Is this anything or am I just paranoid?

[montanafan]

Every time I do Windows updates I have changes in my program control in Zone Alarm Pro. After the last time I noticed that several of the programs had been granted Server rights in both Trusted and Internet. I changed them all to ask or block for Internet Server rights and left the few I could remember as having Trusted Server rights that way, like Generic Host, Application Layer Gateway, LSA Shell, LiveUpdate Engine, and Services and Control.

Later I checked again and saw that Internet Explorer had an allow green checkmark under Send Mail which I had never seen before. I clicked to block it.

Later I checked in again and saw a new program "Run a DLL as an Application" and it was checked as allow across the board, Access and Server and Send Mail all. I blocked Send Mail and Internet Server Rights and put Ask on all the rest.

Then in task manager I saw that I had an explore.exe and IEXPLORE.EXE both and I couldn't remember seeing both before. I ran Norton and it found nothing. Then I ran AdAware and it found several entries for MegaSearch Toolbar which was a TAC 4. I usually don't have anything higher than a 3. I removed all. Did a restart and ran AdAware again. It found one entry for it again. I removed and restarted and since then it's found nothing. Running Norton again found nothing as well.

Today when I tried to connect to the internet I couldn't until I went to program control and gave Application Layer Gateway both Trusted and Internet Server Rights. I know that before it didn't need Internet Server Rights.

All these wierd things have me wondering if something is wrong or if I'm just paranoid because of finding the MegaSearch Toolbar thing and the Run DLL as an Application and the Internet Explorer send mail program oddities.

Anyone know anything about any of this? Does it sound like I'm okay? If not, what can I about it?

 

[Blake]

MegaSearch Toolbar tracks Internet usage in Internet Explorer and sends links to data.alexa.com.

You probably received MegaSearch Toolbar either by downloading the toolbar directly from the Internet, or through downloading other popular free software from the Internet that bundles with MegaSearch.

Sounds like you caught it in time. Most spyware programs do a decent job of removing that stuff. I would just keep doing regular scans for virus and spyware. The extra stuff you are doing might be overdoing it and be the reason you couldn't connect to the internet.

 

[montanafan]

Thanks, Blake. The only thing I've downloaded from the internet in a long time, besides the Windows updates, was some songs from MusicMatch and Walmart. Think it could have come from one of them? So it's not anything serious, just annoying?

Thanks again.

Alexandra


Edit: After taking a closer look at it in AdAware's quarantine list, it looks like it came from Verizon? I use Verizon DSL.

 

[GregANDTCH]

had an explore.exe and IEXPLORE.EXE both [/Q
IEXPLORE.EXE should be MS Internet Explorer.
Was it running at that time?
Does it disappear when you close IE?

Is the other one "explore.exe" or "explorer.exe"?

 

[BadThad]

You do realize that Ad-aware will only catch a fraction of malware that's out there, right? To do a more complete job, you'll need, at minimum Spybot and MS Antispyware scans. Spysweeper is very good, but only a 30 day trial.

 

[montanafan]

Originally posted by: GregANDTCH

had an explore.exe and IEXPLORE.EXE both [/Q
IEXPLORE.EXE should be MS Internet Explorer.
Was it running at that time?
Does it disappear when you close IE?

Is the other one "explore.exe" or "explorer.exe"?

GregANDTCH, the IEXPLORE.EXE does disappear when I close IE. And, my mistake, the other one is explorer.exe, not explore.exe. Thanks.


BadThad, I've used Spybot in the past and was going to download it on this machine, but kept putting it off because I'd read somewhere that there are some phony sites out there posing as Spybot and wanted to do some double checking to make sure that I got the legitimate one. Right now I'm just using AdAware and ZA's spyware cleaner, but I'll get Spybot or something else too. Thanks.

 

[GregANDTCH]

Use the link for Spybot off of this page:
http://forums.anandtech.com/messageview.aspx?catid=33&threadid=1658987

 

[CrispyFried]

NOTHING should have server rights for internet except p2p stuff.

 

[montanafan]

Thanks, GregANDTCH! I should have remembered seeing that thread here a while back.


CrispyFried, that's what I thought. I unchecked Internet Server Rights for Application Layer Gateway again and everything works fine. Thanks.