fake favorites

[Linda]

They were getting the famous pron pop-ups so they ran Ad Aware, I deleted
the cookies and temp files and history. They are runnning a current virus
scan also.
There is a folder named Favorites that you see when you click to open
favorites and it has links to porn sites - I have deleted it directly from
the browser - it returns. I deleted it through Windows Explorer and the
Documents and Settings - Favorite (it was under several profiles) but it
returns when you reopen IE 6.
How do you get rid of this? Is there a reg change or something? Ad Aware
could not fix it.
Because it is there the computer keeps getting re-infected with pron.
The porn is a big problem for a lot of people - course I think these guys
brought it on themsleves by surfing it - still - it is easy to mistype and
end up with it on any computer. Seems that this problem will have to be
addressed at the ISP level to get resolved on the Internet has it evolves
too fast for the average user to keep up with.
Thanks

Linda

 

[Jim Byrd]

Hi Linda - Well, you kinda need to know what the parasite(s) is/are before
you can do much about fixing them except to apply some general tools like
AdAware and/or SpyBot S&D (see below). Start here:


Download HijackThis, free, here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip it to any convenient folder, start it then press Scan. Click on
SaveLog when it's finished which will create hijackthis.log. Now click
the Config button, then Misc Tools and click on Generate StartupList.log
which will create Startuplist.txt

Go to Spyware and Hijackware Removal Support, here:
http://www.spywareinfo.com/forums/index.php?s=8a236cdf61469fbad3bddbe810be0374&act=SF&f=11

Sign in, then copy and paste both files a message asking for assistance,
Someone will answer with detailed instructions for the removal of your
parasite(s).



For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here: http://www.lavasoftusa.com/support/download/.
Update and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others.


Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.wilderssecurity.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it updated) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Both Very Highly Recommended.

See if any of this helps and post back with your results.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Linda]

Will any of these be able to edit/delete the Fake Favorites links in IE?
More specifically the new/fake favorites folder that is under the regular
Favoites on the tool bar?
Ran Ad Aware which found and removed some items but not these - this is
different - is there a place in the registry where the entires to the
folders are keep?
Even deleting the folder under documents and settings (all users and all
profiles) as well as in the browser window does not perminately delete the
links - they reappear when you close and reopen IE. Something is re-writing
them. From there I think it is reloading the pages.
I did empty the cashed info, cookies and history.
Linda

 

[Jim Byrd]

Hi Linda - Just follow the HijackThis procedure that I outlined in my
previous post.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In