Hi everyone,

I accidentally mis-clicked on a pop up and ended up installing a whole bunch of nasties. I won't go into the rant about how this wouldn't have been possible on a computer with a real operating system...

Anyhow. I got everything working again. There were a couple of viruses and a bunch of spyware installed.

I've used Adaware, Hijack This and Spybot S&D and none of them finds anything. Actually, Spybot S&D keeps finding these two things:

IGetNet
Common Hijacker

I don't think these are the cause of my problem, because Spybot shows they are "redirected host" type problems.

I remove them, but they keep coming back, even if I remove them in Safe Mode.

I'm getting a pop-up IE window every 5 minutes or so. I can't find any processes running that is causing this. It's driving me absolutely crazy.

PLEASE someone, how can I find out why IE is starting up on its own and showing me an ad. I can't figure this out...

Thanks in advance,

Jim

Dust off and nuke the site from orbit. It's the only way to be sure.

Um. To use the cliched phrase, "Post a hijackthis log".

Also make sure you've cleared out your trusted sites lists and set all the security levels bask to the defaults.

Matthew

No kidding!

What a ridiculous piece of junk.

Anyhow, wonders never cease. I "fixed" the problem (or so it seems, so far) by installing SP2. So, the people who caused the problem actually fixed it. Amazing. And you thought that Microsoft just made things worse and worse.

Of course, I still have absolutely no idea what was going on.

In the process, I learned about an antispyware tool I hadn't used before: Intermute's Spy Subtract . It's commercial-ware, but with a 30 day trial. It detected a few things (mostly registry keys) that Spybot, Adaware, and HiJack This all missed.

The fact that whole segments of the software industry continue to thrive as a result of extremely poor quality of Microsoft amazes me. If it were *any* other product area, the poor quality source of all the problems would be replaced. Because of 3rd party software, this isn't happening "on the desktop". Instead, people keep bandaging their critically wounded patient.

The internet will kill Microsoft. Not in the way they fear, however. It will be because the globally connected world magnifies the poor quality and reliability of the MS products. They will not be able to fix this without losing their stranglehold on the market -- their 3rd party software dominance. To fix these problems, Microsoft will need an entirely new platform; they can't polish this turd enough. When they do that, they lose the backward compatibility and the development environment investments won't matter because everything will need to be ported.

I can't wait to see Microsoft delisted from Nasdaq.

Jim

Just to say this after the fact, but one should never install SP2 if you've got a spyware problem. I do a lot of helpdesk work, and it seems that the only way to really screw things up when installing SP2 is to install it over a mess of spyware.

Matthew

Hi there,

I highly recommend "Scan Spyware" from http://www.scanspyware.net/ It's commercial software ($30) but they do have a trial version (don't know how functional it is though)

After running Ad-Aware, I then run Scan-Spyware. Always finds loads more stuff and has never failed to remove it.

Cheers, Sim

I take it you've been watching 'Aliens' a lot lately, Tony?

You know, as of about 10 minutes ago I'd be with you on the FF=impenatrable. I run M$ Anti-Spyware Beta, more as a test of it before my other users (most have gotten it now). I come in this morning and it tells me I've got a case of Comet Cursor. Now, I did not click any pop-ups or anything like that. I've no idea how this happened, but FF is not a silver bullet. Better yes. Perfect, no.

My system sits behind a Sonicwall Soho3, and runs XP SP2 (but admitedly the FW software was not on)- I have several centrally administered pieces of software - most notably my virus scanner - McAfee 8, corporate edition and hadn't bothered to look up which ports it needs.

<SIGH> No magic bullets. (yeah yeah linux/MAC....)

-Zeke

I am running Adaware 6.0 with the latest update file.

Thanks for all the suggestions, everyone. I was extremely frustrated last night. I can't figure out how it was happening. There didn't seem to be any process running, or any indication of where a process might be invoked.

I've had IE open now for about 7 hours and there hasn't been a popup.

I guess I got lucky with the SP2 install, but I did get rid of everything I could find first.

Jim

Well, I consider myself a fairly competent computer user. I think the spyware/adware is getting much more sophisticated. So, I'd like to think that your boss isn't *necessarily* a pointy-haired boss, or at least that not being able to remove the popup stuff doesn't make him one...

J

Yeah, you have a point.

Quote:
Dust off and nuke the site from orbit. It's the only way to be sure.

Thinking of this, I just ponied up for a 12 seat license of Symantec Ghost Suite, and I have to say I'm pretty impressed. I hadn't looked at Ghost since 2001 (when I ended up using RIS). This time RIS was being more trouble than it was worth. I'd like to have a solid setup where I can just re-image within an hour back to a working desktop. I think Ghost can get me there, but I've only had it a day or two.

-Zeke

Beat you to it

I'd agree with everything you've been doing except McAfee. I have no good will towards that program. I've never seen anything good about it. Plus, if you have AVG I don't see why you need McAfee.

Similar to your methods: I've built computers for several people, and aside from Windows+updates and whatever software (Office, etc) that they want, I simply install Ad-Aware, AVG, and the Google Toolbar (with a hearty recomendation for Firefox). So far I have heard of zero problems from any of the people I've built systems for, and after as much as one to two years.

Quote:
I'd agree with everything you've been doing except McAfee. I have no good will towards that program. I've never seen anything good about it. Plus, if you have AVG I don't see why you need McAfee.

I'll second (and third, and foutrh) That! I had been using the same Mcafee, and during my 'pain and suffering' last week, I had ran and re-ran full scans. Mcfee said everything was cool... I then ran AVG and it found 4 trojans and 7 virus'! I was ticked...
I will say that the beta spyware tool from MS seems to work well... It found 3 cases of spyware that AdAware did not. Choose your own tools, but I won't choose Mcfee anymore...

I use both McAfee and AVG because both will find things that the other missed when scanning someone elses PC. I'm currently testing Mcafee 8 and Nod32. Nod32 is 10 times faster at doing a full system scan. Oh and any version after McAfee 8 is total CRAP.

Ok...I am now having a spyware problem that I cannot get rid of. When I search for something with Google, it will redirect me to www2.popupsearches . I have tried getting rid of it with Spybot, Ad Aware, and the Microsoft one, but it is still there.It is frustrating....has anyone else had any success getting rid of it?

Try seeing if you can identify it with Hijack This!.

If HiJack This doesn't help Download Agent Ransack from http://www.mythicsoft.com/agentransack/ and do a search for files containing text popupsearches once you find the file on your hard drive you can then search the registry and have point it back to the correct host file.

There was another one that somebody from this site recommended a long time ago, but I can't remember what it was. It was one that scanned my computer from the website, you don't actually download the software. Anyone know which one this is?

housecall.trendmicro.com

There was a great link on /. in case you missed it which cited a great plan to rid/stay clean from spyware for Windows users. I've followed a very similar methodology with great success so far.

The one other tool I would suggest is WinPatrol 9.0. Which is a watchdog over critical system areas alerting you and giving you the option to allow/deny (ala Zone Alarm) access to those items. Good stuff.

Enjoy. Updated often, Immunize.
T

Hmm, I just found this on /.

"As of April 4, 2005 the SANS Internet Storm Center has raised their alert level to Yellow following a rash of active DNS poisonings. The infected DNS servers are re-directing users from popular sites such as Google or American Express to malware infecting advertising sites. According to the ISC presentation on the attack, it is believed to be linked to known spammers and malware distributors. The full presentation of information up until this point can be found here."

http://it.slashdot.org/article.pl?sid=05/04/06/170233&tid=95&tid=172&tid=218

Maybe this is your issue. I would recommend running Bind-PE (just noticed it's been renamed to TreeWalk DNS) on your local PC. I've been running it on my box for the past year and it works great. Just remember to update your root zone file about once a month.

Wow.. a whole universe out there that I never get to experience. Oh well.

Don't you wish you could be in the club??

I wish I had the patience for Linux, I really do. But I don't feel like trying out all those different types of programs again to see which ones I like, and I don't want to dual-boot. And the thought of trying out several different OSs to begin with does not get me excited.