-
We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.
Quick! Other than adaware, what's a good prog to clean out spyware?
- Thread starter StageLeft
- Start date
mechBgon
Super Moderator<br>Elite Member
Spybot Search & Destroy is another one you can try.
Bigger picture: your defenses are weak somewhere. Questions:
Bigger picture: your defenses are weak somewhere. Questions:
- What people use this computer and do they have Administrator-class accounts or restricted accounts?
- What operating system does it have, and what service pack level
- What antivirus do you have
- What firewall(s) do you have, hardware and/or software
StageLeft
No Lifer
I use it. I installed it because some fvcking site popped up something and I was expecting a file, so i hit install, but this popup was before the one I was expecting, so a bunch of exes and processes and all that good stuff started up.
Anyway, I used adaware, and now the damn sh*t keeps poppping up after reboot (most of it's gone, but a few critical objects are still here), so adaware has to clean it again. Thanks - I'll give spybot a go 😀
Actually a few are cookies. They don't bother me themselves, but no idea how they keep getting there. The fourth problem that keeps popping up is "istbar". It's a registry setting it keeps writing, and I'd love to know what application is writing it, but all either of the progs can find is the registry entry.
mechBgon
Super Moderator<br>Elite Member
Since your malware is returning, you should do this:
Can I suggest switching to a Limited-class account (called a Restricted-User account if you've got Win2000Pro)? Save the Administrator powers for another account that you use when you need it. If you need to run something with Admin powers from within your limited/restricted account, just right-click it while holding Shift, and choose Run As.... I use this precaution myself at home, and as a Restricted User I would not have seen that installer popup that started this mess. Even if I had, it could not have installed since that power is locked away. Try it for a while.
- Rant & throw stuff
- Download Hijack This, save it into C:\HJT, and extract the .exe out of the .zip file to that folder
- Run it and hit Save Log to save the log file
- Post the logfile's contents here
- Get Schadenfroh to check it out and recommend what to do 😎
Can I suggest switching to a Limited-class account (called a Restricted-User account if you've got Win2000Pro)? Save the Administrator powers for another account that you use when you need it. If you need to run something with Admin powers from within your limited/restricted account, just right-click it while holding Shift, and choose Run As.... I use this precaution myself at home, and as a Restricted User I would not have seen that installer popup that started this mess. Even if I had, it could not have installed since that power is locked away. Try it for a while.
StageLeft
No Lifer
I'll give that a go. The Malware is gone, but now I've got, upon booting, three cookies - doubleclick.net, ehg-idg.hitbox.com,hitbox.com I wish the people who do this stuff would die! This is infuriating. Spybot and ad-aware are both finding totally different problems upon each bloody reboot. This was from ONE click.
Spybot keeps finding the dsoexploit. I have XP and SP2 btw, and zonealarm. Hjt here is log:
Services are now linked here Is there any point in keeping Remote Registry running?
Ah, I see it was a silly error with spybot as to why dso exploit keeps getting reported.
Spybot keeps finding the dsoexploit. I have XP and SP2 btw, and zonealarm. Hjt here is log:
Services are now linked here Is there any point in keeping Remote Registry running?
Ah, I see it was a silly error with spybot as to why dso exploit keeps getting reported.
mechBgon
Super Moderator<br>Elite Member
I see your System Restore is running. That could be a reason that certain things come back. OTOH, if you used System Restore, you might be able to go back to before this thing got in the door, too. I have a thing against SR since it seems like every virus under the sun has to have SR disabled in order to remove it. So why even give them this hiding place to start with, that's what I say :evil:
Anyway, if you PM Schadenfroh I'm sure he could give you some advice on what to have HJT fix. 🙂
Anyway, if you PM Schadenfroh I'm sure he could give you some advice on what to have HJT fix. 🙂
BlueWeasel
Lifer
BHOdemon is another good program for getting rid of mysterious search engines, homepage hijackers, etc.
Schadenfroh
Elite Member
Hello Skoorb,
Before you do anything
1. Make sure that you have extracted HiJackthis to a folder that is isolated before removing anything, for hijackthis makes backups within the folder it is in.
2. Disable system restore, malware can come back through it.
3. Reboot into safe mode.
4. Close all browsers/windows explorer.
fix the following in hijackthis(kill the process in process viewer, if its there)
Additional Steps
1. Clear your Temporary Files
2. Remove the following VIA instructions provided:
3. Delete the following folders
5. Update to the latest verision of HJT and post a new log, as some malware can hide from the older versions of HJT, download latest HJT.
Notes
Dont worry about the DSO exploit, It is a bug and harmless.
Before you do anything
1. Make sure that you have extracted HiJackthis to a folder that is isolated before removing anything, for hijackthis makes backups within the folder it is in.
2. Disable system restore, malware can come back through it.
3. Reboot into safe mode.
4. Close all browsers/windows explorer.
fix the following in hijackthis(kill the process in process viewer, if its there)
- R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/home.html
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = file:///D:/home.html
- R3 - Default URLSearchHook is missing
- O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
- O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
Additional Steps
1. Clear your Temporary Files
2. Remove the following VIA instructions provided:
3. Delete the following folders
- c:\program files\180solutions
- C:\PROGRA~1\COMMON~1\tsa
5. Update to the latest verision of HJT and post a new log, as some malware can hide from the older versions of HJT, download latest HJT.
Notes
Dont worry about the DSO exploit, It is a bug and harmless.
StageLeft
No Lifer
Thanks, I'm doing that now, as well as going at it with adaware, spybot, CWS, and spywareblaster (runs all the time to prevent spyware I guess - is this a silly app? I'd hate one to really drag down system resources).
I also am using pandasoftware.com's online antivirus and it's found one on my PC, which it has removed. Sadly, it didn't say what the virus was, but it had infected 116/97,000 files.
I also am using pandasoftware.com's online antivirus and it's found one on my PC, which it has removed. Sadly, it didn't say what the virus was, but it had infected 116/97,000 files.
Schadenfroh
Elite Member
No, you enable all protection and close it. It does not take up any resources. See This Link. It is one of the best tools ever to prevent spyware.
Schadenfroh
Elite Member
IIRC it puts "hooks" in your system that keep the specific spyware from installing. It also blocks bad cookies and adds sites to IE restricted zones. It does all of this when you hit enable all protection and once its done, your immune to those specific infections (but new variants come out every day, so keep it updated). Spybot only does activeX, spywareblaster does much more and has a much larger database for prevention. Sorry for trying to get you to nuke your home page😛 many hijackers do stuff that looks like that and i did not know.
StageLeft
No Lifer
Here's where I stand then. I killed the virus, killed spyware with ad aware, spybot, cws, hjt, and now have run spywareblaster and FINALLY I am not having an annoying cookie with ad-aware. I wonder how long until I have one *shrug*.
Anyway, thanks for all the help. It's muchly appreciated and I'm not longer having violent tendencies. I was reading a couple of days ago about a guy on slashdot who went to one site he knew about to see how badly it could kill his machine. I didn't expect I'd experience it myself so soon!
Anyway, thanks for all the help. It's muchly appreciated and I'm not longer having violent tendencies. I was reading a couple of days ago about a guy on slashdot who went to one site he knew about to see how badly it could kill his machine. I didn't expect I'd experience it myself so soon!
Schadenfroh
Elite Member
You might also be interested in my Guide to Malware Prevention
mechBgon
Super Moderator<br>Elite Member
I have about 80 systems to look after, and the #1 countermeasure against spyware in my opinion is to not have people running wild with Admin powers when they don't need them (with beefy, well-configured spyware-aware antivirus protection as backup). If they have Admin powers, they can install spyware despite having Firefox, it won't stop them downloading a Gator/Weatherbug/PrecisionTime/FREE SMILIES FOR YOUR EMAIL!! installer if they want to. 😉 But we all have our opinions, I realize.
I found the Vitalsecurity link in this INQ article seems to describe what happened to Skoorb. Check it out.
I found the Vitalsecurity link in this INQ article seems to describe what happened to Skoorb. Check it out.
Schadenfroh
Elite Member
look under "Steps to plug security holes that allow malware to get thru:"
number 5
Schadenfroh
Elite Member
AMEN!
TRENDING THREADS
-
Discussion Zen 5 Speculation (EPYC Turin and Strix Point/Granite Ridge - Ryzen 9000)- Started by DisEnchantment
- Replies: 25K
-
Discussion Intel Meteor, Arrow, Lunar & Panther Lakes + WCL Discussion Threads
- Started by Tigerick
- Replies: 25K
-
Discussion Intel current and future Lakes & Rapids thread- Started by TheF34RChannel
- Replies: 24K
-
-
