New Adware/Spyware/Malware

[Guest]

A few days ago I picked up some adware/spyware/malware while surfing the net. Whenever I go into IE, my start-up page has the address "about:blank", and a variable (and sometimes lewd) pop-up appears saying that my computer is infected with spyware. I have both Ad-aware and Spyware Seek & Destroy software. Ad-aware picks up infected registry values in the following placesHKEY_LOCAL_MACHINE:software\microsoft\internet explorer\main\ and HKEY_CURRENT_USER:software\microsoft\internet explorer\main\ ). Spyware picks up numerous "DSO Exploits". Though both programs pick up malware, neither one fixes the problem (though both give the option of erasing the files post scan, subsequent scans after visiting the internet again or restarting the computer show the same problems). I've also attempted to go into the registry editor and delete suspicious values (regarding my home page, start page, search page, etc.) under the aforementioned keys, but to no avail. I've tried resetting my homepage - no luck. I've also tried to go under Start-Control Panel-Add and Remove Programs. Here I found a program called Spyware/Adware. When I try to remove/uninstall this program, it doesn't give me the option, instead I am automatically put onto the internet and a web page appears for "Spyware Remover Gold". Nothing I've tried is working. Norton Antivirus doesn't pick up anything at all. Please help!

-Ryan

 

[Guest]

this is EXACTLY what is happenint to me!! i have adaware, spykiller, and the zone alarm firewall. please, please - help us get rid of this insidious thing!!!

 

[Guest]

Just wanted to add that all my Norton/Ad-aware/SpyBot Seek&Destroy is up to date. Also, I can't download the google toolbar at present - it goes through the entire process of downloading, and appears to be complete, but the toolbar won't show up (it's not hiding and the google toolbar option is checked under the "view" tab).

 

[Guest]

I've had the same thing happening to me for about a week now. I've installed and ran 3 different spyware blockers that are finding objects, fixing them, but still it returns. What's going on?

 

[Guest]

Here's another update: Based on advice given to others in the newsgroup, I've just attempted to go to the websites for CWSShredder, HijackThis, SpywareBlaster, and www.kephyr.com/spywarescanner/library/huntbar. IE or whatever malware has hijacked IE will not allow me to go to these sites - I get the old "This page is currently not available" message. I also wanted to mention that the firewall suggested by microsoft's "Three steps to protecting your PC" is up and has been up for many moons. And all of my attempts to fix my adware/spyware/malware problems have been with the system restore off.

-Ryan

 

[Guest]

Try CWShredder form here:
http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder
Alternate Download site:
CWShredder - http://209.133.47.200/~merijn/files/CWShredder.exe
Alternate Download site:
CW Shredder - http://aumha.org/downloads/cwshredder.zip

SPYWARE INFO-HELPFUL LINKS
http://www.spywareinfo.com/~merijn/
http://mvps.org/winhelp2002/unwanted.htm
http://www.doxdesk.com/parasite/
http://www3.telus.net/dandemar/index.htm
http://www.cexx.org/noadware.htm
http://www.aumha.org/
http://www.mvps.org/winhelp2002/hosts.htm

A few days ago I picked up some adware/spyware/malware while surfing the

net. Whenever I go into IE, my start-up page has the address "about:blank",
and a variable (and sometimes lewd) pop-up appears saying that my computer
is infected with spyware. I have both Ad-aware and Spyware Seek & Destroy
software. Ad-aware picks up infected registry values in the following
placesHKEY_LOCAL_MACHINE:software\microsoft\internet explorer\main\ and
HKEY_CURRENT_USER:software\microsoft\internet explorer\main\ ). Spyware
picks up numerous "DSO Exploits". Though both programs pick up malware,
neither one fixes the problem (though both give the option of erasing the
files post scan, subsequent scans after visiting the internet again or
restarting the computer show the same problems). I've also attempted to go
into the registry editor and delete suspicious values (regarding my home
page, start page, search page, etc.) under the aforementioned keys, but to
no avail. I've tried resetting my homepage - no luck. I've also tried to
go under Start-Control Panel-Add and Remove Programs. Here I found a
program called Spyware/Adware. When I try to remove/uninstall this program,
it doesn't give me the option, instead I am automatically put onto the
internet and a web page appears for "Spyware Remover Gold". Nothing I've
tried is working. Norton Antivirus doesn't pick up anything at all. Please
help!

 

[Bruce Chambers]

Greetings --

The DSO exploit was patched long ago by IE Cumulative Update
MS02-015, in March of 2002. If you've installed this specific patch,
or any subsequent IE Cumulative Updates, or Service Pack 1, you're
safe. It would appear that the latest version of Spybot S&D is only
checking for Internet zone settings in the registry that could be used
as work-around protection, and not for the presence of any corrective
patches. Hopefully, the makers of Spybot will soon fix this bug.

MS02-015 March 28, 2002 Cumulative Patch for Internet Explorer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;319182

If you like, you can test your system for this particular
vulnerability at this web site:
http://www.greymagic.com/security/advisories/gm001-ie/

The makers of SpyBot S&D have acknowledged the problem and will
fix it on their next update:
http://www.safer-networking.org/index.php?page=paragraphs&detail=currentfaqs


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

A few days ago I picked up some adware/spyware/malware while surfing

the net. Whenever I go into IE, my start-up page has the address
"about:blank", and a variable (and sometimes lewd) pop-up appears
saying that my computer is infected with spyware. I have both
Ad-aware and Spyware Seek & Destroy software. Ad-aware picks up
infected registry values in the following
placesHKEY_LOCAL_MACHINE:software\microsoft\internet explorer\main\
and HKEY_CURRENT_USER:software\microsoft\internet explorer\main\ ).
Spyware picks up numerous "DSO Exploits". Though both programs pick
up malware, neither one fixes the problem (though both give the option
of erasing the files post scan, subsequent scans after visiting the
internet again or restarting the computer show the same problems).
I've also attempted to go into the registry editor and delete
suspicious values (regarding my home page, start page, search page,
etc.) under the aforementioned keys, but to no avail. I've tried
resetting my homepage - no luck. I've also tried to go under
Start-Control Panel-Add and Remove Programs. Here I found a program
called Spyware/Adware. When I try to remove/uninstall this program,
it doesn't give me the option, instead I am automatically put onto the
internet and a web page appears for "Spyware Remover Gold". Nothing
I've tried is working. Norton Antivirus doesn't pick up anything at
all. Please help!

 

[Guest]

You can also try to use "Hijackthis" at http://www.snapfiles.com/dlnow/dlnow.dll?Inc=No&ID=106738 Look up "Hijackthis.exe"with your search engine or use this link.

Used in combination with Adware, I have had great success in either locating and deleting 99.9% of these malicious (my opinion) scripts.

Right now I have to go thru all of my clients' websites to make sure they haven't been bitten by the latest bug.

 

[Guest]

THAAAAAANK YOU! The re-route to the CWSShredder worked well. I appreciate the help.

-Ryan

 

[Guest]

At this point, I no longer have a hijacked search page - the CWSShredder helped. I was able to download the google toolbar, and I don't have the annoying pop-ups. Spybot Search&Destroy is still finding multiple "DSO Exploits" with each pass, and says its deleting them, but continues to find them. What are they, and how do I get rid of them. Also, the Adware/Spyware program seems to be permanently affixed - I still can't delete it from my "Add and Remove Programs" option in the control panel (it just refers me to a website for "Adware Remover Gold"). What do I do about this.