Community Newsletter: Q&A forum: 4/1/05 Removing malware that just won't die!

Answer:

Dear Tom,

While you alluded to the use of various antispyware utilities, you failed to mention whether your daughter's computer is protected by a firewall. This is a key consideration and the first part of the solution to your problem.

You are being bombarded with pop-ups as soon as you boot the PC because of adware configured to run whenever Windows starts. Adware is a type of spyware that monitors your Internet behavior, then "calls home" without your knowledge. The information collected and shared with a third party is used to select advertisements tailored to your surfing habits, which are then downloaded and displayed as pop-ups. As you have realized, this process does not depend on any other programs running, so SP2's pop-up control - an Internet Explorer add-on - is of no help. But successful adware depends on access to the Internet, and this is where a solid firewall comes into play.

A strong firewall like ZoneAlarm blocks such unauthorized connections to the Internet, thus preventing adware from downloading ads. When you disconnected your cable modem, you essentially blocked outgoing Internet traffic just like a good software firewall does.

Since you have SP2 installed in your daughter's PC, chances are you are running Windows Firewall. This is a very basic firewall that prevents intruders from getting into your computer, but it doesn't prevent spyware already in it from accessing the Internet. In contrast, a more powerful software like ZoneAlarm monitors and controls both incoming and outgoing Internet traffic. Any spyware present will be unable to phone home. If you are currently relying on Windows Firewall - or have turned it off for some reason - do yourself a favor and install ZoneAlarm Personal as soon as possible. You can download this excellent firewall for free by visiting http://www.zonelabs.com/.

Sometimes, antispyware utilities detect a known spyware program but fail to remove all of its key components. Active or potentially active spyware "fragments" that remains in your computer might not be detected during future scans. In addition, restoring your computer to an earlier point might also restore registry values that allow adware and spyware components to run once again. (Because of this, it would be a good idea to disable System Restore while you perform the following troubleshooting!) Thus, it is imperative that any spyware leftovers are removed manually, or kept from running during startup. Adware that is unable to download ads because of a firewall might still display blank pop-ups, which would be just as annoying!

Since you indicated that you have Spybot Search & Destroy and Ad-Aware SE, let's start the next phase of troubleshooting by making sure the latest detection definitions are installed. Download any newer software versions and definitions, then scan your computer first with Ad-Aware SE, then with Spybot S&D.

After removing any spyware detected during the scans, click the Immunize button on Spybot S&D's toolbar, and follow the prompts. The Immunize function will provide real-time protection against the installation of some spyware. Real-time protection is indispensable if you want to keep your computer free of spyware. Another excellent tool you should consider is Microsoft Windows AntiSpyware (http://www.microsoft.com/athome/security/spyware/software/default.mspx )

Next, start Spybot S&D it in Advanced Mode, if it is not configured to do so already. (To switch modes, click on Mode on Spybot S&D's menu bar, then choose Advanced Mode from the drop-down menu). On the left, you will see the toolbar with several buttons. Click on the one labeled Tools, then choose System Startup. This is a very helpful utility that lists all the programs that run when you start your computer. When you click an entry in the main window, Spybot S&D will provide a brief description of the program. (If you are unable to see the descriptions, click on the gray bar with the two navy arrowheads, and drag it towards the main window to display the additional window, which has a pale yellow background.)

If any program is identified as spyware or adware, deselect the entry by clicking on its corresponding box. Understand, you are not actually deleting these items from your computer. By removing the check-marks, you are preventing spyware (or any other program you choose) from running the next time you Windows starts. You do have the option of deleting the entries, but it is a good idea to just disable them for the time being, lest you accidentally delete something you actually need, like your antivirus or a Windows component. You can always run the System Startup utility after you are sure everything works fine, and delete the offending entries.

(Incidentally, you can disable programs set to run on startup with the Windows XP System Configuration utility (Msconfig.exe), but the latter lacks program descriptions. Because many of the programs have very cryptic names, you are likely to end up guessing and disabling the wrong things!)

Once you have disabled any spyware components listed under System Startup, restart your computer.

Hopefully the pop-ups will be gone, but if any are still displayed, you can use the Windows Task Manager to see which processes are running at that time. Write down their names, and look them up in the Task List Programs database found at http://www.answersthatwork.com/.

Again, if there is anything identified as spyware or adware, you can disable it using either Spybot S&D's System Startup utility, or Msconfig. If you are unfamiliar with the Windows Task Manager and Msconfig utilities, you can find a description of these tools by clicking your computer's Start button, choosing Help & Support, and entering the corresponding terms in the search box.

One last consideration: It is possible that you may be running a legitimate program that has adware components or functionality. For example, if you complement your broadband connection with, say, America Online, many of the pop ups might come from AOL itself. These might not be recognized as spyware when you scan your computer. Moreover, because a firewall would grant Internet access to AOL and its components, it might take some trial and error before your firewall is configured to block access to those components responsible for a pop-up blitz.

Having said that, I am pretty confident that if you follow the preceding troubleshooting advice, you will solve the pop-up issue to your satisfaction.

Best wishes,

Miguel K.


Submitted by: Submitted by: Miguel K. of Columbus, Ohio

In reply to a some what distasteful post!!
There are those of us who do not have a problem with our original OS or Browser!!There are ways and means to keep everything running smoothly,I call it sweep and mop in my computer,as it is in our houses,flats,aparts or whatever!!However some folks just download and download, the first thing they see that seem's to be a "good thing",I'll download that as well!! and music and photos and use word pad and high end games etc....etc....
That's ok when the puter is new but then they start to delete and reinstall etc..etc..
The computer will NOT die!! It will work until it cannot work anymore because there is no room to move in it's little room,because it's full of junk,meaning leftover bit's and pieces from downloads and deleted install files which are never fully deleted etc... etc...
There is more work in keeping a computer running free and strong than to using word pad or playing a game on it.
Most computer's are badly adjusted from the start to give more "pretty looks" than workability!!
I am not for one or the other OS,it just gets my (nah)when ppl criticize without knowing what they are bleating about!!
by the way (nah)=goat in MSN MESSENGER which works an absolute treat on my THREE computers all micosoft OS's from 98 to xp pro with a xp home between them

If you do "this" for a living then why such a negative response to someone who needs help!!
Or I have completely mis-understood your post
AS for me,I am a professional jockey,licensed Tour Guide,Qualified ddec3,4,5,6 detroit diesel tech,Qualified diesel pump and injector tech,and i help my friends when they have a prob with their puter's
I was not "attacking" you,I found your post to be negative,these forums are here to help,so i thought:p

full of pearls of wisdom ain't ya dude. Practice what you preach coz its rich for you to be dissin someone for writing about nothing when you've done your fair share and more.

I'm not a self centered geek nor a self serving comp-nerd, [not that all geeks and nerds are] I'm just an ignorant jerk, that hopes and prays my computer works, just like I hope my car runs and toilet flushes. When they don't, I fix em. That seems to be the problem here, how do I fix it? Although that diesel guy reminded me of the "if my toilet worked as well as my computer" joke, I agree, lets get back to business.

I also use Spysubtract Se.

But try to tone the attack down a few knotches.

Right on, I have been using windows for 3 yrs. and read up on what I'm trying to do before I do it.Common sence works 99% of the time and luck works 1%. Not a serious problem in 3 yrs.

you've got a whole lot more infections than you think ... im willing to bet you're not that lucky.

#1 Yahoo Anti-Spy misses more than it catches and fine if your main concern is tracking cookies.
#2 Not having an anti virus is probably as dumb as standing on the roof of a speeding car.
#3 If you have no anti virus how do you know if your computer isn't infected ... guess work isn't an option.
#4 I am a tech and if you want to keep on blissfully travelling through life as you are then fine because one day in the not too distant future some tech near you is gonig to be putting your money in his/her pocket.
#5 Its not just you that you need to consider. If you use e-mail for example and you are infected ... if not now, you will be soon ... the almost certain probability is you're going to pass on your infections to others via e-mail.
#6 Why is it that kids think they're bullet proof right up until the time they get drilled right between the eyes.
Sorry dude but you're dreaming.

Well, I have made a good living doing this for nearly 20 years. One of the biggest problems that I confront is people who make their living by giving out defective and sometimes evil advice. I have seen many office systems totally screwed up by people who "make their living" by screwing up and then blaming MS.

I was so POed by the arrogance of the message I forgot to praise the quality of the winning answers. All three were of amazingly high quality and very useful--even to those of us who make our living doing this stuff.

Are you an ass for a living too? Because you do it very well.

>> when ppl criticize without knowing what they are

>>bleating about!!

> ...I do this for a living, what about you ?

Whoah! You post insensitive and annoying responses to internationally viewed message boards for a living?! Cowabunga, dude! How do I get a job like that, and what does it pay?!

As I read the replies I thought the same thing as googey, but I have a question about these other browsers. Are they resistant to these malware attacks or just to new to be targets?

Thanx Aussie_jack, I appreciate your reply.