Either BitComet or uTorrent is so full of spyware, malware, etc...

[Turkish]

I am normally very cautious about what I install and I always create restore points before I install something. Unfortunately, I forgot to do so this time and after installing both BitComet and uTorrent, my computer is full of it... I constantly get IE popup windows even when IE is not running. As I type this post in Opera 9.5, another IE window with ads popped up. Any ideas which one causes this? And how I solve it?

 

[nismotigerwvu]

I'm pretty certain utorrent is clean. But like anything, if you didn't get it from the legit homepage then it could be infected.

 

[Sink41]

http://www.lavasoft.com/products/ad_aware_free.php

http://www.safer-networking.org/en/spybotsd/index.html

try running these two.

 

[ForumMaster]

assuming you dl'ed utorrent from legit websites, the program is clean. it's also so small that there's no room for spyware...maybe bitcomet if you downloaded it from a bad site. try running anti-spyware apps. utorrent certainly doesn't have any spyware and i doubt bit comet does either. think what you did that might have caused it. perhaps you installed something else?

 

[mechBgon]

A trojan-downloader could be very, very small. As in, below 10kb. So a trojanized version is a possibility.

Also try superantispyware's free version (superantispyware.com), plus an online virus scan at F-Secure's security center (f-secure.com, and use Internet Explorer since it uses ActiveX to scan). If problems persist, you might want to send a PM to Medea and see if he has room in his workload to look at your HijackThis log for targetted advice.


Also have a look at some more security tips, definitely use the Secunia checkup utility and enable your Data Execution Prevention.

 

[Turkish]

Thanks guys. I downloaded both applications from their official websites so I don't think it is a trojanized version.

Maybe I missed something in the setup where it said "Uncheck this if you want to opt-out of our ad program" or something :-/

mech: I was thinking of using Schadenorth (sp?)'s command line scanner script? Would that be good enough?

 

[RebateMonger]

Originally posted by: mechBgon
A trojan-downloader could be very, very small. As in, below 10kb. So a trojanized version is a possibility.

I don't know about Trojans, but a 100-Byte-long Virus won a "smallest possible virus" contest in 1994.

 

[mechBgon]

Originally posted by: Turkish
Thanks guys. I downloaded both applications from their official websites so I don't think it is a trojanized version.

There have been trojanized versions of FireFox (and FF extensions), trojanized Linux distros, and who knows what else. So never say nevar The security tips I linked to will cover some of the other ways your system could get pwned, such as exploits that target Flash Player, Adobe Reader, RealPlayer, QuickTime, iTunes, WinAmp, vulnerabilities in Windows, vulnerabilities in web browsers, etc.

mech: I was thinking of using Schadenorth (sp?)'s command line scanner script? Would that be good enough?

That would be a good approach too, but also get Superantispyware since it's one of the top spyware removers.

 

[degibson]

If you spend more than 2 hours on this problem, just nuke. I, for one, cannot stand stuff that pops up and steals my focus.