Spyware and Popups

K

Kathy

I am having the following troubles relating to advice I
received (the string of communication follows).any input
would be great.

1. When I go to: http://www.kellys-korner-
xp.com/xp_tweaks.htm

it gives 6 different options to go to at the top, 5
options at the bottom, or I can scroll down a list of 331
items to troubleshoot. There is not merely one spot
to "download." Any ideas?

All the other things suggested to rid me of spyware and
popups I have done (suggestions are at the bottom of
this) and I am still in the same boat. In fact, anytime
I log online I follow it by running all the below
programs and always have new things to delete/fix.

2. When I right-click on the network icon I do not get
a "properties" option to click on. Any ideas for
checking to see if my firewall is activated? And, will
Norton work with the firewall activated?


Thanks.
Kathy
______________________________

----Original Message-----
Download and run.

--
All the Best,
Kelly

Microsoft-MVP Windows® XP
2004 Windows MVP "Winny" Award

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm


(e-mail address removed)> wrote in message
Hi,

I did all you mentioned except for the CWShredder as I
was unable to determine what option I need to select once
in the site you gave. Could you elaborate for me on what
to do once I am in the site? Thanks! Kathy


-----Original Message-----
Hi Kathy,

It is called Spyware. Start here and run each of these,
it takes a combo and besides, you may be surprised it
what is found on
your system. :blush:)
Click to expand...

Ad-Aware
http://www.lavasoftusa.com/

Spybot
http://tinyurl.com/btf8

CWShredder (Line 313)
http://www.kellys-korner-xp.com/xp_tweaks.htm

Hijack This
http://www.spychecker.com/program/hijackthis.html

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

--
All the Best,
Kelly

Microsoft-MVP Windows® XP
2004 Windows MVP "Winny" Award

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

_________________

message

I am using Explorer 6.0 and XP. This weekend I Suddenly
have pop-ups happening even when I don't have Explorer
launched (but am connected to server for email/Outlook).

In addition, instead of Yahoo.com being my default window
for Explorer (as I have had set), something
called "allaboutsearching" comes up. Even after I reset
it to yahoo.com, an additional window for
allaboutsearching appears. I checked for viruses and
have none. I ran spybot.com to get rid of anything that
might have attached itself to my system. After both
these actions I still am having troubles. What do you
suggest? Would clearing out cookies work? Should I try
to uninstall and reinstall explorer? What can I do?
This is horrible and I ahve never had such troubles
before. I can barely type a couple sentences in an email
when a popup appears and messes up my system. I
Cannot begin to use my computer for business tomorrow
(which is how I make my living). Please help!

Desperately,
Kathy


Hi,

When I right-click on the network icon I do not get
a "properties" option to click on. Any other ideas?

Thanks!
Kathy

-----Original Message-----

Aside from the spyware side, make sure that you have the
firewall up and working. Go to Control Panel - Network
Connections, r-click on the icon for the connection to
the Internet, take properties. On the Advanced page
check the top box 'Protect my computer'

Some of these messages come in direct that way - and more
importantly
indicate that it is open to things like the Blast and
Sasser worms
 
C

CWatters

Regarding...
I did all you mentioned except for the CWShredder as I
was unable to determine what option I need to select once
in the site you gave. Could you elaborate for me on what
to do once I am in the site? Thanks! Kathy
Click to expand...

and Kelly said....
CWShredder (Line 313)
http://www.kellys-korner-xp.com/xp_tweaks.htm
Click to expand...

Ok so what he means is go to his site by following the link above and then
scroll down to his tip number 313. This line says...

"313. CWShredder version 1.59.0IE Crashes - Browse in New Process"

Right click on the word "CWShredder" and select "Save target as" then
navigate to a suitable folder (or create one) and click on save. That will
download a zip file containing the program Kelly thinks will help you.

You then need to uncompress the program using a program like winzip and run
it.

Colin
 
P

Phil

Kathy said:
I am having the following troubles relating to advice I
received (the string of communication follows).any input
would be great.

1. When I go to: http://www.kellys-korner-
xp.com/xp_tweaks.htm

it gives 6 different options to go to at the top, 5
options at the bottom, or I can scroll down a list of 331
items to troubleshoot. There is not merely one spot
to "download." Any ideas?
Click to expand...

You click on one of the 331 items(the words) to download it.
All the other things suggested to rid me of spyware and
popups I have done (suggestions are at the bottom of
this) and I am still in the same boat. In fact, anytime
I log online I follow it by running all the below
programs and always have new things to delete/fix.
Click to expand...

Make sure to update all the spyware removal tools before running them. Also
make sure to have a firewall and pop-up blocker running and active at all
times. The firewall stops messenger service pop-up ads. Also check msconfig,
startup tab, and uncheck anything you don't want starting. Do a virus scan
as well with an updated program, like AVG.
2. When I right-click on the network icon I do not get
a "properties" option to click on. Any ideas for
checking to see if my firewall is activated? And, will
Norton work with the firewall activated?
Click to expand...

If you have AOL for your isp then you can't use the xp firewall. AOL doesn't
work with it, you'll need a third party firewall.
 
J

Jim Byrd

Hi Kathy - Sounds like this might be a variant of some malware called
CoolWebSearch (if CWShredder doesn't fix it, then see AdAware, SpyBot, and
HijackThis, below, in that order). Do the following:



Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)


The process of removing certain malware may kill your internet connection.
If this should occur, this program, LSPFIX, will enable you to regain your
connection.



Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.



However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

Both of these programs should normally be UPDATED and run after doing any
other fix such as CWShredder and, as a minimum, normally at least once a
week.



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended


Finally, go to Windows Update and ensure that ALL Critical updates are
installed.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
K

Kathy

Hi,

How do I get to:

check msconfig,
startup tab, and uncheck anything you don't want starting.

Thanks!
Kathy
 
P

Phil

Click on the start button, click on run, type in: msconfig -- hit enter,
click on startup tab.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Who Dat? 6
Enable administrative privileges 7
deleted folder out of recycle bin 1
Always show icon on the taskbar!!! 5
Display Properties - Desktop 6
AVG Cripples XP 6
Need help with Media Center 3
not the sasser worm again 3

Top