Re: suspicious PC behaviour...

From: Moe Trin (ibuprofin_at_painkiller.example.tld)
Date: 12/24/04 

Date: Fri, 24 Dec 2004 16:30:42 -0600

In article <1103826726.684552.249110@c13g2000cwb.googlegroups.com>,
heruti wrote:

>after not scanning for 'bots for several months (a wholly smart move in
>itself...) I did a scan using S&D, which found several
>marketing / surf tracking 'bots in IE.

Why did you install the 'bots' in the first place? Are you blindly
clicking "OK - Install the spyware/bot because I haven't a clue" or
have you got your browser auto-installing stuff for you because moving
the mouse to click on the "OK" or "Cancel" is to much work? This stuff
doesn't auto-install unless you have configured your computer to do so.

>I checked the repeat delay / repeat rate settings and they were on
>minimum delay/max rate as always.

I think you have that backwards. Max delay, because you have to hold the
key for the maximum amount of time before it starts auto-repeating, and
Min rate - so that it's slow enough for you to realize you are pressing
the key. Try it the other way.

>could this be some keystroke tracking spy sitting in my midst, thinking
>I do not know it is there? with a somewhat imperfect interrupt
>algorythm?

Possible - but it could also be a hardware problem. Get a bootable CD
and try loading a different operating system/version. Do you still have
the same problem? If so, fix the hardware (I suppose it _could_ be a
BIOS setup problem, but not very likely). If the problem goes away, the
easy solution is to wipe the disk and reload from scratch (including all
applicable service packs, etc.). Then configure your system to not
auto-install every piece of software thats made available to "improve
your surfing experience".

>I ran S&D again and also some others. No improvement.
>any insights...

Most of these tools are looking for very specific characteristics, even
bit patterns on the disk. If the virus/trojan/spyware changes even a small
amount, your tool won't necessarily find the "new" version. That's why the
definition files are being updated so often. But the correct solution is
to not install the virus/trojan/spyware in the first place.

        Old guy