Re: spysweeper keeps popping up asking to remove/keep startup item

From: Sean (Sean_at_discussions.microsoft.com)
Date: 11/16/04


Date: Tue, 16 Nov 2004 06:18:03 -0800

Hey
Tahnks for that. I ran those 2 programs and it got rid of it. The adware
was called CommonName. Thabks again
Sean

"Malke" wrote:

> Sean wrote:
>
> > Hi
> > On my windows XP Professional PC I have spysweeper installed. While I
> > am working away it keeps popping up asking to keep or remove various
> > startup
> > items. Its a different startup item name each time. These are the
> > details of the item:
> > Startup Item: egFHY9Ex (This name changes each time)
> > inetkw
> > CommonName
> > Location: C:\PROGRA~1\vowpuqt\qpwostw.exe
> > Registry or startup Folder: HKLM:Run
> >
> > Any ideas of what it can be? Ive turned off spysweeper for the
> > monent.
>
> You have malware on your computer. It is common for trojans and/or other
> non-viral spyware to spawn randomly-named copies of themselves. Just
> killing the one .exe won't get rid of the root problem; you need to
> really clean the computer. Here are general removal steps:
>
> 1) Scan in Safe Mode with current version (not earlier than 2003)
> antivirus using updated definitions;
>
> 2) remove spyware with Spybot Search & Destroy
> (www.safer-networking.org) and Ad-aware (www.lavasoftusa.com). These
> programs are free, so use them both since they complement each other.
> There is a new version of CWShredder from
> http://www.intermute.com/spysubtract/cwshredder_download.html. I would
> not install the other Intermute programs, however. Alternately, there
> are CoolWebSearch malware removal steps at
> http://www.silentrunners.org/sr_cwsremoval.html. A combination of
> HijackThis and About:Buster (http://www.majorgeeks.com) works well in
> removing homepage hijackers. Always read the instructions before
> running a spyware removal tool. Be sure to update these programs before
> running, and it is a good idea to do virus/spyware scans in Safe Mode.
> Make sure you are able to see all hidden files and extensions (View tab
> in Folder Options);
>
> 3) If you are running Windows ME or XP, you should disable/enable System
> Restore because malware will be in the Restore Points. With ME, you
> must disable System Restore completely. With XP, you can delete all but
> the most recent (presumably clean) System Restore point from the More
> Options section of Disk Cleanup (Run>cleanmgr).
>
> 4) make sure you've visited Windows Update and applied all security
> patches. Do not install driver updates from Windows Update;
>
> 5) run a firewall.
>
> Malke
> --
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
>



Relevant Pages

  • Re: RUNDLL Error
    ... Malke Wrote: ... I have performed a system restore to date ... See below for HijackThis links. ... Do not install driver updates from Windows Update. ...
    (microsoft.public.windowsxp.general)
  • Re: Cutting & Pasting - Strange Problem
    ... >> Thanks Malke. ... Very often they are malware. ... > the most recent System Restore point from the More ... Do not install driver updates from Windows Update; ...
    (microsoft.public.windowsxp.general)