Re: scumware

From: Chuck (none_at_example.net)
Date: 05/21/04


Date: 21 May 2004 16:50:08 -0500

On Fri, 21 May 2004 12:41:02 -0700, andres <anonymous@discussions.microsoft.com>
wrote:

>I have a virus that is not letting me to any site where I can download Lavasoft's ad-aware program.
>I have what I think is a spyware virus that has installed its "ISEARCH" toolbar in my browser and is not letting me download ad-aware.
>
>I did download and run spy-bot, and it found stuff but did not get rid of this ISEARCH spyware.
>
>Any sugestions?
>Thanks,

Andres,

You downloaded Spybot, but did you update it successfully? If your malware
blocked AdAware, it could interfere with Spybot updates. Try all Spybot mirrors
for updates.

Try these free online virus scans, hopefully not all sites should be blocked:
<http://www.bitdefender.com/scan/license.php>
<http://www.pandasoftware.com/activescan/com/activescan_principal.htm>
<http://security.symantec.com/ssc/home.asp>
<http://housecall.trendmicro.com/housecall/start_corp.asp>

Download McAfee Stinger, available at:
http://download.nai.com/products/mcafee-avert/stinger.exe
If necessary, download Stinger onto a clean computer, and copy it to a floppy or
other removable media.

Now check for, and learn to defend against, additional carriers of infection.
Have you downloaded these programs before? Download them again, as many are
revised frequently, to keep up with the current level of malware being attempted
constantly - get the absolutely most current version of each product listed.
They're all free - and most pretty small, so they download quickly enough.

First, download LSP-Fix and WinsockXPFIx from <http://www.cexx.org/lspfix.htm>,
and CWShredder from <http://www.majorgeeks.com/download4086.html>. All are
free.

Next, close all Internet Explorer and Outlook windows, then run CWShredder.
Have it fix all variants.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155> and Spybot S&D
<http://www.safer-networking.org/index.php?page=download>. Both free.
1) Install and run Spybot. First update it ("Search for updates"), then run a
scan ("Check for problems"). Trust Spybot, and make all recommended deletions.
2) Install and run HijackThis. Do NOT make any changes immediately. Save the
HJT Log.
3) Have your HJT log interpreted by experts at one or more of the following
forums (and post it here):
<http://forums.net-integration.net/>
<http://www.spywareinfo.com/forums/>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Finally, improve your chances for the future.

Harden your browser. There are various websites which will check for
vulnerabilities, here are three which I use.
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/
https://testzone.secunia.com/browser_checker/

Harden your operating system. Check at least monthly for security updates.
http://windowsupdate.microsoft.com/

Block possibly dangerous websites with a Hosts file. Three Hosts file sources I
use:
http://www.accs-net.com/hosts/get_hosts.html
http://www.mvps.org/winhelp2002/hosts.htm
(The third is included, and updated, with Spybot (see above)).

Maintain your Hosts file with:
eDexter <http://www.accs-net.com/hosts/get_hosts.html>
Hostess <http://accs-net.com/hostess/>

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.



Relevant Pages

  • Re: PERFECTNAV.COM
    ... Download, UPDATE before running, and run: ... Be sure that you also download and install hotfix Q816093, ... Another excellent program for this purpose is SpyBot Search and Destroy ... Spyware and Hijackware Removal Support, ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Home Page is not working
    ... CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). ... Download, UPDATE before running, and run: ... Be sure that you also download and install hotfix Q816093, ... Spyware and Hijackware Removal Support, ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Internet Explorer Home Page Driving Me Crazy
    ... CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). ... Download, UPDATE before running, and run: ... Be sure that you also download and install hotfix Q816093, ... Spyware and Hijackware Removal Support, ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Home Page Problems
    ... CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). ... Download, UPDATE before running, and run: ... Be sure that you also download and install hotfix Q816093, ... Spyware and Hijackware Removal Support, ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Home Page "about:blank"
    ... CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). ... Download, UPDATE before running, and run: ... Be sure that you also download and install hotfix Q816093, ... Spyware and Hijackware Removal Support, ...
    (microsoft.public.windows.inetexplorer.ie6.browser)