Spyware or Addwar!!??

[Guest]

Despite the fact that I am using Adware blockers, pop-up blockers, spyware
destroyers and up to date virus software, I am getting highjacked with pop
ups all the time from:
jamster
upspiral
search-h
and others.
How do I stop these full page pop ups / highjacks !!!
Greg

 

[Ted Zieglar]

Modify your behavior online so you won't download these pests in the first
place. No amount of software can help a user who does not observe safe
computing practices.

"Protect Your PC"
http://www.microsoft.com/athome/security/protect/windowsxp/Default.mspx

 

[Patrick Keenan]

Despite the fact that I am using Adware blockers, pop-up blockers, spyware
destroyers and up to date virus software, I am getting highjacked with pop
ups all the time from:
jamster
upspiral
search-h
and others.
How do I stop these full page pop ups / highjacks !!!
Greg

Start with ccleaner.exe, from www.ccleaner.com. Let it clear out all
temporary files.
Next move to HiJack This and cwShredder:
http://www.spywareinfo.com/~merijn/downloads.html

with HiJack This, let it scan and check through each entry. Mark the ones
that you are sure you don't need. After you tell it to remove entries,
re-scan. Watch for things that re-load themselves - those are the big
clues to where the launchers are hiding.

Aside from the temporary folders, these things often hide in the windows and
windows\system32 folders. It is sometimes necessary to manually go
through these folders and identify things that really have no business being
there; this does require some knowledge and research to check the identity
of questionable items. I usually rename such items to "*.bad" and at the
end go back and delete when I am sure.

Please note that some of these things can break your internet connection, so
be aware of LSPFix.

HTH
-pk

 

[Guest]

Thanks for nothing, Ted

Modify your behavior online so you won't download these pests in the first
place. No amount of software can help a user who does not observe safe
computing practices.

"Protect Your PC"
http://www.microsoft.com/athome/security/protect/windowsxp/Default.mspx

 

[Guest]

Thank you for the advice Patrick.
I have proceeded with you instructions and have a log file. I am not savy
enough to review this. Maunally reviewing my system32 file is way out of my
league. Is there someplace that I can post or send my log file for review .
.. . is that dangerous?
Greg

 

[Ted Zieglar]

That's okay. Hate me now, thank me later.

Ted Zieglar

 

[Patrick Keenan]

Thank you for the advice Patrick.
I have proceeded with you instructions and have a log file. I am not savy
enough to review this. Maunally reviewing my system32 file is way out of my
league. Is there someplace that I can post or send my log file for review ..
. . is that dangerous?
Greg

Do a Google search on "hijack this log review". You'll find some results
like this:
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t1112.html

There are a number of sites where people will help review Hijack This logs.

You may also wish to find a tech near you who does adware/spyware removal -
some people specialize in it.

HTH
-pk

 

[Guest]

I have a similar pop up problem, except my pop ups are from:
www.registrycleanerexpress.com or www.patchupdate.info or www.dlpatch.com.
They all claim to be from Microsoft, saying something terrible is wrong with
my system, and if I click on the URL, I can download software to fix it
immediately, for a fee, of course. What can I do to get rid of them? Do you
suggest the same remedy as for gggumbo?

 

[David H. Lipman]

From: "Novice" <[email protected]>

| I have a similar pop up problem, except my pop ups are from:
| www.registrycleanerexpress.com or www.patchupdate.info or www.dlpatch.com.
| They all claim to be from Microsoft, saying something terrible is wrong with
| my system, and if I click on the URL, I can download software to fix it
| immediately, for a fee, of course. What can I do to get rid of them? Do you
| suggest the same remedy as for gggumbo?

If the text in the Pop-Ups includes "Messenger Service" you need to disable the Messenger
Serice.

To disable the Windows Messenger Service, you can open a Command Prompt and type the
following commands...

sc stop Messenger
sc config Messenger start= disabled

A Router such as the Linksys BEFSR41 will also block this at the WAN/LAN interface and such
messages won't be seen on a LAN PC.



If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/

* SpyBot Search and Destroy v1.4
http://security.kolla.de/

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *