Anti-Spyware Programs Clean but Don't Disinfect

The Houston Chronicle ^ | October 31, 2004 | Matthew Fordahl [Associated Press]

[quidnunc]

Salinas, Calif. — Though less than a year old, the PC took more than åfive minutes to start up and never shut down without stalling on error messages. Attempts to Web surf generated at least a half-dozen pop-up ads and — frequently — system freezes.

Internet Explorer's home page was hijacked. Attempts to reach some sites, including eBay — were redirected to random search engines that only called up more ads. Google search results were altered. And the modem, without permission, tried to dial distant lands in search of porn.

Welcome to the nasty world of a PC infected with adware, spyware, dialers and their ilk, all of it installed without the knowledge of its owner — my brother-in-law.

No sooner had he spent nearly $1,000 for the Dell Dimension 4600C than he lost control of it to advertisers and porn peddlers.

My brother-in-law, bless him, had committed the computing equivalent of running with sharp objects: Installing free software willy-nilly, clicking carelessly on misleading ads or spam and letting relatives (not this one) have free reign during visits.

But my job was not to judge. It was, rather, to make the violated system hum again. I agreed have a go at degunking it provided I could write about the experience. He agreed.

-snip-

[goldstategop]

If you download Kazaa you're asking for trouble.

[OneTimeLurker]

Anybody have an opinion as to the best ad ware spy ware program. I use Ad Ware and Webroot and can't get the job done. Have a couple programs I can't get rid of.

[fooman]

try cws shredder. it has bailed me out

[goldstategop]

Download Spybot Search & Destroy. And download Spyblaster to keep the pests off your hard drive for good. They're both free.

[snooker]

I use adware and spybot. Then Norton and AVG for viruses. Scan with all the above on max and use the ad prevent settings when done. Often you can dump a lot of the slow down by erasing all cookies.

If you haven't already switch to mozilla or firefox for a better browser.

Linux is the final solution.

[GummyIII]

He left out using Zone Alarm or some good firewall...

[gdc61]

where are the geeks when we need them? I just had a pop-up while I typed this!!!

[Maurice Tift]

Hijackthis is a very good utility for removing browser hijacks and malicious programs loading on startup.

[silent_jonny]

What's worked for me is to reinstall Windows ME(or whatever you use). It takes about an hour, but afterwards my hard drive is squeaky clean.

[GummyIII]

Most folks don't realize Spybot has TeaTimer and Resident. They block changes to the registry and warn of changes to homepages, etc.... I use it and Webroot's Spy Sweeper. They work well.

[Simmy2.5]

I use ad-aware, cwshredder, spybot seach and destroy, and spyblaster. Been a while since I had any major problems.

[abner]

I have a brand new computer as of today. I am running Norton virus scan right now for the first time and it has already found one virus!

I've run adware twice today and had to clean up about 40 things already!

This is just nuts!

[snooker]

I find if you immunize with both adware and spybot it helps keep the problems down to a small number.

[tiki]

I use spy sweeper

[Cacique]

btt

[sigarms]

I am a computer repair technician. I do this stuff all day long. Here is my advice. (Assuming you are running Windows XP).

1) Download and install Ad-Aware, Spybot, and Spy Sweeper. Update all 3 programs to the latest definitions.

2) Turn off System Restore.

3) Boot into Safe Mode.

4) Run a full system scan with all 3 of these programs.

5) Run the program "regedit" and delete any values from the Run key that look suspicious.

6) Open the Add/Remove Control Panel and remove any programs that look suspicious.

7) Reboot the computer back into normal mode.

8) Connect to the internet and download all updates from www.windowsupdate.com. After you download the updates, you'll have to reboot and keep going back to the site until no more updates are available. Especially important is to make sure that you get Service Pack 2.

9) Download and install Mozilla Firefox from www.mozilla.org.

Personally, I don't run Windows. I'm an avid linux users--I like to have control of my operating system.

[AJS]

We use Pest Patrol, works wonderfully.

[Foolsgold]

Netscape 7.1 has a grat pop killer, and you still can get the ones on websites

[OneTimeLurker]

Thanks for the good advice!

[GummyIII]

You might want to add making a backup of the registry before doing the regedit.

Another thing is to run msconfig to see what is loading on startup. Often a virus/trojan/adware will add things there.

[white trash redneck]

5) Run the program "regedit" and delete any values from the Run key that look suspicious.

And how would us non-professionals know which registry keys are suspicious?

[silent_jonny]

I don't know what to tell you. Spyware can be anywhere. If you've installed some new hardware, like a keyboard or a printer or something then Spyware can sneak into your computer that way. It's not exactly illegal, but I think it's unethical. (Logitech is guilty of this practice)

[Not now, Not ever!]

Bump, Bttt, as a bookmark

[sigarms]

I forgot to add a couple more critical steps:

10) Search for and file the file named "hosts". Open the file with notepad. Remove any entries other than the "localhost" one. Save the file and overwrite the original.

11) Open up Internet Properties (in the Control Panel). Go to each tab and click the "Restore Defaults" button.

[John Lenin]

Anybody have an opinion as to the best ad ware spy ware program. I use Ad Ware and Webroot and can't get the job done.

My opinion is to download Mandrake Linux 10.1, I have been using it for about 4 days and it's the first Linux release I would recommend. It's awesome and it's Free !

[Mustng959]

ping to self. good info!

[Lancey Howard]

I have been delighted with my Spy Sweeper.

[happydogdesign]

Dealing with Spyware and Adware

[Peace Is Coming]

bttt

[dolander2002]

I use Crazy Browser and never have pop-up windows.

[abner]

Just finished the Norton scan... 4 viruses. Gone now.

No new hardware. It's all Sony. New water cooled machine. It's pretty cool. I'm just going to keep running adaware and Norton and hoping for the best.
The amazing thing is, my satellite connection is working perfectly again! Before, it would cut out about 4 times a day.

[Tax Government]

AdAware and SpyBot Search and Destroy are a good combination.

Something else that may increase speed greatly on XP is disabling the System Restore function. I suggest this only to people who are comfortable with their machine, and who will take responsibility for not being able to restore the system to some prior state. (I have never, ever used this feature, and feel very comfortable ditching it entirely.)

Why is System Restore a problem? It creates a (possibly VERY large) undefraggable file. To turn the feature off go to Programs / Control Panel / System / System Restore.

You may just want to turn System Restore off from time to time and defrag a couple times, then turn it back on.

[Reagan is King]

I've tried them all (seems like!) and I recently had one that nothing else would get rid of until I d/l Trojan Hunter. It found a trojan that had "injected" itself into the file explorer.exe! This new type of sneaky trojan makes itself part of programs that are always running on your system so it's always running too. Their website says this is the only one that fixes these types so if you have a tough one you might want to d/l their free trial and see if it finds anything.

Trojan Hunter

Is it just me or does anybody else want to just beat the living daylights out the people that make these things? lol.

[Mustng959]

I have Spybot, Norton Antivirus and a Windows XP firewall and my system runs pretty good without any pop-ups. Looks like some good preventive maintenance was given.
Thanks for your added recommendations, also.

[philetus]

Spybot
Spyware Blaster
Spyware Guard
The last two from Javacool software.
All are free and good.
Run all three and you won't get spyware.

[philetus]

A POPUP?
Stop using IE!

Find out why people everywhere are switching to Firefox. Be sure not to miss the great Introduction to Firefox.

http://texturizer.net/firefox/

[John Lenin]

You will never be safe with Windows. XPSP2 is trash, I had to re-install the OS twice in one month because XP slowed down to a crawl both times after about 10 days use. My sytem was being hacked into 2 days after a fresh install with a hardware firewall and software firewall. I was going to switch to MAC but downloaded Mandrake Linux and for the first time got a Linux install where everything works without having to be a linux guru. Windows is unsafe at any speed.

[edchambers]

I use Google toolbar for popups,Spybot search and destroy resident,you have to turn on the "advanced mode" for this.Then run Adaware every couple of days or once a week, my system stays reasonably clean.You can set up Adaware to run at startup if you have the time/patience.Also using a good registry cleaner will help I recomend TweakNow RegCleaner it might keep some of this stuff from comming back it'll definitely keep a bunch of junk registry entries from slowing down your system.It's an ongoing battle but it's manageable if you stay on top of it.Somebody will chime in any second now with buy a Mac or install Linux but it's only a matter of time before spyware/malware begins to target these OSs as well.

[El Gran Salseron]

"5) Run the program "regedit" and delete any values from the Run key that look suspicious."

There are two pertinent Run folders in the registry and are located as follows:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENT_VERSION\RUN

and

HKEY_LOCAL_MACHINE_\SOFTWARE\MICROSOFT\WINDOWS\CURRENT_VERSION\RUN

I'm sure that sigarms meant to tell all of you this but forgot. :-)

[Weirdad]

Just any "good firewall" is not good enough. It is best to use a firewall like ZoneAlarm that also monitors and is able to block unauthorized OUTGOING communications from a computer will alert users to many programs that "phone home." In fact, I use a hardware firewall and am relatively confident about it blocking most incoming hacks, and the main reason I run a software "personal" firewall on all my computers is to monitor the outgoing connections. The redundancy and protection from hack that penetrate the hardware firewall is gravy.

However, even the good personal firewalls require that users take thoughtful precautions, such as rationally deciding whether or not to permit a program to contact the internet. If users just automatically click the "permit" button or especially the "always permit" button, then it's not useful to have monitoring of outgoing communications.

And some programs "piggyback" on permitted programs such as Internet Explorer. (In other words, a spyware program might use Internet Explorer to "phone home" so that the user will think it is a trusted program rather than spyware.) Even those common programs should not be given carte blanch permission to contact the internet until the user is actually using the program to connect.

It all requires work on the part of users. I have totally cleaned up some systems and placed all the necessary software to keep a system safe, only to have friends and relative complain so much about having to hit a few extra buttons that they made me "unsecure" their system. Some people prefer to give no thought to what they are doing and would rather have an "automatic transmission" than is insecure that a "manual transmission" that is secure.

I would not really care much if it were not for the fact that these insecure systems then become weapons in the hand of hackers for launching more mischief on everyone which can cause internet and ISP slowdowns and affect even the secure users.

[A CA Guy]

Before you go on the net, get any copy of Zone Alarm and then download only good stuff.

I run only the free Zone Alarm fire wall and it does very well.

If the occasional bug every three months gets over, the zone alarm mentions it and I erase it.

[yellowhammer]

You should try Maxthon, SlimBrowser, or AvantBrowser. They use the IE browser engine but have tabbed browsing and popup blocking.

[GummyIII]

I say "AMEN" to everything you just said. I do exactly as you do. I teach A+, CISCO networking, Java programming, and Oracle Database Design/SQL plus I deal with a school full of computer problems. The best thing we ever did was put Deep Freeze on all our school computers that students use. It's a pain when installing updates, but it's wonderful otherwise. The biggest pain I have is with teacher computers/laptops due to the very things you just mentioned...sigh...

[D-fendr]

I really don't get why so many still put up with this when it is not necessary. Unless you are running a Windows only application - which doesn't include many popular programs except games - why have to worry about, pay for and spend all the time and hassle with this?

I can't see the reason being cost. By the time you add up all the cleaners and antivirus and time spent, it's no bargain.

Don't get it.

[paulsy]

I've switched from IE, over to Mozilla Firefox and don't have problems anymore.

http://www.mozilla.org/

[GeronL]

Headline sounds like an ad for Lysol bashing a competitor

[D-fendr]

Somebody will chime in any second now with buy a Mac or install Linux but it's only a matter of time before spyware/malware begins to target these OSs as well.

Ignoring for the moment that there are differences in security in OSs, I still don't understand the logic of this.

Users should continue using the roads under attack now, because the attackers are going to hit the safe roads in the future?

Even if true, it's just not good security advice to give.

[Reagan is King]

You will never be safe with Windows.

Agreed! It's junk. I'm getting sick of fighting this stuff off so I may have to give Linux a try myself. Does it install alongside Windows so I can try it out before switching over all at once?

[Gamecock]

As a last resort try "Hijack This" (freeware) I'm on my way out the door, If you can't find it ping me and I'll send you the link when I get home.