Bloody Ad-Ware.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

I think have Ad-Ware on my PC now, and I need suggestions to remove it.

I have Ad-Aware SE 2007 on here, but it messed up Vista when I ran it.. I got like 20 stop codes or something saying host processes cant start, and the scan was really slow and bogged out..

Any help is appreciated.

EDIT: Basically while my browser is up, I just get random popups, primarily in new windows. And since my browser is nearly always up, I don't know if it happens while I'm on my desktop, but I am suspicious because it's happened 3 times now and just a few ago it happened when I opened MSN.

I have Google Toolbar installed apparently, bad? Uninstall? My other computer with FF doesn't have it installed, I have no idea how it got on here.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

All I can think of is to install AdAware free, the latest 2008 version. Spybot S&D on top of that should find and remove pretty much everything.

I'm just running NOD32 these days (plus Comodo for a firewall) - I don't know if I'm running the risk of adware, but I think NOD clears out most crap like that.

Try Tarun's site - he seems to be an expert on malware.

[edit]I never install any toolbars - what does Google toolbar actually do anyway? FF and IE can both have their default search set to google anyway - mine are.

[editt]Link to Spybot - http://www.safer-networking.org/en/download/index.html Can't link to the latest AdAware - this work PC isn't too good with java, but check http://lavasoft.com

Luce

Pre-Searing Cadet

Join Date: Jun 2008

Try using Windows Defender and maybe try using SpyBot too. You can also just goto download.com and look through the spyware section.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Says that Symantec found a Spybot Worm thing named W32.Spybot.Worm - rBot.exe one month ago..

Symantec on my other computer found it too, it came from limewire.exe or something, i haven't used limewire in a million years.. so it must be from some old hard drive I had around.

I am going to lunarsoft.net yeah.. I really need Tarun's help right now.

But I think I'm going to F-Disk every comp and hard drive I have soon, I'm way too paranoid about having potential crap floating around, I never would have even known that this spyware was around. According to Symantec's auto-protect statistics, it caught the spyware trying to edit registry keys - stopped it - deleted the keys - and dealt with it apparently.. And all of this was under the cover, a month ago. But I don't know what to do still.

NeonXero

NeonXero

Lion's Arch Merchant

Join Date: Jan 2007

Pennsylvania

Leaked Aggression [grr]

D/W

I frequently use:
Lavasoft Ad-Aware
Spybot S&D
CCleaner
AVG Free 8

Those things all seem to do a good job keeping everything in line, but sometimes it just is necessary to format. I had a big mess with formatting this computer (macbook pro) - both the mac and windows partion (NTFS and HFS) as well as my external, which was in FAT32 to support both operating systems. I did back stuff up, but the recovery process effed up... and I lost some data Not sure how I got onto that... but yeah, good luck.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

Apparently, the W32.Spybot.Worm is a different trojan to rbot.exe - you may have had 2 there.

The first one is either contracted via the kazaa network OR mIRC. RBot is spread by Messenger, or by any open network shares (so could be LimeWire again, I suppose)

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Well, I have calmed down some so now maybe I can explain things better.. I tend to freak out in bad situations.

Basically there is some file or something that I had backed up - and transferred it over somehow to my other computers. I believe this infected file came from an older hard drive that had some pretty odd stuff on it - I used to be really stupid with computers.

So, basically, Symantec has an auto-protect feature that scans and blocks anything trying to harm my files - and what happened was just that, both of my computers caught it, and got rid of it. Else I'd be in some deep doo-doo, but into further inspection of the way the system works on it, it told me to delete the backup copy too as it can still contain the infected file, so I did that, now everything appears to be clean and multiple scans don't pick anything up.

Later, I am going to boot up XP on this machine and see if that hard drive caught the file too, I haven't used it in months so we'll see what it finds, but both of my computers found that virus on the same exact date, so It's making me suspicious.. Either way.. I'm going to try to get some more anti-spyware and anti-adware programs to run later - Ad-Aware 2007 borks my Vista 64 bit so that is a huge no-no right now. I'll figure something out, hopefully Tarun runs by.

Snog;

*I have used mIRC in the past.

*I have used Limewire.

*I do use Instant messengers such as MSN, Yahoo, Skype, and AIM.

My friend told me the same thing when he looked up that baddie, so I'm assuming that what you say is correct - and I indeed did get it via one of these sources. However I am most likely assuming it was limewire because the other computer picked it up as limewire.exe (it doesn't have limewire on it, the old backup drive did, which used to be plugged in but a while ago I removed it.) and I have only briefly ever been on IRC, and never clicked links or files from IRC. I have transferred files Via my IM's with friends, so there is some likely hood there too. But I can't be certain at all, I will have to find some way to find out the real source. As for now, all limewire related folders will be deleted from the system, even after scanning the old MP3's in there too. I still can't believe myself for actually using that garbage in the past.. but I have since learned.

KZaske

KZaske

Jungle Guide

Join Date: Jun 2006

Boise Idaho

Druids Of Old (DOO)

R/Mo

I use Spybot S&D, but I do not leave it running all the time. For 64Bit (I think you said you were using a 64bit OS) try Avast, AVG is nice but 64bit support is a little iffy last I knew it was not supported, but not sure about version 8. If you are willing to pay there is always Nod32, one of the best out there.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Bah, well apparently this all happened in April, a month before I thought.

So after two months.. it wold seem logical that by the history of events that my AV already dealt with it, and it is long gone. I would assume so at least.

We shall see. Is it safe to assume that I am fine by now? I feel it's kind of daft asking that, but the infection has not shown any signs since, and I have had no troubles - I never knew it was even there and that my AV did any of this, so for two months I was in the dark about it, and if everything has been fine for that long, I think I'm ok.

As for Ad-Ware, still unsure about that, but I'm less worried about that.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

Should be fine. The paranoia method is to temporarily disable System Restore and run all your AV and malware checks in safe mode. That should get pretty much everything.

Those who know say NOD32 is the best AV protection - use the version without the firewall though. Comodo is a good bet fore a reliable and free firewall. NOD32 costs, but is well worth it. Defeats as many viruses as anything else on the market and has a VERY low footprint, that is it doesn't hog resources like most do.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Thanks for the tip, I'll look into NOD32 later.

I kind of have anxiety.. so paranoia is a word I know all too well. I suppose that I will run a scan in safe mode to be sure - however, System Restore has long since made a lot of backup points since the infection was last detected two months ago, so if anything was done there, it's done.

I am still most likely going to reformat and purge every file that I have left to make sure these things are gone, and this is the first infection I have had in two and a half years.. so it's pretty spooky for me, I'm most likely going to up my security as much as possible.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

You mention you have no problems with your "other" PC that runs FF. What are you running on this PC? IE, or something esoteric like Safari or Opera?

You know, the easiest solution is to run FF on this system too - download the V3 release candidate NOW, then upgrade to the "proper" version shortly. It's amazing now - pisses all over IE8.

Oh, and let it block pop-ups - it does that well

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Well, I think I may have jumbled things in my rush.

Both of my systems run FF2, and they both run the same AV, however Vista uses its built in firewall, because the Vista version of my AV doesn't have one supplied.

Pretty much the only problem on my other computer is that I can't watch youtube because it keeps telling me to update flash, and I have 10000 times, and rebooted, the 9 yards. Does the same thing on IE and FF, so I don't know what that problem is - but that is irrelevant.

I kind of refer to one PC or another because I use them to differ problems from eachother.. to maybe pinpoint things, but it's also 3:21 AM and this is the latest I've been up in ages.. seriously need some sleep.

awesome sauce

awesome sauce

Krytan Explorer

Join Date: Dec 2005

To avoid getting malware in the future, I always scan everything suspicious under 10 mb at virusscan.jotti.org. You upload the .exe / .zip / .xxx and it scans it with 20 different programs.

lord_shar

lord_shar

Furnace Stoker

Join Date: Jul 2005

near SF, CA

I'm running McAfee Antivirus and SpywareDoctor together under Vista32 Premium. It's been able to intercept everything so far. SD can also detect rootkits.

SD does have a try-before-buying demo... perhaps you can use it to identify the exact Adware title that infected your PC. It receives updates pretty much every other day. You can download it from www.pctools.com.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

Quote:
Originally Posted by lord_shar
It's been able to intercept everything so far.
...as far as you know.

That's the problem, if a virus gets through, you wouldn't know until it unleashed its payload on you.

McAfee has gone downhill a lot. SpywareDoctor gets laughed at by the malware experts. Try looking up some independant virus/malware detection rate comparisons - some products out there are shockingly bad.

AV comparisons - http://www.av-comparatives.org/seite...se_2008_02.php

Firewall comparisons - http://www.matousec.com/projects/fir...ge/results.php (scary)

Hmm, matbe SD isn't too bad - it's hard to find a definitive comparison that includes it. I'm keeping my eye on http://www.antispywarecoalition.org/ - will be great when they finally get off their butts and actually DO something!

lord_shar

lord_shar

Furnace Stoker

Join Date: Jul 2005

near SF, CA

Quote:
Originally Posted by Snograt
...as far as you know.

That's the problem, if a virus gets through, you wouldn't know until it unleashed its payload on you.

McAfee has gone downhill a lot. SpywareDoctor gets laughed at by the malware experts. Try looking up some independant virus/malware detection rate comparisons - some products out there are shockingly bad.
All the google searches I ran on SD 5.5 / 2008 were above-avg to very-good (PCMag, ZDNet, etc...) The bad reviews I did find were from older 2005 versions.

Webroot's SpySweeper was top-ranked according to this list:

http://anti-spyware-review.toptenreviews.com/

However, I didn't find any real-time scanning with Spy Sweeper on the version we run at work, so I don't know what to think of it. I also found some errors in their SD review, like scan-scheduling being absent (it's actually there... found it very quickly too).

From what I've seen, the rankings can shift very quickly depending on version#'s and reviewers, so I try not to put to much faith on any one source.

EDIT: Lastly, SD intercepted some spyware payloads on guru's ad-banner above a few times last month. Not sure if you guys have corrected this, but I'm using Firefox with No-Script enabled just to be safe for now.

I also forgot to mention that SD isn't all that good for viruses since anti-spyware is its focus. However, it does a decent job in that department

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

Yeah, after some research it appears I may have been a bit harsh on SD. Where's that Tarun when you need him?

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Last night I came to a realization, I know what the spyware was from.

I was trying to get a song back then, and my brother gave me a limewire installer stub thing, and when I transferred it over to my computer, Symantec went haywire and all up in arms, blocking it and stuff. It did this on both computers so I'm assuming it was bad, and that is why both computers detected it on the same date. Thing is, is that I wasn't actually going to use it, because by the time I got it on my PC anyways I decided I didn't want to download the song from there, because I knew that I could probably get infected.

So basically it was limewire indeed, and I told him that it may have a virus but he said it didn't. He uses McAfee on Vista 32 bit as well, I tried it a long time ago but didn't trust it. Either his AV didn't catch the spyware, or it is a false-positive on my end.. but I'm kind of doubting that it's a false positive.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

I think sometimes the limewire stub installer itself gets flagged as malware - best to be safe, of course

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Well, if it was a false positive, it was definitely a sign! But considering that the statistics show it was trying to edit registry keys, and Symantec deleted those keys that it made, then I'm assuming it wasn't judging by all of it's activity.

I still need to make sure I don't have ad-ware, I'm noticing a lot more popups than I ever got before, they blow right through FF's popup blocker.

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

I'm here Snograt. Been very busy with my website and other issues as of late. Brianna made a post on Lunarsoft that I've been monitoring since I got up this morning.

SpywareDoctor and SpySweeper are garbage. SpywareDoctor is very well known among knowledgeable technicians for having copious amounts of false positives. Toptenreviews is pretty well known for being paid to raise the results of applications being reviewed. They've ranked Symantec/Norton stuff number one before. Same happens with magazines like PC Magazine and all those others. Yeah, I'd really want to trust the word of companies who accept money to raise ratings for products.

Malwarebytes Anti-Malware is an excellent anti-spyware and anti-adware application that takes care of more than what Ad-Aware used to get. The newer Ad-Aware versions are becoming bloated. Spybot still does an excellent job, though I personally think it's long overdue for a major overhaul. It feels like it has a Windows 95 interface.

Don't worry Brianna, I'll help you get your computer fully cleaned and help you tighten the security.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

Thank god for that - I thought I was going to have to trawl for information for ever

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

Snograt, I've been slower on here to reply as I've been working on a project to help ease my work load and reduce bandwidth usage on my website.

I'm sure you and others are most likely familiar with my Anti-Malware packages. It started as one package called "AllApps.zip". To try and meet users needs I later changed this to the existing Anti-Malware packages, each one classified by a name such as Lite, Standard, Full and Professional. Over time, two of them became the exact same, so now there's Lite (appx 20MB), Standard (appx 40MB) and Professional (appx 50MB). It has become a tedious and very long process to update these programs. Mainly uploading them to my website at 50KB/s. 110MB at 50KB/s takes a while.

I have a program in development that will be able to help ease the bandwidth and space usage on my website and also allow people to only download the applications they need. I have some big plans for it as well to make things very easy for the user.

It will need .NET Framework which isn't really a problem anymore. It's becoming a standard for pretty much every mainstream OS. It has been tested and works on Windows 98SE through Windows Vista.

More information can be found here:
http://lunarsoft.net/forum/index.php?showtopic=1323

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Is it safe to delete all of the items in the temp folder? C > Users > Me > AppData > Local > Temp?

Tried anyway, says that some things can't be deleted because they are in use.

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

Yep, nothing is meant to stay in the temporary folder.

Used to see people complain on CCleaner forums because they actually kept all of their important documents in the Temporary folders, then ran CCleaner and it deleted them. They blamed CCleaner for their own foolishness.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Well, by saying ''They kept" that implies that they put their stuff in the temp folder willingly?

I just don't want to delete something I need, that is all I care about.

lord_shar

lord_shar

Furnace Stoker

Join Date: Jul 2005

near SF, CA

Quote:
Originally Posted by Tarun
...<SNIP>...

SpywareDoctor and SpySweeper are garbage. SpywareDoctor is very well known among knowledgeable technicians for having copious amounts of false positives. Toptenreviews is pretty well known for being paid to raise the results of applications being reviewed. They've ranked Symantec/Norton stuff number one before. Same happens with magazines like PC Magazine and all those others. Yeah, I'd really want to trust the word of companies who accept money to raise ratings for products.
I've encountered 1-2 false positives in the time I've used SD, so I agree with the above. I finally had to go in and manually exclude the file generating the alerts. SD also has a few modules that cause problems for Vista (file guard is one of them -- had to shut this down as well to speed up network file access). Still, SD was pretty useful for the most part, but I agree there are better options


Quote:
Originally Posted by Tarun
Malwarebytes Anti-Malware is an excellent anti-spyware and anti-adware application that takes care of more than what Ad-Aware used to get. The newer Ad-Aware versions are becoming bloated. Spybot still does an excellent job, though I personally think it's long overdue for a major overhaul. It feels like it has a Windows 95 interface.

...<SNIP>...
---------------------

I'm sure you and others are most likely familiar with my Anti-Malware packages. It started as one package called "AllApps.zip". To try and meet users needs I later changed this to the existing Anti-Malware packages, each one classified by a name such as Lite, Standard, Full and Professional. Over time, two of them became the exact same, so now there's Lite (appx 20MB), Standard (appx 40MB) and Professional (appx 50MB). It has become a tedious and very long process to update these programs. Mainly uploading them to my website at 50KB/s. 110MB at 50KB/s takes a while.

I have a program in development that will be able to help ease the bandwidth and space usage on my website and also allow people to only download the applications they need. I have some big plans for it as well to make things very easy for the user.

It will need .NET Framework which isn't really a problem anymore. It's becoming a standard for pretty much every mainstream OS. It has been tested and works on Windows 98SE through Windows Vista.

More information can be found here:
http://lunarsoft.net/forum/index.php?showtopic=1323
Lots of info to digest, but looks good

Brianna: CCleaner is fine. Many malware payloads enter your PC through the IE temp folders in your user-profile. CCleaner can clean them off before launching if you're proactive in using it.

EDIT: Give Netcraft Toolbar for Firefox and McAfee Site Advisor a try if you don't already use them. I'm finding them both very useful for identifying bad sites before even clicking on them from a google or yahoo search page.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Yeah I like McAfee site adviser, that is a good tool.

I do have CC cleaner installed on all my pc's, I should run that.

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

I'd avoid toolbars like the plague. I don't care how good the reputation may be, it's a toolbar that hooks into Windows Explorer (because Windows Explorer shares the Internet Explorer core) which can cause a user tons of problems just trying to browse their folders.

In Firefox, toolbars may be a bit safer though I really wouldn't use them. In fact, I only have one toolbar installed for my Firefox and it's to work on my website (Web Developer Toolbar) and even then I turn off the toolbar completely.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

It says I have google toolbar for IE, but I don't use IE.

I can probably remove that from the ''Add / Remove programs'' list then.

Malice Black

Site Legend

Join Date: Oct 2005

The Goggle toolbar always reappears even after uninstalling

I just left it, doesn't appear to do any harm. All scans show up clean. I run CCleaner everyday, and have Spybot etc set to run on a daily basis too.

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

Malice, try Toolbar Uninstaller.

SnipiousMax

SnipiousMax

Perfectly Elocuted

Join Date: Sep 2005

Just to drop a few more names:

Superantispyware is great
Spyware Terminator (you don't necessarily have to set up real-time scanning, just run the on-demand scanner)
A-squared (it's really a slow scan, but it's pretty through. It's also aimed at scanning for Trojans/dialers/worms.)

You could also use HijackThis as kinda a last ditch effort. It doesn't just list malware, it lists a bunch of stuff, so you'll have to do some google searching for HJT logs to see if anything on the list has been identified by others as adware/spyware. There are whole forums devoted to looking at HJT logs.

Finally you can use Revo Uninstaller and something like Task Killer to look through your installed programs and processes. If you find something that looks suspicious, just do a google search and see what others have said about it.

It might also not be a bad idea to clear out all of your temp files, cookies and such with Ccleaner.

If none of that takes care of it, then I'm not sure what else you can do.

*Edit*
Revo Uninstaller does a good job of removing Google Toobar, as it removes everything associated with the program.

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

A-Squared is a horrible scanner, and Spyware Terminator is a delisted rogue.

SnipiousMax

SnipiousMax

Perfectly Elocuted

Join Date: Sep 2005

Quote:
Originally Posted by Tarun
A-Squared is a horrible scanner, and Spyware Terminator is a delisted rogue.
It's been cleared by Spyware warrior. And it was only ever suspect, they had never really found any need for concern in any of their testing. I think it's still a slick program.

Quote:
Note on SpywareTerminator: We originally listed Spyware Terminator on this page out of concerns that Crawler, the company behind the product, had established connections with IBIS, a well known adware distributor responsible for such adware programs as Wintools, Websearch, & Huntbar. Although we found no problems in our initial testing with Spyware Terminator, and while the vendor itself announced that it was exiting the adware business (1), we decided out of caution to impose a three month probation period before we would consider re-testing and, if warranted, de-listing the the product from the Rogue/Suspect list. During that three month probation period we monitored the behavior of IBIS and Crawler. At the end of the three month probation period we re-tested Spyware Terminator, again finding no problems serious enough to justify listing the program on this page. As the vendor involved has not been involved in the distribution of adware for many months, and as the program itself exhibits no problems serious enough to warrant mention on this page, we have decided to de-list Spyware Terminator from the Rogue/Suspect list and can no longer regard the program to be "rogue/suspect."


A-squared has also been recently updated, it's much better now.

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

I know SpywareWarrior cleared it, thus why I said it was delisted.

I wouldn't recommend something that was once a rogue application to anyone. That's asking for trouble.

a-squared has tried to make a hijackthis replacement and other anti-malware applications. None of which have been up to par.

SnipiousMax

SnipiousMax

Perfectly Elocuted

Join Date: Sep 2005

Quote:
Originally Posted by Tarun
once a rogue application
It wasn't rogue for anything beyond vague suspicions into the parent company's other business connections (see above post) two years ago. It was only listed for three months as a precautionary measure. This is a completely different version of what was listed back then, the company's been clean, and this version has gotten nothing but good reviews that I've read. I'd understand your reservation if the program had been caught loading adware, blatantly ignoring adware, acting like malware itself... but it wasn't. It's effective, it's light and has tons of options.

Regardless, I like to rotate my Adware/spyware protection every so often. No one program is completely foolproof, and I like to scan with two or three programs just to be sure.

The Way Out

The Way Out

Wilds Pathfinder

Join Date: Aug 2007

In my peanut brain

Zomg Zombies [OMG]

Mo/E

At this point, your system is compromised somehow. Because you are here asking us for help, I would suggest trying this first...

http://housecall.trendmicro.com/

Once this is done, come back here and let me know. I will help you a bit more.

A-squared blows.

Brianna

Brianna

Insane & Inhumane

Join Date: Feb 2006

Heh, well It started out by me thinking it was ad-ware, which seems to be cleared up now. Then I found that old spyware and freaked out, but that is long since gone and I'm not worried about that bit anymore, I also cleaned up anything that could still be related to it and ran some more scans, and it comes up with nothing.

But, at least some new programs were suggested to check out, because it's not to say that I won't get anything in the future - I'll have more tools at disposal now.