Adware problem

[jabberjaw]

I have a computer that has had some adware problems. I
have run the recent Lavasoft Adware SE and if found
infections in the Registry, file and cookies, and deleted
them. I then rebooted and ran Adware again and it found no
infections. I also did this with SpyDoctor. But as soon as
I get back on the Internet pop-ups start and cookies are
added to my system. I found this out by just being on the
Internet for five minutes and then runnig Adware again. It
found more infections, just file and cookies and deleted
them. This happens every time. Is there a worm or some
thing in my system that changes names every time I run
Adware and delete the infections and what can I do about
this.

 

[Ted Zieglar aka \Rocky\]

Many adware/spyware programs run multiple instances under continuously
changing names. Your only hope of eradicating them is to find out the
specific name(s) of the adware on your computer and search the Internet for
specific removal tools. You may find one on the web site of the major
spyware detection companies.

 

[Chuck]

I have a computer that has had some adware problems. I
have run the recent Lavasoft Adware SE and if found
infections in the Registry, file and cookies, and deleted
them. I then rebooted and ran Adware again and it found no
infections. I also did this with SpyDoctor. But as soon as
I get back on the Internet pop-ups start and cookies are
added to my system. I found this out by just being on the
Internet for five minutes and then runnig Adware again. It
found more infections, just file and cookies and deleted
them. This happens every time. Is there a worm or some
thing in my system that changes names every time I run
Adware and delete the infections and what can I do about
this.

AdAware (NOT Adware!), and Spydoctor may not be the best tools to use here.
Spydoctor is a suspect / rogue tool, also:
<http://www.spywarewarrior.com/rogue_anti-spyware.htm>

Start by downloading each of the following additional free tools:
CWShredder <http://www.majorgeeks.com/download4086.html>
CoolWWWSearch.SmartSearch (v1/v2) MiniRemoval
<http://www.majorgeeks.com/download4113.html>
HijackThis <http://www.majorgeeks.com/download.php?det=3155>
LSP-Fix and WinsockLSPFix <http://www.cexx.org/lspfix.htm>
Spybot S&D <http://www.safer-networking.org/index.php?page=download>
Stinger <http://us.mcafee.com/virusInfo/default.asp?id=stinger>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. Spybot S&D has an install routine - run it. The other
downloaded programs can be copied into, and run from, any convenient folder.

First, run Stinger. Have it remove any problems found.

Next, close all Internet Explorer and Outlook windows, and run
CoolWWWSearch.SmartSearchMiniRemoval, then CWShredder. Have the latter fix all
problems found.

Next, run Spybot S&D. First update it ("Search for updates"), then run a scan
("Check for problems"). Trust Spybot, and delete everything ("Fix Problems")
that is displayed in Red.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and post a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[dmg]

There's an offender out there since June 2004, that is
called Twain-tech. PestPatrol says that it can be
manually disabled. Go to
http://pestpatrol.com/PestInfo/t/twain-tech/asp. If I
understood correctly, Twain-tech has Microsoft's tacit
approval, and it does not stay permanently deleted. It
can be disabled. PestPatrol tells you how at the web
site mentioned above. PestPatrol says that it threatens
your confidentiality

BackWeb is another one (a part of the OS) that has
Microsoft's approval. I deleted it from my computer, but
each time I boot I get a popup box stating that it cannot
locate such and such. I just click OK and go on my way.

When your machine is clean again:

If you don't use Windows Messenger, disable it.

If you don't have a popup stopper, get one.

Use a firewall.

HTH