Question about evil spywareFollow

A couple of the things that I do when cleaning up Spyware on a PC:

Turn off cookies until the PC is completely clean of spyware.
Clean up the registry manually after the spyware removers are done
Look for anythng that is installed that either is spyware or invites spyware.

These things always seem to help. Admittedly, I haven't had to clean up my own PC in over a year at home or ever at work, so I'm not nearly up to the latest tricks.

There are lots of people out there who will answer questions about specific items you're unsure about from a HJT log, as well.

I tend to google anything I'm not 100% sure on. Pretty much everything under the sun is already answered if you look.

First,
Boot into Safe Mode.

Find Temp folder and delete the contents, also Temporary Internet Files.

I am not familiar how FireFox works, cause I've never had a SPyware problem with it.


Now,

Now, go to the Control Panel, and then Add Remove Programs and remove anything talking about "Toolbar" this or "Shopping" that, or "Internet enhancer" or any crap that is spyware. you can see wehn the stuff was installed.... BE CAREFUL that you don't remove any important Windows Components.. like "Hotfixes" Leave those alone.
Be careful


Now.

If you can, do another Spyware scan using this:
http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en (if you have a legit copy of Windows.)


You will prolly have to boot into Normal mode to install and run scans.

Remember.. Spyware and Viruses are two differnt things.
YOu CAN HAVE more than one Anti-Spyware softwares on your PC. They may find each others quarantine folders.. but no matter.
You should only have ONE anti-Virus software. YOu said you have Norton's. I think Norton's is the best(for common use).


So after removing waht you can manually, Run those Spyware Scans...

You MAY have to do it many times.


IF you do have an actual Virus.. and your Norton's is Updated, then scan your PC. NOrton's should work on finding everything.

SOME Viruses require you to have to turn off system restore to get rid of, otherwise it will keep reappearing.
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam
That is how you do that..

IF you need to do it...

GOOGLE anything that you can't seem to get rid of, and see how somone else got rid of it.




DISCLAIMER:I bare no responsiblilty no matter how badly you fu[b][/b]ck your computer up messing with it Be careful waht you delete, Google it if you're not sure


Needed somthing to type whilst holding in some bingers






Edited, Thu Nov 17 20:59:00 2005 by Kelvyquayo

UH

Yeah, if you don't want any of your files, or programs, or data.

doesn't work that way anyway

Edited, Thu Nov 17 21:08:19 2005 by Kelvyquayo

Blix, you would have needed a restore point that is not "infected".

The default "Restore Point" is from before anything was installed.

unless I'm wrong, I've never used the ****...

Try it then. Let me know.

System restore has NEVER worked for me.

System restore has never worked for me in the spyware department. It has worked for me when my computer has suddenly started doing something unexplanable and scary that I can't figure out, and I'll use that as a last resort. It usually works then, and I go *whew*.

ok long drawn out responce here and a major flame on your husband who was STUPID enough to think you do not need protection from malware (this includes spy/ad/and viruses) when you are running a Microsoft Windows platform and connected to the internet.

list of programs i sujest:

1. Adaware
2. Spybot
3. Spywareblaster (all one word)
4. MS Beta anti-spyware
5. AVG or Antivir or F-Prot (F-prot is not free for windows)

first things first turn off automatic backup in the advance settings of My Computer Properties. this may require a reboot.

After that, use msconfig and kill every starting application that is NOT part of the OS or a driver for sound or video. this includes your antivirus software for NOW. that setting is not perm. you will reactivate the antivirus software at a later time.

go to your internet settings and tell IE to change its homepage to the following URL:

http://www.trendmicro.com/home/default.asp

then open IE and go to your new homepage. run their FULL SYSTEM scan to include spyware scanner. depending on your connection, power of your system, and amount of files to be scanned this can take up to 4+ hours. be ready to go eat during this scan.

If it is clean, then you are ok, odds are you will not be clean, alow for trendmicro to automatically clean your system.

depending on what viruses are installed will depend on how much more work you have ahead of you. if you have some of the nastier ones that hack your antivirus and antispyware software you will be lucky if you can even get to the above URL. if you can not get to the above URL, you are just better off losing ALL data on that computer, formatting and starting over from scratch.

if you are to this point and have the system clean enough to install from fresh your antivirus (see above program sujestions) then you are getting closer to being home free, so to speak.

install your antivirus software and run its updater to get the latest virus definitions (commonly known as .dat files) and run a full deep system scan and have it automatically clean your system. again this could take from a few min. to several hours depending on the software used, the amount of data to be scanned, and the power of your system.

if you are finnaly clean after both of those scans then it is time to start installing from scratch the above anti-spyware tools in the order they are listed.

if you have a USB stick drive you can put all of the software that will speed things up, if not just burn them out to a CD. down them from a clean system not from the infected system.


--------------------------
BIG SIDE NOTE: IF HE IS NOT CLEAN AFTER THE TRENDMICRO SCAN, BUT IS DURING THE FRESH INSTALL OF YOUR ANTIVIRUS SOFTWARE, RUN TRENDMICRO AGAIN and mark what is not cleaned from the system for manual removal. just google for the virus name and cleaner:

example: lovebug cleaner

that should give you a well known place to get a tool and instructions to clean your system manually.

--------------------------

install and run the above listed antispyware tools in the order they are listed 1 at a time. each tool on its own is good, but when you combine them they are really powerful. *note* the spywareblaster is not a cleaner, but a, without getting to technical, black list of known malware URLs that it prevents from getting into your system. the reason for running the MS beta tool last is it SUCKS a$$ at finding a lot of malware out there, but is great for reducing the odds of new malware from getting into your system.

after all of that is done there are a few more things you need to do.

1. go to windowsupdate.microsoft.com and make sure you are 100% updated for ALL critical and security updates for your OS.

2. this is the ONLY time you should use IE from now on.

3. use Firefox, Opera, or any of the other more secure and faster patched browsers on the market that are also more compliant with the WWW RFCs. IE is one of the worst when it comes to com;liance with xml, html, and many other WWW codes.

4. if you are using Outlook or Outlook express and not connected to an Exchange server stop using them NOW. go grab Thunderbird or any of the other again more secure and faster patched e-mail clients on the market. avoid eudora too as it is just as buggy and insecure as both Outlook and Outlook express.

the only reason for using Outlook is if you are connected to an Exchange server and that means for WORK only. keep it seperate from your personal e-mail and never use your work e-mail to sign up for anything online.

now that you have your system semi locked down and some better software running to protect it follow some of the basic security rules to protect you from furture major infections.

*note* now is the time to go back to msconfig and make sure your NEW antivirus software is active to run at startup. nothing else should be running except the tools and drivers you tell it to be running. this will also speed up your boot up times and increase the performance of your system.

1. do not just install everything you see on the web.

2. be very careful about were you click a link to from an e-mail.

3. NEVER NEVER NEVER open an attachment from someone you were not expecting an attachment from. delete it and ask them to send it again. if they really did send it then no biggy if not be glad you deleted it and tell them they have a virus on their system.

4. NEVER run with administrator privleges. if an applications needs administrative rights to run, then you can manually configure that application to run with permission of your user.

sadly in Windows this is almost never followed and even when it does it matters little as MS has not the foggies clue at how to really lock down the OS with user level rights.

5. run daily scans with antivirus and antispyware tools on your system. keep them updated and check for updates at least 1 time a day if not MORE.

i know that with both AVG and Antivir they could update as many as 4 - 10 times a day depending on how bad thing are on the net at that point in time. this is not true with symantic or mcaffee as their home user mods only update 1 time a day at max. even their corp. (enterprise) editions do not update as often as they should.

if you chose to run Firefox, here are 2 extensions i highly sujest to help cut down on even more stuff from getting into your system and gives you a way to track what web pages, allah for example, have adds that install malware.

NoScript

and

Adblock

the first one creates a "white list" that you have to tell it that it is OK to run that script from this domain. example is if you have yahoo mail. then you will want to allow the yahoo domain, but not any of the other scripts they have running as they are from places like blank blank and doubleclick, both very nasty malware domains.

the second alows you to creat a "black list" of what ever you do not want to see. example:

http://whatever.com/ads/advertisement

you could use the adblock extention to block out the:

http://whatever.com/ads

and any item that has that URL in it is blocked from opening in FF. this also speeds up browsing as you are no longer waiting on 3rd party URLs to open up their advertisements.

example:

you are browsing on http://www.whatever.com and they have an add from http://www.doubleclick.net and it is taking a long time to load. if you have adblock set to block the doubleclick.net then it will never load and will speed up the time it takes to load that page as that portion of the page code is just ignored by the browser and thus doubleclick.net never gets to run on your system making it safer and cleaner.

also do not keep a long cache of web pages and graphics. clean your cache at least 1 time a week if not daily. this way if something sneaks past your protections and is resident in the cache but not really any place else you will remove it.

a lot of 3rd party cookies are like that.

on the line of cookies NEVER ALOW 3rd party coookies. all browsers from IE 6.0 and newer (just an FYI, opera, mozilla, firebird(predisesor to firefox) and just about every other browser on the market had this tool for 2-4 years before IE 6 was released) have an option to control 3rd party cookies. make sure they are NEVER alowed in your computer.

3rd party cookies are cookies (data gathering bits of software) from some domain other then the domain your are currently browsing.

example:

you are here at allakhazam.com and doubleclick.net wants to install a cookie on your system. if you do not have cookies disabled (then you could not post here if that were the case) and you have not set IE to block 3rd party cookies then doubleclick.net can do what ever it wants thanks to the BS security that is Microsoft Windows. IIRC the default for FF is to not alow 3rd party cookies, but that is one of the first things i do before i go to any web page other then my personal domain as i have zero cookies there. i know, i coded it.

with the change in software, modifiing your browsing habbits, modifiing the user level permissions, and running the daily scans you should see fewer and fewer bits of malware on the system.

best of luck

And you aren't a very savvy kind of gal.