[brapper]

So help me. Honestly I have no more ideas what to do.
My mom's laptop is overrun with spyware (specifically "Adblaster" and "Netbouncer")
I've downoaded Adaware and Spybot Search and Destroy. They're not effective.

What's happening is windows pop-up in Internet Explorer even when IE isn't running. I have her using Firefox, but they're popping up in IE nevertheless. I've deleted the files manually, and the registry entries, but to no avail.

So what do those of you that must run windows use to block, prevent, and erase.
I'm thinking of going out to get Norton NetUtilities, but I was hoping I'd get a better idea from you all.

Oh, and yeah, throwing away the piece of **** woulf be preferable, but it'll have to wait until I get a new computer and can give her my Tibook.

She's running Windows Me (I know... ) with all the latest Microsoft update and security patches (I know.. )

[RiSE]

Uninstall all the adware/spyware remover programs if you run more then 1 it can create more spyware and just give you more problems. After you uninstalled them. Download Yahoo Compaion and run the anti-spywear software in safe mode. Reboot and you should be all clear. Tell your mom to run the anti-spyware once a week. And really windows ME was the worst version on windows, try and get xp

[qualey2]

Dude sound like windows messanger is still running on that machine. See shoot the messanger. Let me know if it helps.

[goMac]

Dump... ME... Now...

[rjenkinson]

nuke and pave.

-r.

[cheerios]

2 words: SAFE MODE

Also, since you know the exact culprits, google for specialized removal tools.

Also, you're running antivirus software on there... right... ?

hook her up w/ AVG anti-virus if you've got nothing better... i've used it on a couple boxes & it seems to work pretty well.

Good luck

btw: no, running ad aware & spybot together will NOT create more spyware, and i would highly suggest using the two in conjunction. I've never heard of using Yahoo for spyware removal and would be highly cautious following that advice.

[itistoday]

edit: [kids, don't be like me, read the entire post before posting...]

[effgee]

This is my usual route for fuxored WinBoxes ...

1. Download Spyware Blaster from http://www.javacoolsoftware.com/
2. Download CCleaner from http://www.ccleaner.com/
3. If there's no AV software on the box, download and install Kaspersky AV from http://www.kaspersky.com - it's not free but has one of the best detection rates - way better than Norton or Avast, for example. Update the Virus defs after installation
4. Update the definition libs for Spyware S&D and Ad-Aware
5. Download and install a decent firewall (I use Kerio myself - more later)
6. Disconnect the thing from the internet
7. Boot the box in safe mode (hold down F8 during boot before the Win logo appears)
8. Run Ccleaner
9. Run Ad-Aware
10. Run Spyware S&D
11. Run a full scan with Kaspersky AV

The machine should now be clean - reboot it normally. Following the reboot, open Internet Explorer (without an active internet connection). Kerio will now ask you whether or not you want to allow the application Internet Explorer to launch - click the checkbox for making this setting permanent and deny the launch - IE will never bother you again. Do the same with Windows Messenger and Media Player.

Lastly, run Spyware Blaster and enable the protection for all products.

If that didn't do it and you're 100% sure you followed the steps above, the only thing left to do (short of a complete reinstall) is to run "Hijack This", save the results and post them in a forum where experts can tell you how to get rid of what. If you know your way around windows, the registry, etc. real well you can also use Hijack This to permanently remove those pesky IE toolbars (HOB's or whatever the hell those pest boils are called)

HTH + good luck

[d0ubled0wn]

I had to use a combination of Webroot's Spy Sweeper and Security Task Manager to fix my friend's pc. Spy Sweeper removed most of the common baddies. Security Task Manager shows currently running tasks and sorts each task by threat level. It makes it easy to spot questionable running tasks and quarantine them.

[powerbook867]

I second this idea. The amount of time it will probably take to fix it, you can do a complete re-install.

Originally posted by rjenkinson:


nuke and pave.

-r.

[brapper]

thanks everyone for the advice. I'm downloading the software you've mentioned as we speak and I'm going to give it a shot.
Also, now I know what safe mode's for...thanks.
I hope I never have to touch a Window's system again.

[itai195]

In my experience a combo of Symantec's anti-virus scanner and Webroot Spy Sweeper works pretty well, but there are always some pesky programs that I have to go in and remove manually. Since you know the ones that are bugging you, you can probably google for the manual removal process. No doubt about it, the spyware problem is starting to seriously get out of control, it seems like it's getting harder and harder to remove.

[Xaositect]

The Webroot product is very good, and their tech support is top notch.

Hijack This! is a staple of spyware removal - there are always new ones out there, and this can help you remove them before new definitions come out.

The one I hate the most is CWS (Cool Web Search). Some of it's hundreds of variants load as mime type helpers (usually for txt and html files), so as IE is the user interface, they run even in safe mode (nuke and pave - unless you have a spare day or two and a masochistic streak).

The difference between the virus and spyware groups is simple - most viruses are kids writing graffiti (note the most), while spyware is a money making industry - and when the professional scammers get into a field, the ride gets wild.

I was going to rib you (gently) for the "fo" in the title - did you mean "of" or "for"? Both fit, and I'll let you claim you meant for both possible interpretations as word play!

[brapper]

Originally posted by effgee:
This is my usual route for fuxored WinBoxes ...

1. Download Spyware Blaster from http://www.javacoolsoftware.com/
2. Download CCleaner from http://www.ccleaner.com/
3. If there's no AV software on the box, download and install Kaspersky AV from http://www.kaspersky.com - it's not free but has one of the best detection rates - way better than Norton or Avast, for example. Update the Virus defs after installation
4. Update the definition libs for Spyware S&D and Ad-Aware
5. Download and install a decent firewall (I use Kerio myself - more later)
6. Disconnect the thing from the internet
7. Boot the box in safe mode (hold down F8 during boot before the Win logo appears)
8. Run Ccleaner
9. Run Ad-Aware
10. Run Spyware S&D
11. Run a full scan with Kaspersky AV

The machine should now be clean - reboot it normally. Following the reboot, open Internet Explorer (without an active internet connection). Kerio will now ask you whether or not you want to allow the application Internet Explorer to launch - click the checkbox for making this setting permanent and deny the launch - IE will never bother you again. Do the same with Windows Messenger and Media Player.

Lastly, run Spyware Blaster and enable the protection for all products.

If that didn't do it and you're 100% sure you followed the steps above, the only thing left to do (short of a complete reinstall) is to run "Hijack This", save the results and post them in a forum where experts can tell you how to get rid of what. If you know your way around windows, the registry, etc. real well you can also use Hijack This to permanently remove those pesky IE toolbars (HOB's or whatever the hell those pest boils are called)

HTH + good luck

These steps seem to have done the job.
Thanks.

[cheerios]

glad to hear it cleaned up Now that it's clean, make sure it stays that way. Give your mum a lesson in how to use spybot, set up her virus scan to auto-scan daily, make sure it's set to scan when it boots back up if its off @ the designated time.

good luck /w the user training!!

[driven]

Look at the bright side .... these types of incidents are driving people to the Mac.

[milhous]

give this a shot, but please understand that it's still beta and could still have some issues.

just released today by microsoft:

Microsoft Windows AntiSpyware (beta)

it just sounds like it's additional spyware for spyware!

surely they could've been more creative with the name. good luck.

[Superchicken]

Since you've solved your problems I can feel good about getting away with a small quip:

Step one:
Wait until MWSF
Step two:
Order headless iMac
Step three:
Wait one to three months for shipping
Step four:
Plug in to wall and old monitor
Step five:
Tell mom Microsoft changed their name to Apple

[Shaddim]

Spyware? Never heard of it.

[eep]

Originally posted by effgee:
This is my usual route for fuxored WinBoxes ...

1. Download Spyware Blaster from http://www.javacoolsoftware.com/
2. Download CCleaner from http://www.ccleaner.com/
3. If there's no AV software on the box, download and install Kaspersky AV from http://www.kaspersky.com - it's not free but has one of the best detection rates - way better than Norton or Avast, for example. Update the Virus defs after installation
4. Update the definition libs for Spyware S&D and Ad-Aware
5. Download and install a decent firewall (I use Kerio myself - more later)
6. Disconnect the thing from the internet
7. Boot the box in safe mode (hold down F8 during boot before the Win logo appears)
8. Run Ccleaner
9. Run Ad-Aware
10. Run Spyware S&D
11. Run a full scan with Kaspersky AV

The machine should now be clean - reboot it normally. Following the reboot, open Internet Explorer (without an active internet connection). Kerio will now ask you whether or not you want to allow the application Internet Explorer to launch - click the checkbox for making this setting permanent and deny the launch - IE will never bother you again. Do the same with Windows Messenger and Media Player.

Lastly, run Spyware Blaster and enable the protection for all products.

If that didn't do it and you're 100% sure you followed the steps above, the only thing left to do (short of a complete reinstall) is to run "Hijack This", save the results and post them in a forum where experts can tell you how to get rid of what. If you know your way around windows, the registry, etc. real well you can also use Hijack This to permanently remove those pesky IE toolbars (HOB's or whatever the hell those pest boils are called)

HTH + good luck

Probably a dumb question but here it goes.

I use VPC 7 (running windows 2000 pro) to check out my web designs on the web and on my local machine. Should I install Anti-Spyware and Anti-Virus on VPC? I assume that netbarrier will double as a firewall for VPC since it shares the macs connection. Not really sure but I've heard that if you have shared folders in VPC, that folder can be damaged by a windows Virus. And since VPC can access programs on my Mac it could do damage there as well. Is this right or wrong?

Any Ideas?

Thanks.

[brapper]

Originally posted by Superchicken:
Since you've solved your problems I can feel good about getting away with a small quip:

Step one:
Wait until MWSF
Step two:
Order headless iMac
Step three:
Wait one to three months for shipping
Step four:
Plug in to wall and old monitor
Step five:
Tell mom Microsoft changed their name to Apple

[effgee]

Originally posted by brapper:
These steps seem to have done the job.

Glad to hear you got your Mom's WinBox back up and running!

Originally posted by eep:
Probably a dumb question but here it goes. ...

Not dumb at all, methinks. All PC viruses that I've heard of (there's way too many to know 'em all) rely on the Windows directory structure such as

• C:\Windows\System32\whatever.dll

in order to locate files they'd like to infect/delete/alter/etc., so they'd probably be stumped and unable to do their biding when they suddenly encounter an unknown file system. However, they're still perfectly able to make a complete mess of the system on your VPC image and render it unusable.

To be on the safe side, I'd recommend installing/using a combo of free tools (Spyware S&D, Ad-Aware + AVG free - all available from Versiontracker for Win) and keeping them up to date.

Also (again, to be on the safe side), you should make sure that you never share folders that (even a couple of folders deeper) contain confidential information (taxes, banking, client info, billing etc.) - e.g., instead of sharing your entire "Documents" folder, rather share a "html" folder inside your project folder that contains nothing but the code you're using for your cross-platform tests.

And of course - for completion's sake - never, ever use VPC for any kind of financial transaction (online shopping, banking, etc.) unless you're 100% sure that your Windows system is safe, virus- and spyware-free.

All that might sound a bit paranoid to the average and relatively unconcerned (rightfully so) Mac user but I've seen my share of virus damage on WinBoxes and would not want to see that kind of shite on my PeeCee. From keystroke loggers to backdoor trojans to erased drives to god knows what else - there's (next to) nothing those crapware-writing retards haven't thought of.

[effgee]

speaking of paranoid ...

Brapper,

in case your mom bought/buys stuff online and/or does her bank business (or any other type of confidential transaction, for that matter) online, make sure you tell her to keep a very close eye on the next two or three credit card/account statements she'll be getting in the mail.

If the box was infested badly there's the possibility that she had caught a keylogger as well - and if she typed any credit card info into an online form while that thing ran in the background ... well, you can imagine the result ... some kid somewhere might just think it's funny to order a crapload of stuff using your mom's credit card.

Just to be on the safe side ...

[kikkoman]

Tip, go to Tools -> Internet Options -> Advanced and uncheck Enable third party browser extensions. Install service pack 2 if you haven't done so.

[Goldfinger]

deltree* (if that still exists)

then proceed to www.apple.com/store --> spyware problem solved.


*I learned this command years ago when I tried it on some of the Win 3.11 computers at school when a PC-using friend of mine recommended it to me. I have to admit that PCs are very good at deleting stuff, very fast.

[turtle777]

Originally posted by Superchicken:
Tell mom Microsoft changed their name to Apple

Dude, if your mom doesn't like Apple, get a new mom asap.

-t

[brapper]

Originally posted by turtle777:


Dude, if your mom doesn't like Apple, get a new mom asap.

-t

how'd you get that from what he wrote?

[turtle777]

Originally posted by brapper:
how'd you get that from what he wrote?

Say again all after Good morning ?!?!

-t

[effgee]

Turtle needs to get himself a strong cup of coffee and pledge that - if he doesn't feel like reading through the entire thread - henceforth he'll at least read the initial post before commenting.




(T'was one of my own new year resolutions - and so far (a week into the new year!) I haven't said/typed anything really dumb. By my own standards, mind you)

**awaitsobviouscommentsfromtheusualprotozoans**

[gautch]

Originally posted by Superchicken:
Since you've solved your problems I can feel good about getting away with a small quip:

Step one:
Wait until MWSF
Step two:
Order headless iMac
Step three:
Wait one to three months for shipping
Step four:
Plug in to wall and old monitor
Step five:
Tell mom Microsoft changed their name to Apple

Originally posted by turtle777:


Dude, if your mom doesn't like Apple, get a new mom asap.

-t

If his mom dosent like Apple there is also an easy fix for that:

Step one:
Wait until MWSF
Step two:
Order headless iMac
Step three:
Wait one to three months for shipping
Step four:
Plug in to wall and old monitor
Step five:
Tell Family, Mom changed her name to Apple and is now your personal assistant.

It worked for me.

[turtle777]

Originally posted by effgee:
Turtle needs to get himself a strong cup of coffee and pledge that - if he doesn't feel like reading through the entire thread - henceforth he'll at least read the initial post before commenting.

Uhm, I did read the whole thread.

I just don't understand what brapper meant with "how'd you get that from what he wrote?"

Brapper didn't get it in the first place.

I was just polite enough to hold back a WTF and gave him the

-t

[FulcrumPilot]

LOL!!

This friend of mine has his IE hijacked a few days ago. Have never seen a soul so tormented, he is pretty PC savvy mind you. He says he has tried everything to get rid of "it" and has now given up. He is planning to reformat his drive this weekend, and says he will never launch IE again ever!

Free entertainment for me!

[effgee]

Originally posted by turtle777:
Uhm, I did read the whole thread.

I just don't understand what brapper meant with "how'd you get that from what he wrote?"

Brapper didn't get it in the first place.

I was just polite enough to hold back a WTF and gave him the

-t

He, He ... I think (!!) I'm on top of this ...

• Superchicken (out of the blue, as usual ):
  "Tell mom Microsoft changed their name to Apple"
• Turtle (taking SC literally):
  "Dude, if your mom doesn't like Apple, get a new mom asap."
• Brapper (confused, my comments in grey):
  "how'd you get that ("If your mom doesn't like ...") from what he (SC) wrote ("Tell mom Apple changed ...")?"

Result: Usual confusion towards the end of a thread ... Brapper never said a word about his mom not liking Macs

[turtle777]

Originally posted by effgee:
Brapper never said a word about his mom not liking Macs

Really ?

Duh !

Alter, vielleicht solltest du ab in die Heia...

-t

[brapper]

Originally posted by turtle777:
Uhm, I did read the whole thread.

I just don't understand what brapper meant with "how'd you get that from what he wrote?"

Brapper didn't get it in the first place.

I was just polite enough to hold back a WTF and gave him the

-t

I asked how you got that my mom doesn't like Mac's from what chicken said.
It's not a logical assumption, hence my asking you.
Moreover, my mother is excited about getting my old Powerbook when I upgrade.
But in truth, I'm not really interested all that much, so don't worry about it.

[turtle777]

Originally posted by brapper:
I asked how you got that my mom doesn't like Mac's from what chicken said.
It's not a logical assumption, hence my asking you.
Moreover, my mother is excited about getting my old Powerbook when I upgrade.
But in truth, I'm not really interested all that much, so don't worry about it.

Why is everyone so humor impaired today ?
It was a freakin' joke...

Alright ?

-t

[bradoesch]

Originally posted by Goldfinger:
deltree* (if that still exists)

then proceed to www.apple.com/store --> spyware problem solved.


*I learned this command years ago when I tried it on some of the Win 3.11 computers at school when a PC-using friend of mine recommended it to me. I have to admit that PCs are very good at deleting stuff, very fast.

IIRC this should trash everything:

deltree * /y

Or for sure

deltree \Windows /y

will trash your Windows directory.

[effgee]

Originally posted by turtle777:
... Alter, vielleicht solltest du ab in die Heia...

Well, it lasted a week for me. **checksfirstitemoffresolutionlist**



"Darf ich noch ein bisschen weiter arbeiten oder muss ich jetzt wirklich schon ins Bett?"
(hint: I gotta work regardless of what the answer will be - 4am is the projected "computer-off-go-to-bed" time for tonight.)

Maybe it's the music ...

[brapper]

Originally posted by turtle777:
Why is everyone so humor impaired today ?
It was a freakin' joke...

Alright ?

-t

oh. I didn't get it.
Sowwy :offers hug:

[turtle777]

Originally posted by effgee:
Well, it lasted a week for me. **checksfirstitemoffresolutionlist**

That's why I never came up with one in the first place...

-t

[turtle777]

Originally posted by brapper:
oh. I didn't get it.
Sowwy :offers hug:

Accepted.

Did you really think I was serious with "getting a new mom" ?

-t

[effgee]

Originally posted by turtle777:
That's why I never came up with one in the first place...

Me neither.
**schwarzeneggervoice**
"I lied."

[brapper]

Originally posted by turtle777:
Accepted.

Did you really think I was serious with "getting a new mom" ?

-t

No, I thought you seriously didn't understand what SC said.
I was trying to help with your comprehension.

[turtle777]

Originally posted by brapper:
I was trying to help with your comprehension.

Hm, maybe next time

-t

[effgee]

Originally posted by brapper:
No, I thought you seriously didn't understand what SC said.
I was trying to help with your comprehension.

**raiseshandwithbrapper**

Dangit - them' Turtles got me all 'fused.

[turtle777]

Originally posted by effgee:
**raiseshandwithbrapper**

Dangit - them' Turtles got me all 'fused.

Since when can you take *anything* seriously in the lounge ?

-t

[effgee]

Originally posted by turtle777:
Since when can you take *anything* seriously in the lounge?

Good point.

[olePigeon]

Buy a hardware firewall. Should solve 90% of your spyware problems. Linksys or Netgear work great. Netgear has one up on Linksys by providing a real VPN.

[ManOfSteal]

Originally posted by milhous:
just released today by microsoft:

Microsoft Windows AntiSpyware (beta)

This is the software they acquired from the acquisition of Giant Company Software, correct?

Interesting.

[brapper]

Originally posted by ManOfSteal:
This is the software they acquired from the acquisition of Giant Company Software, correct?

Interesting.

Don't work wid Windows Me anyhow..
But yeah, I believe you're correct.