Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Is cm.g.doubleclick.net spyware/adware or a Google cookie matcher or both?


  • Please log in to reply
2 replies to this topic

#1 leon_redfield

leon_redfield

  •  Avatar image
  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:05 PM

Posted 24 May 2013 - 09:19 AM

Hello everyone. I apologize for not being an active user, but I always read the forums whenever a problem arises. However, I'm very confused at this point and was hoping to receive some help. This is a lenghty description, so I apologize in advance. I'll have a "too long, didn't read" at the bottom lol.

 

On my Windows 7 laptop, I use IE9. Now whenever I visit www.gamefaqs.com, (which I've been going to for years, a legit site about gaming) there will be times as I browse through that I all of a sudden have a new window opening attempting to navigate somewhere. However, my anti-virus, Norton Internet Security 2013, apparently blocks it as the windows always show "Navigation Canceled." But I wondered why do these windows come up sometimes, (and it's only on gamefaqs).

 

The URL of the blocked windows begin with "cm.g.doubleclick.net" and gives off more random characters. Curious, I looked it up. So the cm.g.doubleclick.net has a positve review from Norton Safe Web and Webutaion, (which shows rating from Norton, MyWOT, etc.) however reviews from users on Norton Safe Web says it's a spam site which makes sense. However, I came across two things researching this.

 

The first is that "cm.g.doubleclick.net" is a Google thing that they do something with IE9 to where they get ads in and it's a cookie matcher, (hence the cm) to match your browsing and what not. Ok, seems like nothing I can do since it's an IE9 issue? On another laptop which uses XP and IE8 there is no problems. However, I used a Desktop with Vista and IE9 on it, went on GFAQs to see if I get any pop ups and nothing.

 

The second thing I read about cm.g.doubleclick.net is that it's spyware which also makes sense. But my Norton never stopped it. I read that Spybot can remove this and after looking up Spybot, stupid ol' me downloads it and uses it. Well it was a legit download and it didn't find anything, but I feel dumb for using it, (now more research I did says Spybot isn't good at all).

 

Norton Internet scan finds nothing, did a Norton Power Eraser and it found nothing, and I used a tool from symantec, (http://www.symantec.com/security_response/writeup.jsp?docid=2008-091809-0911-99) to also scan the rootkit and it found nothing...so what is cm.g.doubleclik.net?

 

Also, would a System Restore remove Spybot? I did it, but I noticed that there's still a folder under Program Files called Spybot Search and Destroy 2 and it has files within it. If I deleted this folder would Spybot be completely removed? I don't see it under "Uninstall Program," I don't have an .exe file, and I checked the registry for "spybot" keywords and it found nothing. Seems like it's just this folder, but I'm not sure. If that folder remained after a System Restore, I wouldn't be surprised to have others. This folder contains the files Spybot uses to check for malware, so I'm kind of upset I have these files on my computer now.

 

I'd appreciate any help.

 

TL:DR;

-What is cm.g.doubleclick.net, (cookie matcher Google uses in IE9 or spyware/malware)

 

-how do I get rid of it, (Norton Internet Security, Norton Power Eraser, Symantec Rootkit scan, Spybot finds nothing)

 

-it only happens on gamefaqs.com, (a legit site I've used for years)

 

-and how do I make sure Spybot is completely removed, (did a System Restore instead of "Unintsall Program" and now under "Uninstall" there is no Spybot, registery had no Spybot keywords, but there is a folder under Program Files names Spybot with the files it uses in it)

 

-I'd appreciate any help

 



BC AdBot (Login to Remove)

 


#2 DasNasty

DasNasty

  •  Avatar image
  • Members
  • 19 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:05 PM

Posted 25 May 2013 - 11:35 PM

Hey leon, and welcome.

 

There's a 99% chance you have something, because getting a popup to a suspicious link is a staple of many forms of malware.  Chances are, it's a newer form of malware that Norton doesn't have a signature of in its database; hence, why it can't pick it up.

 

A few questions:

  • Have you tried to clear all cookies and empty the cache?
  • Do you visit any other sites on a regular basis?
  • What sorts of things are in the popup?
  • Do you have a pop-up blocker or an ad blocker?

Here's something for you to do to help some who isn't me knows what they're doing:

 

Download Security Check from here or here and make sure you either save it to the Desktop or a folder you can easily remember.

  • Double click SecurityCheck.exe, and follow the directions in the black box.
  • At the end of the scan, a Notepad document named checkup.txt should appear.  Copy and paste all of the contents here as-is (or save the file into a non-temporary folder, such as your Documents folder)
  • NOTE: If your security application requests permission for DIG.EXE to access the internet, give it permission to do so.
  • Do not take any other action based on the log, since it does give false positives.  Wait for further assistance.

You should be able to remove Spybot just fine by deleting the folder.  However, if it keeps popping up, ne t'inquiete pas.  Chances are in later steps it will be a thing of the past by proxy of removing this malware.



#3 noknojon

noknojon

  •  Avatar image
  • Banned
  • Member rank image
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:05 AM

Posted 26 May 2013 - 12:10 AM

Hello -

Please post the report from 317Security Check listed above -

 

Next : Please download AdwCleaner to desktop.
Temporary disable your Antivirus while the program runs
Close all other running programs including your browser, as your computer will be rebooted after the scan.
Double click on the AdwCleaner icon to run the program
Vista or Win7 users Right click and select Run as Administrator

Select DELETE from the menu
Confirm with OK when asked.
A logfile will be produced after the reboot, please post it back here -

 

Next : Download Junkware Removal Tool
Again temporary disable your Antivirus while the program runs, just to avoid conflicts
Double click on the new icon to start the program
Vista or Win7 users Right click and select Run as Administrator

Follow the directions in the Black box and the program will run
Your computer will not be rebooted as above, but a logfile will be produced
Please post it back here -

 

Make sure you enable your Antivirus when completed

 

Thank You -

 

Just for information, doubleclick.net is usually regarded as Adware / Tracking Cookies, not a bad infection, and can be removed with these programs, or if you have SUPERAntiSpyware free installed, this will usually clean out any remains.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users