Spy/Adware Help

[SA_Gohan]

It's like some horrible nightmare that I can't wake up from. Everytime I log into the internet I'm bombarded with pop-ads, and my task manager is filled with programs whose origins I have no clue to.

What's worse is that I've run the software (Spyhunter) to find the things in my system registry causing this and have deleted them manually . . . and yet seconds later they reappear!

When I delete the executables from my hard drive, (mostly of a program called N-case) everytime I restart it tells me that someone removed N-case without permission and asks if I want to reinstall it! And regardless of my answer it puts itself back on there automatically!

I'm running my firewall to block the offending programs from connecting to the internet and downloading more garbage onto my machine, but it's effect seems to be quite limited in that regard.

Does someone have any suggestions on how to stop this madness?

 

[Devion]

If you disabled your connection to the internet and then delete it.

And if that doesn't work my last suggestion is a format :/

 

[Pain]

http://toolbar.google.com/

blocks popups

 

[Phatslugga]

I use AD-aware and spybot S&D, the combination of those two programs find everything and obliterate them. If that doesn't work and devions suggestion didnt work, i suggest just doing what pain said and get a pop-up blocker, if that's not enough, then you should probably just re-format re-load.

 

[Kurt`]

(I know I'm going to get flamed by IE fanatics for this, but oh well...)

I'm running my firewall to block the offending programs from connecting to the internet and downloading more garbage onto my machine, but it's effect seems to be quite limited in that regard.

You are preventing the spyware programs from accessing the internet, but you are not preventing the program that is DOWNLOADING AND INSTALLING them from accessing the internet. (In this case, Internet Explorer). Internet Explorer has many security vulnerabilites that Microsoft seemingly refuses to patch. In your case, sites are exploiting something called ActiveX to download and install programs.

Use a browser that doesn't allow ActiveX controls to be run. (no automatic downloading/running of spyware) I recommend:

Side note: Mozilla Firebird has been upgraded and is now known as Mozilla Firefox.
http://www.mozilla.org/products/firefox

You can still download Firebird though:
http://seb.mozdev.org/firebird


It also blocks all UNDESIRED popups. (If you click a link and it is supposed to open in a new window, it will) You can also surf multiple sites at once. And it's interface looks somewhere familiar to Internet Explorer's.

Look at what is loading when you log on to Windows:

Start menu->Run->"msconfig"-> and then click the Startup tab

Also, try using Ad-Aware 6.0 and Spybot Search & Destroy. You may also want to run a virus scanner.

Let us know how the situation pans out.

 

[DPredator]

http://toolbar.google.com/

blocks popups

So you wanna block Pop-Ups with Spyware?

That doesn't sound very logical to me.

 

[imported_phrack50]

Adaware 6 will clean up that mess

 

[SaiyanPrideXIX]

Or...you could not be a thieving grabass, uninstall kazaa, and go to the ****ing store to buy photoshop and 3ds Max, and borrow porn from some friend or something. THAT is the safest way.

Damn grabasses.

 

[Pain]

So you wanna block Pop-Ups with Spyware?

That doesn't sound very logical to me.

its not spyware... only a few features of it are, and those are disable-able. the popup blocker feature of it is not spyware as far as i know, so you can disable everything else.

hell... even if it is spyware i could care less as long as i dont get the freggin popups. the pro's far outway the con's. mine has already blocked 844 popups... and that is a godsend to me.

btw the google toolbar doesnt come up as spyware when i run adaware.... so whatever

 

[ssjFajita]

Ad-aware.... nuff said

 

[SA_Gohan]

Update:
I've installed Mozilla and have fallen in love with it. No more pop ups, faster access to sites that used to take forever to load, and (maybe it's just the sites I've downloaded from) downloads average at 5.2 kb when with IE they were 3.5.

- Earlier I ran a virus scan with Norton and found what was hopefully the cause of the problem, a Trojan. For whatever the reason though Norton failed to autodetect it before I ran the scan so maybe spy/adware specifically targets virus scan software to render them less able to block incoming trash?

- I also forgot to mention the important fact that I'm running Windows 2000 so msconfig isn't present on my operating system. Is there another service that is similar to msconfig on 2000 machines?

- Final thing for me to do is to run a scan with Ad-aware.

I'll update again later, thanks everyone

 

[Alteh]

You should get Spybot Search and Destroy it's good, everytime I run a scan it always brings up something that I should get rid of, and also I was watching tech tv and some guy had a problem like that and he said something about n-case. You should go to the site www.techtv.com and search around their.

 

[Kurt`]

Update:
I've installed Mozilla and have fallen in love with it. No more pop ups, faster access to sites that used to take forever to load, and (maybe it's just the sites I've downloaded from) downloads average at 5.2 kb when with IE they were 3.5.

Muahahahaha! Another one joins the anti-IE movement.

(Make sure you go Tools->Options->Advanced-> and uncheck the "Hide the tab bar when only one window is open" box.)

- Earlier I ran a virus scan with Norton and found what was hopefully the cause of the problem, a Trojan. For whatever the reason though Norton failed to autodetect it before I ran the scan so maybe spy/adware specifically targets virus scan software to render them less able to block incoming trash?

AutoDetect should have picked that up, unless it is a fairly new virus. Try to keep your virus definitions up to date.

- I also forgot to mention the important fact that I'm running Windows 2000 so msconfig isn't present on my operating system. Is there another service that is similar to msconfig on 2000 machines?

I found this quote on about.com. ( http://windows.about.com/library/tips/bltip292.htm )

"Simply right-click My Computer, and choose Manage (or Start, Programs, Administrative Tools, Computer Management). In the left-hand pane of the Computer Management tool, expand System Tools, then expand System Information, then expand Software Environment. Click on Startup Programs, and a summary list programs/software will be displayed, no matter what the source of the startup is (Registry or Start Menu)."

Good luck!

 

[SA_Gohan]

I've run Ad-aware and am happy to note the death of all ad and spyware programs on my computer

I found this quote on about.com. ( http://windows.about.com/library/tips/bltip292.htm )

"Simply right-click My Computer, and choose Manage (or Start, Programs, Administrative Tools, Computer Management). In the left-hand pane of the Computer Management tool, expand System Tools, then expand System Information, then expand Software Environment. Click on Startup Programs, and a summary list programs/software will be displayed, no matter what the source of the startup is (Registry or Start Menu)."

Hmm, I found a program Ad-aware missed with this. Belt.exe in c: \winnt from abetterinternet.com
Thanks Kurt!

 

[Kurt`]

If it wasn't adware or spyware, AdAware probably wouldn't have picked it up. That might have been Norton's fault.

Now, just be careful of what you download, and you shouldn't have any more problems.

 

[Zorb]

Muahahahaha! Another one joins the anti-IE movement.

hehe make that two! :laff:
im am in dept to ya guys i'v been having the same probs and now finally the evil circle has been broken! *bows in deep respect*
....oh and by the way, MOZILLA PWNZ!

 

[KilledWithStyle]

ITS CALLED NETSCAPE. Use it. It has auto pop-up blocker. Also I would reccomend you upgrade EVERYTHING (spyware/adaware/pestpatrool). Get everything REGESTERED. Includeing a VIRUS SCAN. Delete all of your COOKIES manually. Change your PASSWORDS, it sounds like someone is there all the time. Make shure you have a FIREWALL and make shure that all of the PORTS are CLOSED this includes turning off the DMZ HOST. DON'T install everything you see, and make shure that your source is verry REALIBLE.
Just cause it stoped, doesnt mean that it will stop continueing.

For deleteing the pests/ads, first QUARINTINE then DELETE. It PREVENTS the FILES from MOVEING/DUPLICATEING. Reboot after EACH TIME. If these keep comeing up, its in your WINDOWS regestry and the best thing to do is a large smaka FORMAT.

PS: Netscape is a MUCH better Mozilla

 

[Kurt`]

PS: Netscape is a MUCH better Mozilla

Nutscrape is based off of the Gecko code originally written for Mozilla. *rolls eyes* Standard Mozilla looks far too much like Nutscrape, and it's a memory hog. That is why I use Firebird instead.

Most of your suggestions are related to Internet Security in general, which this thread is not about. The fact that Mr. SA_Gohan said that his firewall was catching the programs access the internet leads me to believe that he is either using Zonealarm ( http://zonelabs.com ) or Norton's built-in firewall (both of which offer outbound protection.

Delete all of your COOKIES manually.

Not all cookies are evil. In fact, most forums use cookies to "remember" who you are and to automatically log you in. If AdAware or another program says that a cookie is tracking info, then delete it. Otherwise, don't bother.

Make shure you have a FIREWALL and make shure that all of the PORTS are CLOSED this includes turning off the DMZ HOST.

https://grc.com/x/ne.dll?bh0bkyd2

This link leads to the Gibson Research Corporation, a site dedicated to Internet Security. That link points to their Shields Up! test, that determines what ports on your system are open. If you are using a decent firewall, they should all be stealthed, or at least closed. The test takes under a minute. Might be worth a run through.

On that site, you can also find programs that will address vulnerablities that exist in Windows XP, such as Universal Plug and Play, Raw Sockets, Windows Messenger (not to be confused with MSN messenger), DCOM (Distributed Component Object Model), etc. etc.

For deleteing the pests/ads, first QUARINTINE then DELETE. It PREVENTS the FILES from MOVEING/DUPLICATEING. Reboot after EACH TIME.

That won't work for virii that append themselves to certain critical files, such as explorer.exe or svchost.exe, in order to stay memory-resident. When performing a virus scan, it's best to restart into Safe Mode before running the test.

Restart your computer and hold down either the Control key or F8, and a startup menu should appear, from there you can choose Safe Mode or somethign similar.

If you are on Windows 2000/XP, open your virus scanner, terminate explorer.exe, and run the scan (to be sure it isn't hiding out to remain memory-resident). After that, restart normally.

On Windows 98, just run the scan and restart.

If these keep comeing up, its in your WINDOWS regestry and the best thing to do is a large smaka FORMAT.

(Warning: Do not mess with anything in the registry unless you are sure of the result. Deleting something accidentally may cause your installation of Windows to become unbootable)

On most systems (I'm not sure about Windows 2000), you can do the following to see what is loading on startup.

Start Menu->Run-> "regedit" ->HKEY_LOCAL_MACHINE->software->microsoft->windows->current version

Then examine the Run, Run-, RunOnce, RunOnce-, RunServices, etc. folders. All the entries on the right side of the screen show the programs that start when Windows loads.

Hope this lesson in Internet/Computer Security has been useful.

 

[Devion]

I've run Ad-aware and am happy to note the death of all ad and spyware programs on my computer



Hmm, I found a program Ad-aware missed with this. Belt.exe in c: \winnt from abetterinternet.com
Thanks Kurt!

I'm just glad to hear u didn't have to format your pc =]

Next time when u enter a porn site...don't click: Yes I agree .

 

[imported_Mystix]

download adaware 6.0, update it then use it to track down and delete all the adware in your comp.

and yes, the google toolbar is very good when it comes to popups