Comments on: Evil Spyware problem

By: Chris Bertram

Chris Bertram — Sun, 17 Oct 2004 21:55:58 +0000

Thanks everyone. I’m now happily popup and spyware free, and have installed SP2. HijackThis made the difference as well as blocking a list of sites using IE-Spyad (from the spywareinfo site).

By: gee jay

gee jay — Sun, 17 Oct 2004 13:07:55 +0000

Sounds to me like you may have Active Desktop turned on. If IE isn’t running and popups still occur, tne that is the problem. I know it sounds hard to believe, but simply turning AD off will stop this.

By: bryan

bryan — Sun, 17 Oct 2004 00:20:06 +0000

what do these pop-ups look like, where do they direct you, anything distinguishing about them whatsoever?

By: Mike

Mike — Sat, 16 Oct 2004 20:05:55 +0000

You’ve gotten some good advice. Top three suggestions: 1) Use Hijack This—a great program that helped me when I had a similar program; 2) Use ZoneAlarm—another great free program—to turn off IE’s access to the Net. This is an excellent plan; 3) Install SP2. It works, it has great pop-up protection, but use Hijack This first in case whatever-it-is tries to defend itself by screwing with your SP2 install.

By: Adi

Adi — Sat, 16 Oct 2004 09:39:27 +0000

erm i forgot to mention that afaik this is a windows xp fix, not so sure about 2k or previous versions of the unwashed OS

By: Adi

Adi — Sat, 16 Oct 2004 09:37:44 +0000

this isnt as far gone as regediting, but it should help a little anyway, if just to increase bootup time go to start->run->msconfig choose selective startup, then click on the startup tab. uncheck everything that is not located in c:windows[whatever] things like qttask and ituneshelper and winamp agent are the things i find in this area. also doublecheck that whatever is actually IN the windows directory is something you want upon booting up. hope this helps

By: Adi

Adi — Sat, 16 Oct 2004 09:36:30 +0000

By: Phill

Phill — Sat, 16 Oct 2004 05:40:42 +0000

Yikes, sounds like its just adware, but we have been seeing a new type of spyware called theftware, this watches what you do and uses the information gained to either steal from you or to take out loans in your name. i am not kidding. Renaming the IE executable should not have terrible consequences. It is only a thin layer over a large amount of library codes. What Microsoft thinks of as IE is the linked libraries, not the executable.

By: Jonathan Goldberg

Jonathan Goldberg — Fri, 15 Oct 2004 22:48:56 +0000

NB: if you take any of the suggestions involving editing the registry, BACK UP THE REGISTRY FIRST. It’s not hard to do; Microsoft’s site has instructions. The grief it could save you is enormous.

By: terry

terry — Fri, 15 Oct 2004 22:18:08 +0000

go to aumha.com, which has forums where people who know what they’re doing will examine your hijack this logs and walk you thru what to delete.

By: dan

dan — Fri, 15 Oct 2004 21:57:56 +0000

I had this same problem. I solved it by activating Windows XP’s own firewall. I also have separate firewall and virus detection software which did not do the job. To start XP’s firewall Go to Control Panel, then Network and Internet Connections, click on network connections, right click on icon for your internet connection, click on properties, go to advanced tab, check the box, and that’s it. I hope I explained this clearly

By: SHai

SHai — Fri, 15 Oct 2004 19:28:53 +0000

but about installing sp2, id wait until the spyware is removed; e.g. see this story

By: Shai

Shai — Fri, 15 Oct 2004 19:26:03 +0000

removing stuff from run in registry won’t damage your computer (it will merely stop the programs you remove from starting with windows). anyway, bring up the process list (ctrl-alt-delete -> processes) then look for suspicious exe files. especially ones with names like dfsdfwer.exe; ones with more regular names you can search google and maybe find how to remove it. if not, it might be hidden in a dll somewhere. I used security task manager to identify and delete spyware hidden in a dll that norton, adaware, spybot didnt find. if you get really desperate you can try mcafee antivirus or trend micro online virus scan. sometimes one can detect what the other can’t, especially when the virus/spyware isn’t widespread or dangerous.

By: Chris

Chris — Fri, 15 Oct 2004 19:17:44 +0000

Avast! anti-virus software is pretty powerful and free for private users. It caught several bugs on mine that Spybot S&D passed by.

By: Randolph Fritz

Randolph Fritz — Fri, 15 Oct 2004 19:12:26 +0000

Hire an expert.