need help with adware/virus

[Gregory Larson]

I have been “infected” with some form of adware and lord knows what other bugs. At first, even though I had the Norton Anti-Virus Auto-Protect enabled, on start up, the protection was disabled. After running several programs listed below, that issue appears to be resolved, but there are others that are annoying to say the least. I am getting pop up windows from Party Poker, Sex Buddies, Travelocity, passion.com, Ipod software, etc. They are very unnerving, especially with my 12 year-old daughter on the PC when a “who would you like to f### tonight?” comes up. The screen also has the “x” off the screen, forcing the user to drag the window over to even close it. Even more of a problem, whatever has infected the PC frequently brings up the “Blackworm Virus Detected” window, along with a “upgrade your pc by buying software xyz now!”…. I get a relentless window from the site www.Amaena.com, telling me to buy either WinAntiVirusPro or WinAntiSpyware. I am suspicious that this is as much of or most of the problem as it would be a solution.

Regardless, whenever either the above warning comes up or an ad pops on the screen, I get a “Microsoft Internet Explorer has encountered a problem, and needs to close. We are sorry for the problem…blah blah blah…” and we must exit the internet and go back in again. Usually, these issues don’t rear their heads on the second iteration.

I have run Adaware SE personal, downloaded and run Spybot SD, and installed and run Webroot Spysweeper. Microsoft Antispyware is active, as is Norton Internet Security and Norton Anti-Virus auto protect. None of these have stopped the problem. Any ideas how to restore my sanity by the experts out there?

Thanks,

Greg

[Robert S. Carr]

Greg:

As a Dad myself with a daughter I can fully appreciate your concern. You could try:

The Microsoft Malcious Software Removal Tool http://www.microsoft.com/security/malwareremove/default.mspx

It sounds like you've already taken most of the standard virus/spyware precautions. Ultimately if no solution gets rid of the problem in a timely manner, reformat and re-install, making sure to copy personal files to removable media or e-mail them to yourself first so they can be restored later.

If you have XP or Win2k, once the machine is functioning again, create two accounts, one admin and one user. Let your daughter use the general user account and yourself the admin. This helps in preventing malware from getting on the machine or at least limits it scope of control. If you visit a web site logged in as admin, and there is a virus on the site, if it attacks your machine it does so with admin rights. Logged in as user, the virus can only act with user rights, so the scope of possible damage is more limited and antivirus software more effective. Even though I work as a Windows Admin, I use a general user account for most of my work, switching to the admin account only when necessary and avoiding all but the safest web sites if I need to use the web.

Some other suggestions:

1) Use IE v6SP1, which is the most secure version of IE to date and automatically disables popups.

2) Adjust your IE security settings to a higher setting.

3) In IE, check Tools->Internet Options->General. Check what page is set as the Home page. Ensure it is set to a safe page, like http://www.google.com, or similar

4) In IE, in Tools->Tools->Internet Options->General->Temporary Internet Files, click on Delete Cookies, and Delete Files.

5) You could try Firefox, the leading alternative browser. It tends to be more secure is it lacks some of the virus prone features of IE like Active X. Some sites may not work, but this is what you want in the case of sex sites in general. Plus installing it now could remove IE problems merely by the fact you are not using IE.

Ultimately, reformatting is never a great option but with kids involved, safe is always better than sorry.

Good luck.

Rob

[Robert S. Carr]

Greg:

Found this link on HP's site regarding your issue:

http://h10025.www1.hp.com/ewfrf/wc/document?dlc=en&lc=en&product=77623〈=en&cc=us&docname=c00206121

Rob

[Michael Dillman]

This may sound like stupid question, but did you run the updates for Spybot. Also, you can check add/remove programs for any Search bars such as My Search, Spamblocker, Cool Web Search, etc. Hijack This will also create a log of what's running as procceses that you can post here for more help.

[Rajasekhar.k]

Hi Greg,

I was having similar problem with my system, especially spywares which come up with annoying popups.

I have tried norton, but it's not that effective with spywares. Then I got a copy of Kaspersky Anti-Virus from my previous company.It's been really useful and I havent got any problem with my OS till now. This Antivirus blocks spyware from active X controls. It's a small file and will not bother you that much as Norton does. It does it's work and let's us do ours. I would suggest you to try it out and see if it works for you.

You can download a trial version from this link. http://www.kaspersky.com/trials

Install it and run a full system scan. Remember to back up important files. Delete any spywares that you find.

After you complete the process, if there is any problem with your OS, repair it with the OS disk.This should clean the PC from any virus and spywares.

Hope this information helps you.

Regards,
Rajasekhar

[Alan_152]

You seem to be doing all the right things. In addition to adaware and spybot, I personally use ccleaner and the MSIE popup blocker.

For my customers that are really concerned about porn and popups, I also install a custom "hosts" file that blocks a bunch a bad urls. Basically, it is a combination of the kazaa-lite hosts file with a listing of known popup and sex sites.

Depending on the OS, the hosts file may be in c:\windows\system, c:\winnt\system32\etc\networks, or in a number of other places. Find it, open it in notepad, make sure that some spyware hasn't already hijacked it (it should just have 1 entry in it right now for loopback), and copy/paste this list:

http://www.andreasroom.com/HowTo/KLhosts.aspx

A couple of other things:
1) have you upgraded to the latest service pack for your operating system? Have you installed all the security patches for MSIE?

2) Have you considered not using MSIE and instead going with an alternative browser like Mozilla? I don't recommend this very often, but it might just work in your case.

3) I usually recommend getting rid of most everything Norton or Symantec, and installing grisoft's AVG antivirus instead.