy.exe as a suspicious file, but it cannot be deleted! Is anyone aware what this is? Is this the culprit? And, can it be disabled, if not deleted? I did “quarantine” with Macafee, but I am unsure what this does, exactly!

(If it helps, the path for the suspicious file was C:\WINNT\System32\ossproxy.exe)

Any info you can provide would be of great help.

Thanks,

- Jinx

---

<div class="post-metadata">

**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\
**Post date:** [August 26, 2004, 5:35pm UTC](https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624/2 "2004-08-26T17:35:09Z")

</div>

[sysinfo.org](http://sysinfo.org) has this entry:

> [@](#):
>
> Part of Nettsetter - a “market research” program intended to track your Internet usage and buying habits. To remove click on Start -\> Run and enter “%WinDir%\SYSTEM\NSCheck.exe /uninstall” (where %windir% is the Windows directory - C:\Windows or C:\Winnt) followed by enter - this removes all registry entries and a box appears saying "uninstall successful. Find and delete the files nscheck.exe, ossproxy.exe.rvt & ossproxy.exe

It looks like this is relatively easy to uninstall. Of course, it may not be the only problem you’re having.

---

<div class="post-metadata">

**Author:** ![Dragwyr](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dragwyr/32/2855_2.png) [@Dragwyr](https://boards.straightdope.com/u/Dragwyr)\
**Post date:** [August 26, 2004, 7:09pm UTC](https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624/3 "2004-08-26T19:09:11Z")

</div>

Does a reboot of your system clear this up?

---

<div class="post-metadata">

**Author:** ![Fuji\_Kitakyusho](https://avatars.discourse-cdn.com/v4/letter/f/f0a364/32.png) [@Fuji\_Kitakyusho](https://boards.straightdope.com/u/Fuji_Kitakyusho)\
**Post date:** [August 26, 2004, 7:20pm UTC](https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624/4 "2004-08-26T19:20:28Z")

</div>

Just in case this is relevant, many anti-virus programs, as well as spyware/adware removers such as “Ad-Aware” or “SpyBot: Search and Destroy” will not find the offending targets unless they are run in Windows “Safe Mode”.

If you haven’t already done this, reboot into safe mode and run these programs from there.

---

<div class="post-metadata">

**Author:** ![Jinx](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@Jinx](https://boards.straightdope.com/u/Jinx)\
**Post date:** [August 28, 2004, 9:05pm UTC](https://boards.straightdope.com/t/root-of-these-pop-ups-see-inside/261624/5 "2004-08-28T21:05:04Z")

</div>

Thanks for the advice. Good info to keep handy when the pop-ups just won’t be stopped-up! - Jinx