Cleaning up spyware

jtr1962

Storage? I am Storage!
Joined
Jan 25, 2002
Messages
4,365
Location
Flushing, New York
Yesterday I went to my sister's for her 40th birthday. :b-day: I had heard she was having trouble with her PC being slow so while I was there I decided to do some troubleshooting, which was actually better for all involved since I avoided the people downstairs. :mrgrn: Anyway, there were something like 30 processes running :cursin: , and I immediately thought one or two things-this was either junk put in by software they had installed and/or it was adware/spyware.

I proceeded to remove items from the startup group and also from the appropriate places in the registry (HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run along with a few others). Some of this stuff was put there by software but wasn't necessary for the software to run (i.e. like MS Office installs findfast plus a whole bunch of other junk processes). Other registry keys looked like adware/spyware. In addition to all this, the home page of IE was set to some ad site which loaded tons of popups, and seemed to immediately reinstall some of the junk I had cleared. Once I set IE's start page to blank, most of the junk stayed gone. However, some things persistently kept reinstalling themselves despite my best efforts, and I would end up with running processes like ve564yui plus about five or six DOS programs with names like morze5 and te5yur in the startup group and registry. I was finally able to clear most of the garbage out for good by first killing all running processes except Explorer, deleting the startup and registry items, and rebooting.

Despite my best efforts, some problems remain. When the machine boots, about 8 screens warning about invalid links (i.e. morse5.lnk not found) come up, and I can't find where in the registry or anywhere else that these links are referred to. There don't seem to be any undesired running processes any more, but the persistent warning screens don't exactly make me feel that I've done everything I should have.

In case it helps, the machine is a 900 MHz PIII with 128 MB of RAM (more RAM is on the shopping list as the machine hits the pagefile during normal use). The Internet connection is Optimum online, the OS is Windows ME (moron edition :(). My niece and brother-in-law visit Kaaza and other questionable download sites frequently. I'm wondering if perhaps this is the cause of the problem, and how to prevent it in the future. Oh, I almost forget. They had McAffee anti-virus/ firewall which was mostly disabled and causing problems, so I uninstalled it. Any recommendations for good AV/firewall software? Given their browsing habits, they seem to need it.

BTW, since the responses in this thread will be directed to my sister and brother-in-law, who are less computer knowledgeable then myself, please try to explain everything a bit more in layman's terms. I'll e-mail my sister a link to this thread once it gets a few responses. Maybe I can convince her to register here so she can ask questions directly. We could use a few more female members anyway. ;)

As an aside, the people who write spyware/adware should have their heads prominently displayed on fence posts. :evil:
 

blakerwry

Storage? I am Storage!
Joined
Oct 12, 2002
Messages
4,203
Location
Kansas City, USA
Website
justblake.com
1) i doubt winME needs a firewall.

2) use an automated program for getting rid of spyware/adware. i recomend ad-aware. You can get it from the front page of download.com (at the bottom)

Keep it updated with the webupdate link (in the upper right of the program) and have it scan the system once overy week or two.
 

Tea

Storage? I am Storage!
Joined
Jan 15, 2002
Messages
3,749
Location
27a No Fixed Address, Oz.
Website
www.redhill.net.au
Ad-Aware is the best.

I always give the link to the Ad-Aware home page, not to any third-party download sites - who knows what they might foist on you? Go direct to the surce. http://www.lavasoft.de

To use Ad-Aware when you suspect a recalcitrant spyware infection (and this same advice would apply to other products in the same category) remember that some spyware programs can detect and defend themselves against Ad-Aware. So you have to be smarter than the spyware is. Here is what you do:

Arrange matters such that you can access the Ad=Aware install .EXE and the latest update .DAT from safe mode. With WinXP you can access them off CD, with win9X you need to copy them onto the hard drive in advance. Do not install them yet!

Reboot into safe mode. Now do the installation, and then copy the update .DAT into C:\program files\lavasoft\ad-aware.

You now have a fully up-to-date Ad-Aware, and the spyware doesn't know it! Because you are in safe mode, the spyware, along with almost all other system processes is fast asleep.

Only now do you finally run Ad-Aware.

Before, during, and after, you may add registry edits and MSCONFIG stuff to taste.

Note: this method is not fair, as it doesn't give the spyware a chance to defend itself. Unfortunately, when it comes to spywares, I don't believe in fair. My motto is Get the little bastards anyway you can!
 

Will Rickards WT

Learning Storage Performance
Joined
Jun 19, 2002
Messages
433
Location
Pennsylvania, USA
Website
www.willrickards.net
Anti-Virus - Nod32 http://www.eset.com download
Firewall - ZoneAlarm http://www.zonelabs.com download

Yes you have to pay for nod32 but it has consistently won awards for best anti-virus. And from personal experience it uses very little system resources to do so.

ZoneAlarm is dead simple to use once installed.
You just say yes or no to the dialogs asking you whether to allow this or that program to access the internet.

1) i doubt winME needs a firewall.
Every PC needs a firewall. Especially those less technically inclined.
 

Mercutio

Fatwah on Western Digital
Joined
Jan 17, 2002
Messages
22,232
Location
I am omnipresent
I have a client - the commodities traders who are funding my interest in digital cameras - where browsing porn is an acceptable down-time activity (It's an office with 11 guys and a 6Mbit internet connection. Go figure).

Anyway, these guys - except the two I convinced to switch to Firebird - have spyware problems that tend to cripple their PCs on a regular basis, even though they have adaware pro installed and actively scanning on all their machines.

What I've found is, that if I just do adaware, it doesn't get everything (it gets about 85% of the cruft).
If I just do Spybot, that doesn't get everything, either (it gets about 70% of the cruft).

If I do Adaware Pro (which runs in the background like AV software) + regular Spybot scans, I usually get rid of about 95% of the junk that ends up on those machines.

I keep hoping that adaware will come to a point where it actually gets everything, but I don't think that's realistic. But it's also not necessarily a good idea to rely on adaware by itself.
 

Tea

Storage? I am Storage!
Joined
Jan 15, 2002
Messages
3,749
Location
27a No Fixed Address, Oz.
Website
www.redhill.net.au
I bought Ad-Aware Pro but am not clear on how you are supposed to keep it up to date. It's probably simple enough, but I just get so tired of buggerising about finding licence keys and special download sites for registered versions and serial numbers and mother's maiden names and all the rest of it, so although I own the registered version, I only use the freeware version.

One thing that seems to help a great deal is not using any flavour of IE at suspect sites. I never use IE anymore, except right here at Storage Forum (where it is my standard browser, as Tannin Hogs Mozilla and Opera 6 for other places he likes), and sometimes to click on links from this site - though I don't like doing that much and I tend not to follow links directly.
 

LiamC

Storage Is My Life
Joined
Feb 7, 2002
Messages
2,016
Location
Canberra
Not using IE. Hear, hear.

Nothing against IE, in fact I like it, but I have had had far less trouble (like zero) since switching to alternative browsers. Mozilla/Phoenix/Firebird/FireFox for more than twelve months or so. It seems the best defence.
 

Stereodude

Not really a
Joined
Jan 22, 2002
Messages
10,865
Location
Michigan
One of my coworker's PC has both Adaware and Spybot and still has something on there feeding him popups. They even get past the Google toolbars popup blocker. They're not Flash based ads either.
 
Top