Help with Spyware integrated into IE and possibly Windows XP

[Mary Rauscher]

I am having a problem with a particularly nasty case of
Spyware. It's somehow hacked into Internet Explorer and
how has its own toolbar option which I can't get rid of,
and which often pops up again and again, despite me
continuing to close it. It opens a menu bar in the top
right of the screen when Windows first starts up, and
when I start IE, a menubar with a lot spam sites
bookmarked shows up on the bottom of the screen. This
particular spyware/adware also periodically adds a ton of
spam sites to the Favorites in both IE and Netscape.
Is there anyway to delete this? I can't find it anywhere,
and no matter what I do (from searching the hard drive
manually, to running a virus program and two spyware
removal programs) I can't get rid of this program!! It's
very annoying, not to mention I'm afraid that private
information is being obtained by this spyware, and this
is a work computer.
Please help!

 

[Jupiter Jones [MVP]]

Mary;
Try #5 & #6 on this link:
http://www3.telus.net/dandemar/Slowcom.htm

 

[Mary Rauscher]

I just added Ad-aware and Spybot today, and ran the
parasite scan, but none of the three worked.
What I have does sound like a parasite though, from the
description on the page.
Is there any other programs or sites I could try? I've
had this thing for maybe 6 months now and have been
trying everything to shake it, so it can't be a terribly
new parasite.

At any rate, thanks for your help and fast reply!

Mary

 

[JButton]

Mary,

If none of these seem to work, I suggest a reformat.
Spybot and Adaware are pretty much the top two... Just
make sure you have upgraded to the latest includes and
that you do deep scans of the registry and your hard
drives. It should take a while.

Jeremy

 

[Doug Knox MS-MVP]

Mary,

See www.dougknox.com, Win XP Utilities, Startup Programs Tracker. This
small utility scans your system for startup programs and running processes.
It also allows you to create a log file that can be copied and pasted into a
newsgroup post. The contents of the program window are also copied to the
Windows Clipboard, automatically. Generally, for newsgroup posts, its not
necessary to include the list of Running Services.

You can also use Start, Run and enter MSCONFIG Go to the Startup tab and
look for likely items there, and disable them. Continue until you've found
the problem program.

 

[Mark Lawley]

I have similar problem, but do not have anexact solution
as I am still working on it. Firstly if you have
Messenger Plus added to MSN Messenger unistall this as it
brings in spyware. If your toolbar you want to get rid of
is associated with Lop.Com then Plus is one way it may
have installed itself. Two things that will help a bit is
by downloading some free anti spyware applications such
as Adaware 6 and Spybot Search and Destroy, these pick up
on spyware and other nasty unsolicited stuff. I have
used them but they are now not clearing everything out.
So I am now working though advice available on the
following link,
http://www.spywareinfo.com/articles/hijacked/
this is a very detailed site, but I am not sure there is
an easy solution. You can find software that you can buy
that says it gets read of everything but if you follow
the attached link this will give you more information. I
am sorry if this doesnt help much but its a start. If
anyone does have a quck and easy solution that works then
let me know. Good luck!

 

[ewa]

I have the same problem, it attacks favorities in
IExplorer and even loads them to favorities in Windows
Explorer.
I ran the Spyboat and Ad-Aware many times now, each time
they find something. I downloaded the Windows security
updates, but how to get rid of this?
I am lost...
The "favorities " also create shortcuts on the desktop,
in my case these are nasty porn websites, and the
shortcuts keep coming with each restart.

I will try all your recommendations, but if anyone knows
anything else pleeeeeaaaaaaaseeee heeeeeeeeeeeelllp!

Ewa

 

[Guest]

hey I am trying to remove virtual bouncer and ad destroyer. I go to remove them and they cannot be removed because some install.log file cannot be opened. I don't get it, I am wondering if they are the reason my norton auto protect features keep getting turned off after start up

 

[Shenan Stanley]

hey I am trying to remove virtual bouncer and ad destroyer. I go to
remove them and they cannot be removed because some install.log file
cannot be opened. I don't get it, I am wondering if they are the
reason my norton auto protect features keep getting turned off after
start up

You need to protect yourself a little more pro-actively as well as use some
of the spyware removal tools found in the advice below:

Turn on that firewall...
http://www.microsoft.com/WindowsXP/home/using/howto/homenet/icf.asp
If you are getting "Messenger Service" popups - this will also remedy those.
(If you have AOL, you will have to get a third party firewall. IMHO -
another reason NOT to use AOL. Although, I suggest highly that if you want
to get better protection, you should get a third party Firewall anyway, it
still does nothing for my AOL dislike.)


Make sure you have all the updates (critical) installed from:
http://windowsupdate.microsoft.com/
(Scan for updates, Review and Install)


Get rid of the spy/ad/mal-ware..
(Yes - using MORE than one of these.. I recommend at least the first
three.)

Spybot Search and Destroy
http://www.safer-networking.org/

Lavasoft AdAware
http://www.lavasoft.de

Hijack This!
(For browser Hijacks - also look into CWS Shredder)
http://mjc1.com/mirror/hjt/

SpywareBlaster (to help prevent getting reinfected)
http://www.javacoolsoftware.com/spywareblaster.html

And Assortment of Others:
http://www.merijn.org/downloads.html


After you cleanup your PC somewhat of spy/ad/mal-ware, verify your antivirus
software is updated and run a full scan of your computer. If you have no
antivirus software - get one NOW!
http://www.grisoft.com/us/us_dwnl_free.php


Empty your Temporary Internet Files and shrink the size it stores to about
80-120MB..
- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section, do the
following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the "Amount of disk space to use:" to
something between 80MB and 120MB. (Betting it is MUCH larger right now.)
- Click OK.
- Click on "Delete Files" and select to "Delete all offline contents"
(the checkbox) and click OK. (If you had a LOT, this could take 2-10 minutes
or more.)
- Once it is done, click OK, close Internet Explorer, re-open Internet
Explorer.


Uninstall any software you do not use often/ever. (If you have something
installed but never use it, uninstall it. If you go through Control
Panel -> Add/Remove Programs and see things you seldom if ever use, it is to
your advantage to remove it.)


Update all of your hardware drivers (find the manufacturers of your video
card, motherboard, sound card, modem, network card and so on - go to their
web pages, look for Windows XP drivers there and download/install the newest
ones.)