More spyware

[Harkoliar]

Originally posted by Cerek: Yeah, I know I screwed up by clicking inside the ad instead of just clicking the "X". I just had a brain cramp and wasn't thinking. The "spybuster" icons come back on my desktop after each restart. Here is what is showing up: Evidence Eraser Popup Blocker Spyware Avenger Virus Hunter Security I don't have my own firewall installed, but I just got DSL service this week - and it is supposed to come with MSN Premium, which provides a firewall, popup blocker and virus scanner. Maybe these new icons are actually legit and part of the MSN package - but they didn't show up when I activated my DSL connection. They showed up after I got hit with the spyware last night.

get zone alarm and winxp SP2 firewall. it will protect you..

[philip]

If those icons return after boot they're in your registry. If adaware and spybot try HiJackThis. It'll give you a list of what starts up. Then you can clean out the spyware from there. But be careful with it, if you're not sure what an entry does don't delete it and google or ask.

[Bungleau]

Do you have a restore point available from before you launched into this sorry mess? If so, restore to it. If not, you've learned (as I recently did) that there's really no such thing as too many restore points... [img]smile.gif[/img]

You might also try booting up in safe mode instead of logging in normally. They may not have infected you there.

For reference, I also have Popup Killer, a piece of freeware that's really no longer supported or maintained, but does a good job of nuking popups. When one of these critters comes up, I go in to Popup Killer to close it -- it has a nice display of everything that's running, and when I close it, it also adds it to the blacklist, preventing it from darkening my doorway ever again.

Good luck. You have my sympathies.

[Morgeruat]

I only have a small bit to add, with Spybot S&D if you go into advanced mode there is a startup button on the tools tab, that will let you change the registry values of anything trying to start-up on your computer. Also the IE tweaks there can help prevent your browser's home page from being changed without your permission.

Being on DSL having a firewall is critical, if you've had DSL for a week with no firewall running, you can be sure that someone else has been using your computer for something. Zonealarm is a free firewall you can get from download.com

[Chewbacca]

Avast Anti Virus has stopped similiar malware in it's tracks on my PC and it is free! I use it in conjunction with Spybot, Adaware, ZoneAlarm and others. My weekly spyware/virus scans always turn up with nothing.

[ 02-19-2005, 01:11 AM: Message edited by: Chewbacca ]

[Aragorn1]

Sounds like a coolwebsearch variation, especially witht the about:blank homepage. Try CWSshredder, it got rid of the problem last time. other that that i use the above mentioned adware, spybot and zonealarm and have had no problems since installing them, particularly the zone alarm firewall.

[krunchyfrogg]

What's Spybot S&D? Where do I get it?

[Aragorn1]

Its a malware and spyware remover, and it tends to pick up what adware sometimes doesn't, giving you better all-round protecion. As for where to find it, can't remember exactly but try googling it.

[krunchyfrogg]

Cool, thanks!

Good luck, Cerek. Sorry to hear about your computer.

[Cerek]

OK - here's an update.

I did have the standard MSN XP Firewall installed and running. Sadly, I did NOT have System Restore turned on [img]graemlins/crying.gif[/img] (thought I did, but guess I was wrong). That would have made life SO much easier.

I have downloaded Avast, Hijack This, RegLite (works in conjunction with Hijack This) and Adware Away. These last two were recommended by the site I found with instructions on how to remove "about:blank". The Adware Away is supposed to remove "about:blank" and several other ultra-nasty hijackers and trojans that other software can't - but that hasn't been my experience. It seems to be a fairly comprehensive program and gives a menu choice of removing hijackers, spyware, adaware, or trojans. I can also scan the PC and send them a log of what shows up and they will provide a "custom cleanser" - but that sounds pretty "fishy" to me. In fact, I'm beginning to wonder if Adware Away might not be one of the sponsers of "about:blank" or "CoolWebSearch". That is the part that makes me the angriest - is that this hijacker recommends it's own spyware removal packages. These JERKS have the gall to infest my computer, then turn around and offer me spyware removal packages. Wish there was a way to send them a nice letter-bomb instead.

Anyway, I don't feel quite as bad about clicking on the Anti-virus popup now. It STILL comes up on a regular basis and the top address bar is greyed out - so there is NO WAY to click on the "X" at all. And even Alt-F4 won't remove it. I just have to leave it alone until I Restart the PC or Turn it OFF.

I've run Avast scans and finding LOTS of crap. Mostly getting Win32:Trojano-xxx, JS:Istbar, VBS:Malware and other viruses - most infecting the Win32 folder area.

Since removing "about:blank" automatically with "Adware Away" didn't work, I'm going to try doing it manually - but I really feel like I'm out of my league with this one. If nothing else, I may have to take the PC back to the shop and have them simply wipe the HD clean and re-install again. {sigh} I hope not. But I've spent over 4 hours (all told) so far trying to remove these programs and I can't see that I've made ANY progress.