Help...

[Carefree Frank]

Hi guys and gals, I warned that once I got this new computer that I`d be full of questions, so heres another.

My comp has apparently been infected with a spyware bug, and despite running the system through Spybot, it doesnt seem to be totally rectifying the problem. I`ve run several tests today, from different sites with varying results, but one site has given me info which has me a little confused. According to this particular site it tells me that one of the spy systems I`ve installed isnt an anti-spy system at all, but infact its actually pretending to be one? My first reaction was to delete the icon link to the site, but when I went to do that the comp told me that removing the icon wasnt going to remove the program, and that I`d need to go to the program list and delete it from there. SURPRISE SURPRISE!!! it wasnt on the list. So, my next idea is to use my comps restore feature. The idea being that if I turn back the clock a couple of days, and then reinstall spybot, I should be okay. Failing that, I imagine I`m probably going to have to run the Restore disc that came with the comp and completely wipe the system. I dont fancy doing that, but if it comes to it, I will.

Two things I need to ask...1. Would my first idea of turning back the clock work? 2. If I save my photos onto a disc before I run the reload driver, are my pics likely to be infected, or cant that happen. The spyware problem seems to be a tracking devise, so I dont imagine they`d be affected. What do you think?

[xbot]

Originally posted by Carefree Frank
Hi guys and gals, I warned that once I got this new computer that I`d be full of questions, so heres another.

My comp has apparently been infected with a spyware bug, and despite running the system through Spybot, it doesnt seem to be totally rectifying the problem. I`ve run several tests today, from different sites with varying results, but one site has given me info which has me a little confused. According to this particular site it tells me that one of the spy systems I`ve installed isnt an anti-spy system at all, but infact its actually pretending to be one? My first reaction was to delete the icon link to the site, but when I went to do that the comp told me that removing the icon wasnt going to remove the program, and that I`d need to go to the program list and delete it from there. SURPRISE SURPRISE!!! it wasnt on the list. So, my next idea is to use my comps restore feature. The idea being that if I turn back the clock a couple of days, and then reinstall spybot, I should be okay. Failing that, I imagine I`m probably going to have to run the Restore disc that came with the comp and completely wipe the system. I dont fancy doing that, but if it comes to it, I will.

Two things I need to ask...1. Would my first idea of turning back the clock work? 2. If I save my photos onto a disc before I run the reload driver, are my pics likely to be infected, or cant that happen. The spyware problem seems to be a tracking devise, so I dont imagine they`d be affected. What do you think?

1. Maybe. Maybe not. No real way to know.
2. Spyware won't infect them, however, viruses will. I doubt you have them.


By the way--what program are you talking about? You don't have to be unspecific here, which you appear to be trying really hard to do.

It'd be very drastic to do that.

Boot into safe mode (Press F8 while the computer boots up) and do scans with spybot and Adaware in safe mode.)

[Carefree Frank]

I`m sorry, I dont mean to appear unspecific, I`m just completely ignorant to many of the technical terms and suchlike, you`ll have to forgive me. Anyway, the system which is causing the main problem is called Stopsign. I wish I could recall exactly which check program I ran to discover it is a fraud, but I have run so many today my head is spinning. As far as I can recall it was Spyware Doctor.

[war17]

System Restore only restores a set of older system files, not all files. So SR will not likely remove the spyware.

Run AdAware and see if the spyware get deleted. Definitions of what is spyware differs a little from scanner to scanner. So running AdAware will be helpful.

If all else fail, you can run HijackThis, post a log in Spywareifo forums, and let the expert there identify the spyware to remove.

[Carefree Frank]

If as you suggest, my photos will be okay, I think I`d better donload them onto a disc. I dont mind reinstalling the computer again, but I`d be gutted to lose the pics.

[Carefree Frank]

Thanks War, I`m not completely sure of what you suggest, but I`ll stick it in a search engine and see where it leads me. Hopefully one of your suggestions will clear this up for me.

[war17]

1. Use the following scanners to find and remove the website.

SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/
or
CoolWebShredder
http://www.spychecker.com/program/coolwebshredder.html

2. Some porn websites redirects links to their websites using your HOSTS file. Do a search for the HOSTS (without extension) file and remove the entry.

3. If still no joy, download HijackThis from Spywareinfo download page

http://www.spywareinfo.com/program/hijackthis.html

Run the program and you will find many entries. Most are OK. Post the log in Spywareinfo forums. I use to be pretty at deciphering the log, but I am out of practice.

[xbot]

Go with the above users suggestions, but change those ORs to ANDs. One spyware program is not an all-in-one fixit, they all scan different things.

[Carefree Frank]

Is this spyware going to be that much of a problem? From what I can make out all the pop-ups are being blocked, so will it do me any real harm?

[war17]

It depends on the type of spyware. If it is only popup advertising, then no, it no problem. If they are tracking spyware, then it tracks your activity any time you travel the internet.

Since they are popup, it may be coming from Windows Messenger Service. If you have Windows Messenger Service, disable it. The Messenger service is typically not needed for home users.

Right-click My Computer and click Manage.
Click Services and Applications.
Click Services.
Scroll down to Messenger and right-click.
Stop the Service.
Choose Disable as the Startup Type.
Click OK

[Carefree Frank]

Thanks War, you`ve been really helpful. I`ve run Skybot this morning, and found more problems coming up. I`ve cleared those, and then ran CWS Shredder. This has apparently cleared all the problems, at least I think it has. The Stop Sign icon has gone from my desktop, so I`m assuming the problem is solved...I hope so!

[Carefree Frank]

CAN ONE HAVE TOO MANY PROGRAMS RUNNING?

In all the panic over this spy virus I contracted, I`ve found myself downloading virtually every spyware detector I`ve seen. Is this a bad thing? I currently have Noadware, SWShredder, Alert Spy, Spyware Doctor, Spybot Search and Destroy and Kaspersky. Now I`ve found that my ISP has a Broadband Medic service, which provides Anti-Virus and Firewalls, and I`m thinking this might be useful too, am I wrong? Which of these services is best to hang on to, and which, if any, should I discard?

[dragon1]

Having more than one anti-spyware programs is fine. Spybot usually says, if you have Ad-Aware installed, that it's there, but no big deal. I have three and find that combined, they find more spyware and adware than if I used just one.

More than one anti-virus program -- I don't know. There may be conficts between the programs, but I've used online virus scanners alongside the installed one and there weren't problems.

I know that you need only one good firewall. The firewall that Windows XP SP2 enables isn't as good as Zone Alarm, so if you install Zone Alarm, disable the Windows firewall.

Also, for any of the programs above, the key to good protection is making sure you update the programs with the latest definitions. Most of them can be set to update automatically; some you have to do manually.

Here's a timely article from Dennis Faas of InfoPackets.com. Scroll down to the Featured Article.