Spyware - Help

[Jane Doe]

I have AVG 8 installed on my 32 bit Vista Basic and have just run a scan.
For the 1st time I have received a warning of the following spyware:

C: ProgFiles\MyWebSearch\bar\1.bin\F3SCHMON.EXE
Infection: Adware Generic3.UYY
Potentially dangerous object

I clicked heal - and received a warning that to continue may cause my
computer to crash.

What should I do? I tried installing Avast before installing the new AVG
(email scanning disabled), but I think I did something wrong and did not
feel happy with it, so have reinstalled AVG. Can I install Spybot or
Spyware Blaster or Malwarebytes and have one (or all) of them running at the
same time as AVG or are they stand-alone?

Mick Murphy 2008/09/29 06:43 AM RE NORTON OR AVG refers.

http://www.avast.com/eng/download-avast-home.html

Avast Anti-Virus is XP and Vista compatible (32bit and 64bit Versions),
FREE, auto-updating, and a low resources user of your computer.
And, only have 1(one) Anti-Virus installed / running on your computer at any
one time..
Conflicts may occur if you have more than 1(one).

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.javacoolsoftware.com/spywareblaster.html

SpywareBlaster 4.1 is a non-intrusive, FREE Anti-Spyware Program that runs
in the background (no scanning by you!).
SpywareBlaster prevents the installation of many so-called spyware, adware
and malware programs by disabling the CLSIDs of popular spyware ActiveX
controls, and also prevents the installation of any of them via a webpage
Update it once a fortnight, and let it do its work in the background!

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

 

[Mr. Arnold]

I have AVG 8 installed on my 32 bit Vista Basic and have just run a scan.
For the 1st time I have received a warning of the following spyware:

C: ProgFiles\MyWebSearch\bar\1.bin\F3SCHMON.EXE
Infection: Adware Generic3.UYY
Potentially dangerous object

I clicked heal - and received a warning that to continue may cause my
computer to crash.

What should I do?

Well first, you have to determine what it is and how did it possibly get
there.

<http://www.google.com/search?hl=en&q=F3SCHMON.EXE&btnG=Google+Search&aq=f&oq=>

It is not a Windows system file, so it's not going to crash the O/S if it is
removed.

At most, it may crash the browser. Did you install something for the
browser.

You can toss the kicthen sink at things with all the malware detection
software in the world running, and it can circumvent all of it, if you're
not using safehex computing practices.

Safehex is where you should start in the prevention.

http://www.claymania.com/safe-hex.html
http://www.physorg.com/news98802904.html

 

[Mick Murphy]

I still reckon Avast is better then AVG, and anything is better then Norton!

Install Spybot Search & Destroy, SpywareBlaster and Malwarebytes per info
you alread have.
There are no conflicts between them. They are as happy as Larry on the same
computer.
As I wrote, Spywareblaster runs in the background; you just update it once a
fortnight. NO scanning with it.
You do a Manual scan with Spybot S & D, and Malwarebytes, one program at a
time.

Double-click to open them from Desktop Icon, run a scan.

If I was you, I'd go into Safe mode, and scan with Malwarebytes, then Spybot
search & destroy, then your Anti-virus.

Important re: Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

 

[Jane Doe]

I didn't install anything for the browser. However I did download some
photo's via a google programme on the net. That is the only thing I can
think of. I usually am very careful with what I do, but I have learnt a
little lesson here.

I went into

<http://www.google.com/search?hl=en&q=F3SCHMON.EXE&btnG=Google+Search&aq=f&oq=>

and disabled the program as a power user and removed it (despite the
warnings!). I really appreciate your help and reassurance that my PC would
be OK.

 

[Jane Doe]

Thanks, Mick. I will take your advice! Can't be too careful. This really
gave me a scare.

Everyone there seems to think Avast is the prog of choice. I think I made a
hash-up when I custom-installed it to exclude emails. Maybe I'll try again
sometime. However, I do like the AVG 8 internet search shield (but I'm not
sure how well it performs).

JD

 

[Peter Foldes]

Do you have My Web Search installed. If you do then this file belongs to that program and is authentic


NEXT

Do you also have the following files on your system then it is malware

M3SKPLAY.EXE
MWSOEMON.EXE
F3SCHMON.EXE

And use the following tools to remove it

Malwarebytes
http://www.malwarebytes.org/

Super Anti Spyware

http://www.superantispyware.com/?tag=SUPERANTISPYWARE

 

[Richard Urban]

Actually, SpywareBlaster doesn't even run in the background. You update
SpywareBlaster and apply the changes. This add entries into Internet
Explorer to block you from going to known bad web sites. When you close
SpywareBlaster it is no longer running - not even in the background.

When having 3-4 anti malware programs on the computer, as many do, you can
only have one of them doing real time tracking - just like with antivirus
programs. If, for instance, you have Windows Defender running real time
scans - you do not also want SpyBot S&D Tea Timer running. You may get
unfavorable interactions as they fight each other for dominance. OR, you may
be fine. But why create the situation to begin with?

I have found that I *can* run WinPatrol along with Windows Defender without
any ill effects. WinPatrol certainly picks up many potential problems. It
gives you the opportunity to say "yea or nay" before it allows any changes
.. Tea Timer, on the other hand, usually gives you a warning "after" the
change has been made to the registry. It's message tells you as much
(changes have been made to the registry - do you want to allow them?). Then
if you do not want the change it (the registry change) is backed out. I like
the WinPatrol method better.

MalwareBytes, Ad-Aware, Super Anti Spyware etc. are also good as long as you
don't activate any of their real time scanning, along with another programs
active scanning. I use them as "On Demand" scanners if a problem is
detected, or on a weekly basis if there are no apparent problems with the
operating system.

Your suggestion to scan when in Safe Mode is a good one when trying to
actually disinfect a system. For weekly scans I think this is a bit of over
kill though.

 

[Mick Murphy]

If you had read my post properly Richard,

"> > Important re: Safe Mode
It was Safe mode use advice, if something unremovable was found in normal
mode.

All your "yea", "nay", and "OR, you may be fine" confuses the OP.
I state something I know that works with the Operating System, not a maybe.

 

[Mick Murphy]

OK Jane. AVG or Avast. AVG will be easier to use for you, if you get a
serious problem. Avast can be put into its own particular Safe Mode, which
can be very scary for a newcomer to security programs, if a serious problem
is found.

Re Richard's concerns re Registry change notifications from Spybot s & d;
that is something that you do have to read and allow or deny.
If you are installing a Program(that you want to), you allow the registry
change.