Spyware

[nursewhen]

I remember at 'Lexx.com that was', Stormie gave some advice on how to clear your PC of spyware.
I've picked up something that's impressively efficient, but I don't really want a trail of related emails as I potter about the intenet.

Can anybody help?

[XS4Xevr]

A very nice one that I have seen highly rated is a FREE Swedish program (free for personal use) called ADDAWARE. (That might be the one previously posted.) It scans your computer for spyware and can quarantine and remove what it finds. (I ran this on my neighbor's computer that was running slow and also had their home page hi-jacked to an advertisement site, and it found over one hundred files. After reboot it ran twice as fast and was cleanly reset to the home page of their choice.)

http://lavasoft.element5.com/software/adaware/

[nursewhen]

Brilliant, thanks very much :D

Wow, 22 objects found! :shock:

[stormsweeper]

Brilliant, thanks very much :D

Wow, 22 objects found! :shock:

Most are probably cookies. :P

AdAware and Spybot (http://www.safer-networking.org/en/index.html) are the two big ones. The latter has a nice "innoculate" feature that blocks several known spyware sites from installing ActiveX components at all. It also has a hosts file blocking feature, but you may find that it blocks too much.

You may also want to run your system through a virus scanner of some sort. Trend Micro has a free one online (http://housecall.trendmicro.com/).

[Fatguy]

Nursewhen:

If the spyware program does not work (especially if it is one of the later hijacks) you may need extra help. Typically some of the worst are called "coolweb" or something like that. They change your homepage in order to boost the traffic to their search engine site and thus enable them to charge more or advertising. The latest are extreamly hard to get ride of. The program also hides and stops the usual spyware programs from working. There are organizatios devoted soley to fixing these things (I will have to find the site again - they change it and the names as they are always at war with the hijack people). My hijack was state of the art, and the worst as it change setting so fixes never seemed to work.

I solved my problem by deleting the operating system and then reinstalling and looking for broken task messages on start up. Found one (the hijack - even if you change the home page (usually the option is greyed out) their page is reset when you restart.) and located the program and had to use a text editor to delete the script in question - Problem Solved! I found 180 or so data miners when I solved the hijack problem.....

Here is a link if all fails - their program did not help me but the forums did (if you can find them..... ):

http://s89223352.onlinehome.us/mirror/hjt/

The forums are here:

http://www.spywareinfo.com/forums/

Some of these dudes are very talented, I know a couple.....

[nursewhen]

Thanks Storm, yes, all but one were tracking cookies. That Spybot innoculate sounds good, I'll download that :D
I have a virus scanner (Avast) whch I run regularly, plus a firewall.

Fatguy, thanks for the info. I'm not suffering anything as bad as a hijack, just a few emails that spookily relate to content of websites I've looked at. However, if it gets serious, I'll know where to go.
:D

[iStan]

*iStan bites his tongue again*

Every time that I read posts like these I have great sympathy for my friends in the Dark Zone. While I still have several peecees (including one that I use pretty much just for DOS apps) they're never online. There hasn't been a Mac virus in some years, and other than cookies, which I can accept or not, Macs aren't troubled by adware, spyware, scumware, and so on. I write this only because, in my simple minded way, I honestly do believe that more people should use Macs (PC World magazine chose Mac OS X as the best operating system this year).

Okay, I'll go back to sleep now.

[thatguyben]

Nursie-

Greetings! I wrote an in-depth thread on spyware removal, anti-virus, etc in this help forum. It is here:
http://lexxfans.com/phpBB2/viewtopic.php?t=160

The advice upthread is all good on removing spyware. However, I advise you scan the thread linked here to get a bigger picture. There may be other free or low-cost actions you can take to keep your PC safe. I'm by no means authoritative, but I do this stuff for a living, so I have the spiel down pat. Have a look and let me know in a post, a PM or email if you have questions.

[nursewhen]

Nursie-

Greetings! I wrote an in-depth thread on spyware removal, anti-virus, etc in this help forum. It is here:
http://lexxfans.com/phpBB2/viewtopic.php?t=160

Heavens to Betsy! How did I miss all that?
Thanks, thatguyben :D

My machine has got a nasty habit of just shutting down and then restarting again. I thought I might have the Sasser virus, but it keeps coming up clean on all the antivirus runs I do (I've tried the Symantec as well as my own antivirus stuff).

Any ideas? :?

[stormsweeper]

Could be a couple different things. It could be that your computer is overheating, and the BIOS resets the computer to keep it from frying itself.

[thatguyben]

Nursie-

Greetings! I wrote an in-depth thread on spyware removal, anti-virus, etc in this help forum. It is here:
http://lexxfans.com/phpBB2/viewtopic.php?t=160

Heavens to Betsy! How did I miss all that?
Thanks, thatguyben :D

My machine has got a nasty habit of just shutting down and then restarting again. I thought I might have the Sasser virus, but it keeps coming up clean on all the antivirus runs I do (I've tried the Symantec as well as my own antivirus stuff).

Any ideas? :?


That sort of activity could also be associated with worm activity. Sasser, Welchia, MSBlaster, these are worms that attack your PC through holes in good ol Windows.

Disclaimer: if you are well infected, you may have no choice but to re-image to be completely safe. Maya and I went through heck trying to cure her system of a worm and it ultimately was impossible. If you have not done a backup in a while, I'd start corralling all those personal files in anticipation of a massive backup.

Questions on background: what OS are you running? What is your internet connection? (the answers to these questions will determine how easy the following is)

First, be certain you are up to date with Windows. Have you been keeping up to date on patches and service packs? Go to windowsupdate.microsoft.com and be sure you are up to date. If you are not up to date on Windows, and you are trying to rid yourself of malcode, without the crucial Windows patch, the worm will just replicate itself all over again.

If you reboot in the process, grit your teeth, log back on and continue downloading the update. Eventually, you will get it all. Install the Windows patches, then update antivirus and shut down. Then disconnect your PC and run a complete antivirus test. Some of the malcode worm that cannot be removed by AV can still be detected by it, and then that points us to the downloadable removal utility for the particularly stubborn ones.

Note: if you are still suffering dial-up and do not have broadband, this instruction may change a little.

Go through this and post your results. We'll take it from there.

[nursewhen]

Questions on background: what OS are you running? What is your internet connection? (the answers to these questions will determine how easy the following is)

First, be certain you are up to date with Windows. Have you been keeping up to date on patches and service packs? Go to windowsupdate.microsoft.com and be sure you are up to date. If you are not up to date on Windows, and you are trying to rid yourself of malcode, without the crucial Windows patch, the worm will just replicate itself all over again.

If you reboot in the process, grit your teeth, log back on and continue downloading the update. Eventually, you will get it all. Install the Windows patches, then update antivirus and shut down. Then disconnect your PC and run a complete antivirus test. Some of the malcode worm that cannot be removed by AV can still be detected by it, and then that points us to the downloadable removal utility for the particularly stubborn ones.

Note: if you are still suffering dial-up and do not have broadband, this instruction may change a little.

Go through this and post your results. We'll take it from there.
Hi, thatguyben,

I think I've already been through all of the above. I had a massive PC breakdown recently, and in the end I bought a new version of windows XP. Dr When installed it and then downloaded all the windows patches. My antivirus (AVAST) updates automatically, so that shouldn't be a problem.

The new version of Windows solved all my problems except for the intermittent shutdowns (Internet explorer also has a habit of encountering 'a problem', apologising profusely and then booting me off the internet.)

So I have windows XP, broadband and internet explorer, Avast and ZoneAlarm. Does that help?

(P.S let's not discount the possibility that my cat has peed into the computer or that I've sat, banging my head on it once too often :lol: )

[stormsweeper]

The kinds of shutdowns you are having are usually:

1. The processor's heatsink isn't attached properly

or

2. The power supply is flaking out

For 1: If it's a recent enough (as in the last 3 or 4 years) computer, you may be able to see the temperature in the BIOS (by hitting delete or something at startup - it might say on the screen just after the system turns on, before Windows starts. Up to about 50C should be ok, if it starts climbing to 100C and shuts down, you'll know it's the heatsink.

For 2 (and 1): Try installing Motherboard Monitor:

http://mbm.livewiredev.com/

You'll have to play around with the settings a little, but you shoudl be able to have it read the temps from any sensors in your system, as well as the voltage levels of your power supply. You'll want to make sure your 3.3V and 5V rails are actually delivering about that much.

MBM can also monitor temps if it's not available in the BIOS.

[nursewhen]

Thanks Storm :D
I was wondering if it might be something physical.
I'll have a play with the MBM.



(Actually, I think I'll get Dr When to have a play with it :? )

[logan]

I think I've already been through all of the above. I had a massive PC breakdown recently, and in the end I bought a new version of windows XP. Dr When installed it and then downloaded all the windows patches. My antivirus (AVAST) updates automatically, so that shouldn't be a problem.

The new version of Windows solved all my problems except for the intermittent shutdowns (Internet explorer also has a habit of encountering 'a problem', apologising profusely and then booting me off the internet.)

This sounds very similar to the problems I had recently.
Internet Explorer freezing everytime I connect to the internet, having to reboot over and over, in the end I bought a new computer with XP and Norton Anti Virus. As soon as I had it installed (the new computer) it crashed, it turned out that aI had these two worms MSBlaster and Welchia, they had transfered from my old computer via the old data transfer ( I think), any way these were the cause of the problems.

To solve the problems my computer shop gave me a disc to erradicate MSBlaster and Norton Anti Virus quarantined Welchia

BTW....I had an Anti Virus system on my old computer but it just wasnt good enough. I also never open anything in my email if I dont know who or what it is.....never.

Hope this helps

[thatguyben]

I think I've already been through all of the above. I had a massive PC breakdown recently, and in the end I bought a new version of windows XP. Dr When installed it and then downloaded all the windows patches. My antivirus (AVAST) updates automatically, so that shouldn't be a problem.

The new version of Windows solved all my problems except for the intermittent shutdowns (Internet explorer also has a habit of encountering 'a problem', apologising profusely and then booting me off the internet.)

This sounds very similar to the problems I had recently.
Internet Explorer freezing everytime I connect to the internet, having to reboot over and over, in the end I bought a new computer with XP and Norton Anti Virus. As soon as I had it installed (the new computer) it crashed, it turned out that aI had these two worms MSBlaster and Welchia, they had transfered from my old computer via the old data transfer ( I think), any way these were the cause of the problems.

To solve the problems my computer shop gave me a disc to erradicate MSBlaster and Norton Anti Virus quarantined Welchia

BTW....I had an Anti Virus system on my old computer but it just wasnt good enough. I also never open anything in my email if I dont know who or what it is.....never.

Hope this helps

Nursie-

If you think you have Sasser, and it may be from the sound of it, you need to double super extra sure check-see if you are up to date on Windows. Install ALL critical updates presented. Then, verify your AV definitions are up to date. Open the app and put your eyes on the definitions date of last update. If it's not up to date for some reason, update it and run a full scan.

To check and see and remove Sasser, go here:

http://securityresponse.symantec.com/av ... .worm.html (http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html)

and review the removal of the worm. There is also a workaround to suspend temporarily the repeated shutdowns. Once you are patched on Windows, download Symantec's Sasser removal tool and run it. Please review and comment.

[insight]

you need to double super extra sure check-see if you are up to date on Windows.


The Windows update battle is joined against those that would sooner see you off the net and sad.

In the real world, however, few of us are ever completely sure Windows is fully updated. Like keeping a clean car windshield @ 55 mph on a hot, summer night.

Firewalls are a great defense against Sasser and most other exploits or holes in Windows. Even users that don't do their updates are usually protected by firewalls.

Do your updates. At least make an effort to squirt some washer fluid. Even though it leaves some temporary streaking and makes you squint. :)

[nursewhen]

Nursie-

If you think you have Sasser, and it may be from the sound of it, you need to double super extra sure check-see if you are up to date on Windows. Install ALL critical updates presented. Then, verify your AV definitions are up to date. Open the app and put your eyes on the definitions date of last update. If it's not up to date for some reason, update it and run a full scan.

To check and see and remove Sasser, go here:

http://securityresponse.symantec.com/av ... .worm.html (http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html)

and review the removal of the worm. There is also a workaround to suspend temporarily the repeated shutdowns. Once you are patched on Windows, download Symantec's Sasser removal tool and run it. Please review and comment.
Thanks thatguyben,

I'll do that tonight and let you know.

[Hansuke]

I didn't see spysweeper mentioned above. I use it, and it stays in the tray catching items as they come into my computer. Its mostly just tracking cookies, luckily.

[logan]

To do a complete virus/worm check go here - http://www.symantec.com/index.htm click on Symantec Security Check...on the next page click Start Virus Detection.

[nursewhen]

OK, so here's what happened.

I checked for windows updates at windowsupdate.microsoft.com. I was completely up to date on the critical stuff, but I downloaded the recommended ones while I was there.

I tried to force an update on my anti virus, but that was up to date too. Then I ran it, no viruses were found.

I downloaded the sasser software from here
http://securityresponse.symantec.com/av ... .worm.html (http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html)
I unplugged the modem, switched off System Restore and ran it. The result was that Sasser was not found.

I restarted the computer and was met with 'The system has just recovered from a serious failure' or something like that.
Rebooted again, ran the software again and got the same result.

I've switched the System restore back on now.
So where do I go from here? :?

By the way, Dr When is planning some percussive maintenance on the PC fan this weekend. I apologise in advance for the noise.

I'm currently 1/2 way through Logan's Virus detection, but it's taking ages, so I'm going to toddle off to bed and let it run.

Tune in tomorrow for Nursies continued adventures with her recalcitrant PC.
:D

Edit, the scan has just finished and pronounced my PC clear of all viruses and trojan horses.

[nursewhen]

Well it looks like Stormie got the diagnosis right.
Dr When took my PC apart and found that the fan had been installed back to front.
The problem appears to be solved.
Huzzah! :D

Thanks everybody for your help.

[Thesteve2K]

The kinds of shutdowns you are having are usually:

1. The processor's heatsink isn't attached properly

or

2. The power supply is flaking out

Also i just wanted to add that a computer will also reboot if the CPU on your graphics card overheats aswell, it might be worth checking if the fan on the graphics card can move freely too because they can get stiff overtime

[thatguyben]

Well it looks like Stormie got the diagnosis right.
Dr When took my PC apart and found that the fan had been installed back to front.
The problem appears to be solved.
Huzzah! :D

Thanks everybody for your help.

Glad it was a relatively easily-corrected hardware problem and not a bad case of the worms.