Battle w/ Adware/Spyware/Malware/Hijack/Virus

[SailorAlea]

He made a mistake. It's not "TrendMirco" like he says,
It's "TrendMicro."

It's common for websites to make alternate ones, FULL of ads, with slightly different addresses. Like "Googel.com," etc. If someone makes a simple mistake, you get the fake site, and 10 pop ups. That's what happened.

 

[Deman]

There, I edited and fixed his typol.

 

[DiebytheSword]

Try running grisoft's AVG, it's a little better at crap detection than Norton.

 

[Guru_San]

ive got the same problem, like the other day i was playing TFC to find that it just minizmed half way through my game to display the pop up saying.. connect / work offline, everytime i cllicked work offline it would apear again creating a new IE window... i use AOL as my browser etc and i just HATE IE, if you click connect then you will get constant pop ups until the PC is off and there aint much i can do... so im formatting this fri.. with just over 4 gigs worth of crap to back up lol

-SaN

 

[SuperDragonFist]

iv got the same prob but im getting a new comp soon so ill just wait till then

 

[[SAS]Orion]

tried rolling back to an earlier system restore point if you have one?

 

[Mr. Satans]

tried rolling back to an earlier system restore point if you have one?

I disabled system restore a long time ago.

 

[Optional]

Everything in your task manager that is run by Sean Kiles (username) can be ended safely. I see some weird .EXE's running that I haven't seen before. Otherwise, I really suggest reformatting.

 

[Fire Phoenix]

=/ sorry about the typo, why don't you use mozilla fire fox if not that then you could try avant browser. thats nice too. does a lot of think mozilla doesnt support. the only problem with it is its not organized as neat as it could be.

if norton, ad-aware, and spy ware programs can't get rid of this thing, then how do you think you are going to get rid of it? really your only other option either restore (cant you turn it back on) or re-format.

 

[Mr. Satans]

Ugh! I have 8.4 GB of Music, 42.2 GB of Video Media, and about 10 GB of games >_<


Is there some way I could partition my drive so I could backup all my stuff and then reformat so I could have all my stuff without usign practically all my DVD discs to backup files?

 

[SaiyanPrideXIX]

Did that already, just forgot to say it in my post.

Not for nothing but if you steal all the anti-virus programs off of Kazaa chances are they don't work the same way as when you, you know, pay for them legitimately.

Dude...look at your desktop. Guarantee first of all that that copy of StyleXP isn't registered legit...Yahoo Messenger installs like four other stupid programs...I see a shared folder and Kazaa, duh, that's like eating a battery and expecting to feel great afterward. Not trying to show disrespect or anything dude but clearly there are any number of ways that **** could have gotten in.

Once you get a spyware it sucks cause then you get 650. Period. There's just not much one can do about it. I'd scope that peper virus, though; that's what it looks like.

Or you could do what my idiot friend did. He just stopped using IE and tries to pretend the popups are no big deal. lol

 

[Catman]

Close everything thats not supposed to be up that works for me perfectly i used to have that same problem untill i deleted the EXE

 

[Kurt`]

Do you use AIM?

That program breeds this kind of stuff. :S

That's bull****. Don't make up **** to TRY and sound smart.

Here's the drill.

Start->run->"msconfig"->Startup -> Uncheck EVERYTHING. Nothing there is critical to windows running, and these are just lame programs that start when Windows does.

Start-run->"regedit"->HKEY_LOCAL_MACHINE->software->microsoft->windows->current_version -> then click on the Run, RunOnce, and RunServices folders on the left, delete ALL the keys on the right side in the 3 different folders (except for the default, which you cannot delete). Again, these are all the non-critical programs that start when windows starts.

Now, pick a new browser, that isn't totally retarded, and have a trusted friend send you the installer via AIM or whatever. You don't want to open IE again, since the plugins will just readd the programs to your startup.

http://opera.com
http://mozilla.org/products/firefox
http://netscape.com

Or something else, just GET RID OF IE LIKE I HAVE BEEN TELLING YOU MORONS FOR A YEAR NOW.

Reboot into safe mode (with networking if possible).

Now, go to c:\Windows\system32\dllcache\ (you will probably have to type it into the address bar, since it's a dirty little hidden folder.)

Scroll down to iexplore.exe and delete it. (if you hate windows update like I do, scroll down and nuke wuacult.exe, too)

Go to c:\program files\ and delete everything that you can out of the Internet Explorer folder, none of it is critical, although XP would have you think otherwise with it's fake "OMG CRITICAL FILES R TEH DELETED" popup. Ignore it. It's complaining that you found it's backup of iexplore.exe.

Open Norton then open your task manager (while still in safe mode), right-click->end process on explorer.exe (not END PROCESS TREE, that won't make you happy).

Some viruses/spyware crap like to append themselves to explorer.exe, which is balls since you can't edit a file that is in use, meaning your virus scanner can't do crap.

Run a full scan, reboot normally, notice how much faster windows loads, install your new browser. I recommend checking out your Program Files folder, most spyware/ad programs install stuff here, so check out any folders that look suspicous and delete them if they aren't legit (yes, you can delete them since none of the executable files are actually RUNNING, because we killed everything in the first 2 steps.)

You SHOULD be all set now.

I disabled system restore a long time ago.

GOOD. System restores blows, and it's notorius for reinfecting cleaned systems.

@SaiyanNub: Oh yeah, I bet a non-legit copy of StyleXP is the problem! So is Kazaa Lite, which has no spyware in it. As long as you're not a ****ing retard, and don't download executable file types ( .pif, .scr, .exe, etc.), you're fine. I'm not condoning Kazaa, I'm just making fun of how wrong you are. :Þ

There's only so much operating system-related bull**** that can get by a programmer, and none of it is getting by me.

 

[SailorAlea]

That's bull****. Don't make up **** to TRY and sound smart.

Here's the drill.

Start->run->"msconfig"->Startup -> Uncheck EVERYTHING. Nothing there is critical to windows running, and these are just lame programs that start when Windows does.

Start-run->"regedit"->HKEY_LOCAL_MACHINE->software->microsoft->windows->current_version -> then click on the Run, RunOnce, and RunServices folders on the left, delete ALL the keys on the right side in the 3 different folders (except for the default, which you cannot delete). Again, these are all the non-critical programs that start when windows starts.

Now, pick a new browser, that isn't totally retarded, and have a trusted friend send you the installer via AIM or whatever. You don't want to open IE again, since the plugins will just readd the programs to your startup.

http://opera.com
http://mozilla.org/products/firefox
http://netscape.com

Or something else, just GET RID OF IE LIKE I HAVE BEEN TELLING YOU MORONS FOR A YEAR NOW.

Reboot into safe mode (with networking if possible).

Now, go to c:\Windows\system32\dllcache\ (you will probably have to type it into the address bar, since it's a dirty little hidden folder.)

Scroll down to iexplore.exe and delete it. (if you hate windows update like I do, scroll down and nuke wuacult.exe, too)

Go to c:\program files\ and delete everything that you can out of the Internet Explorer folder, none of it is critical, although XP would have you think otherwise with it's fake "OMG CRITICAL FILES R TEH DELETED" popup. Ignore it. It's complaining that you found it's backup of iexplore.exe.

Open Norton then open your task manager (while still in safe mode), right-click->end process on explorer.exe (not END PROCESS TREE, that won't make you happy).

Some viruses/spyware crap like to append themselves to explorer.exe, which is balls since you can't edit a file that is in use, meaning your virus scanner can't do crap.

Run a full scan, reboot normally, notice how much faster windows loads, install your new browser. I recommend checking out your Program Files folder, most spyware/ad programs install stuff here, so check out any folders that look suspicous and delete them if they aren't legit (yes, you can delete them since none of the executable files are actually RUNNING, because we killed everything in the first 2 steps.)

You SHOULD be all set now.



GOOD. System restores blows, and it's notorius for reinfecting cleaned systems.

@SaiyanNub: Oh yeah, I bet a non-legit copy of StyleXP is the problem! So is Kazaa Lite, which has no spyware in it. As long as you're not a ****ing retard, and don't download executable file types ( .pif, .scr, .exe, etc.), you're fine. I'm not condoning Kazaa, I'm just making fun of how wrong you are. :Þ

There's only so much operating system-related bull**** that can get by a programmer, and none of it is getting by me.

Here's a newsflash: You don't have to be a jackass about everything, even if they're wrong. You know something's bad when it's Alea telling people to be nicer.

Believe it or not, some people like Internet Explorer. And no, it's not only out of ignorance about how great Opera and Firefox are. This thread is about his difficulty in removing this spyware, not how YOU THINK it could've been prevented.

As for AIM, it installs a number of things if you don't unclick everything, and even when you do, it plasters icons on the desktop, Start Menu, desktop, favorites, favorite links, and probably more I have yet to find. As well as installing the "Viewpoint Media Player," which it does not let you uncheck, and if you manually delete it, it creates itself again.

And if you are a "programmer" (and in what language?) you'd know that being a programmer doesn't necessarily mean you're an expert at any given operating system, as the main programming languages being taught today(Java, which is platform independant, and C++, which can be developed on Mac, Linux or Windows, though not necessarily run interchangably.) don't require supreme proficiency in any OS.

Anyway, the point is, you don't have to come off sounding so superior, and constantly shoving Firefox down everybody's throats. And like I said before, in response to the masked profanity at the beginning and end of your post, you need to chill out.

 

[Kurt`]

AIM doesn't install spyware, unless you count WildTangent (which isn't really spyware), but like you said, you can opt not to install it.

Wasn't trying to sound superior, just pissed off at people who continue to use a browser that is the cause of the problems they constantly ***** about.

I do not use firefox, and I do not shove it down people's throats. Anything but IE is acceptable.

I wasn't IMPLYING that he got his spyware and **** from Internet Exploiter, but the fact that some of said spyware may have installed IE plugins, which would be loaded every time it's opened, compounding his problem with removing the spyware.

As for programming langauges, C++ (and inherently C), assembly, HTML, PHP, MySQL, BASIC, Turbo PASCAL, and some java. I do have alot of experience with windows (disassembling and tweaking, networking, troubleshooting, programming, pretty much everything about it), and I know what I'm talking about.

What I posted is pretty much the only way to totally clean your system of spyware, and even viruses that try to remain memory resident by appending their code to system files.

 

[SailorAlea]

It's annoying that every time Spyware is mentioned, someone undoubtedly shows up saying "OMG IE SUX! INSTALL FIREFOX!," and they always talk down to the people who don't use it.

What happened here is the equivalent of someone with AIDS walking into a clinic and asking for help, only to have them reply: "You wouldn't be suffering from AIDS if you had worn a condom! Piss off! *spit*"

Does that seem right?

Edit:
Most people with half a brain already know about the alternatives to Internet Explorer, and yet not all of them use it. You should let Mozilla do their own marketting, but the original 'Netscape' browser was a failure for a reason, and some people are unwilling to give them any more chances.

 

[Sonic the Vampire]

Kurt you sure sounded like you knew what you're talking about, until I started reading anyway. Some of what you said makes sense, some of it is questionable, some of it is just over the edge. You're obviously angry and think you know all there is to know about the problem right? I'm sure you're knowledgable but try not to push it onto people.

First you get a warning for being out of line towards Hwoarang.

Now onto what you said.

How will unchecking everything in his start up application menu cure his spyware problem? That will make start up faster, but what if he wants certain applications to start when windows does? And how would deleting internet explorer cure his spyware? Not only will not not cure his spyware, but IE is necessary to view certain web pages correctly. I agree that he should also use another browser but not exclusively.

System restore can reinfect systems, it can also restore them to back when they were clean. It's got practical applications if you know what you're doing.

Calm down.

 

[Kurt`]

Edit:
Most people with half a brain already know about the alternatives to Internet Explorer, and yet not all of them use it. You should let Mozilla do their own marketting, but the original 'Netscape' browser was a failure for a reason, and some people are unwilling to give them any more chances.

For the last and final time, I do not market firefox. I just wish people would use an alternative to IE.

Stop grasping for straws.

@boyster, hwoarang should stop being ignorant, or at least proofread what he is going to post. Why not give him a warning for a pointless post?

When windows starts (not in safe mode), it loads up all the programs specified in the startup section of msconfig, and also from the areas I mentioned in the registry. In order for him to be having "popup" windows, the code has to be running. The most LIKELY spot for a program to load is your startup, since it wants to be actively running on your system all the time.

Removing them all, scanning, then reenabling what you know are LEGITIMATE programs is pretty much the only way to remove them, since you can't edit/delete files that are currently running.

The IE folder is where all your plugins would be loading from, assuming he has the plugin problem that I mentioned earlier, deleting that would fix it. If he DOES have the plugin problem, every time he starts IE, it would reinfect his system.

 

[Synth]

It's quite alright for Kurt to try and be informative. I'm not 100% positive about AIM I'll admit...

...but maybe simple coincidence made me believe this.

I've discussed this with Sonic, and the fact that I'm far from I'm insulted, instead enlightened, I feel no reason for the warning to stand.

 

[Abe Froman]

Kurt covered pretty much everything. A couple more things to try on top of that is delete ALL temporary files(hit Start->Run->type "%temp%", hit Enter, then delete everything in the folder), and delete everything in the prefetch folder(C:\WINDOWS\Prefetch), before the Bagle and Spybot worms had fixes I had to remove them from a couple PCs. They kept coming back after I removed them until I deleted the prefetch files too. All of this from safe mode of course.

Also, make sure wscntfy.exe is in C:\WINDOWS\system32, if it's not then the process running is a virus.

Satan, it kinda looks like you have something new, something the anti-malware guys haven't made a definition for yet. Good luck.

Kurt, the reason why Hwoarang didn't get a warning is because being uninformed is not against forum rules, although if that changed I believe this board might not be so painful to read. I do find it hilarious that you sorta flamed a mod though.