R
rick
it does not get rid of spyware
P
plun
rick said:
Well, it does. But not all. You can`t
find any program wich removes them all.
Mission impossible !
Maybe you can help us to recognise
more spywares if you have found one that
MSAS cant find or remove ?
D
dave
V
Vanguard
rick said:
Thanks for the ever so detailed help in identifying your problem.
B
Bill Sanderson
Rick - you're risking being classified as a troll.
If you have something that is identified, and stated as being removed, and
it keeps coming back--that's bad, and something we can perhaps help with if
you'd tell us more.
If your issue is that Microsoft Antispyware says you are clean, but product
zzz says otherwise, there are reasonable answers to that as well.
If you have something that is identified, and stated as being removed, and
it keeps coming back--that's bad, and something we can perhaps help with if
you'd tell us more.
If your issue is that Microsoft Antispyware says you are clean, but product
zzz says otherwise, there are reasonable answers to that as well.
G
Guest
I am really happy with this beta program BUT:
It cannot remove "SearchMiracle AdDownloader Trojan" and
I am going crazy!!
I wrote down the registry keys etc. it is affecting.
Does anyone know what the steps are to get rid of this
spyware? Can I go into C drive and manually delete these
keys? If so, will my computer be ruined?
Please help.
-Stormy
It cannot remove "SearchMiracle AdDownloader Trojan" and
I am going crazy!!
I wrote down the registry keys etc. it is affecting.
Does anyone know what the steps are to get rid of this
spyware? Can I go into C drive and manually delete these
keys? If so, will my computer be ruined?
Please help.
-Stormy
E
Engel
Rick:
Read and follow:
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussof
tware.mspx
CAUTION!!!!! Removing some spyware can damage the Winsock
stact. Before
you try to remove spyware using any of these programs ,
download a copy of
LSP-Fix - a free program to repair damaged Winsock 2
stacks (all Windows
versions)
http://www.cexx.org/lspfix.htm
Winsockfix for W95, W98, ME, NT, 2000, XP
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?
ttid=257
WinXP:
Get WinSockxpFix
http://www.spychecker.com/program/winsockxpfix.html
How to Reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/kb/299357
In WinXP SP2: You can fix Winsock by going to Start | Run
and typing
CMD
In the command window type
netsh winsock reset
See
Dealing with Unwanted Malware, Parasites, Toolbars and
Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Note that AdAware and SpyBot S & D will each catch some
things the other
won't. Also, each needs to be updated with the program's
update function
before every use, even when just downloaded. There's also
a lot more to do
than just those two programs. CWShredder is also
available here:
http://www.intermute.com/products/cwshredder
**Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://forum.aumha.org/viewforum.php?f=30 for expert
analysis, not here.**
Alternative download pages for Ad-Aware, Spybot,
HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.
See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars
If nothing there helps, please post back to this thread.
Read and follow:
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussof
tware.mspx
CAUTION!!!!! Removing some spyware can damage the Winsock
stact. Before
you try to remove spyware using any of these programs ,
download a copy of
LSP-Fix - a free program to repair damaged Winsock 2
stacks (all Windows
versions)
http://www.cexx.org/lspfix.htm
Winsockfix for W95, W98, ME, NT, 2000, XP
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?
ttid=257
WinXP:
Get WinSockxpFix
http://www.spychecker.com/program/winsockxpfix.html
How to Reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/kb/299357
In WinXP SP2: You can fix Winsock by going to Start | Run
and typing
CMD
In the command window type
netsh winsock reset
See
Dealing with Unwanted Malware, Parasites, Toolbars and
Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Note that AdAware and SpyBot S & D will each catch some
things the other
won't. Also, each needs to be updated with the program's
update function
before every use, even when just downloaded. There's also
a lot more to do
than just those two programs. CWShredder is also
available here:
http://www.intermute.com/products/cwshredder
**Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://forum.aumha.org/viewforum.php?f=30 for expert
analysis, not here.**
Alternative download pages for Ad-Aware, Spybot,
HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.
See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars
If nothing there helps, please post back to this thread.
E
Engel
If possible submit a spywarereport to MS, menu tools.
Good luck
Engel
Good luck
Engel
S
Sandi Hardmeier
Cite: original author - Frank Saunders, MVP.
S
Sandi Hardmeier
Hi anonymous,
Removing the registry keys may work, temporarily, but you still have to get
rid of the active files.
Before trying to remove spyware:
Back up all essential data.
Download the recommended software
After all software has been downloaded, installed and updated disconnect the
computer from the internet and/or any network to which it may be attached.
The software you should download and have ready to use is:
Lspfix and Winsockfix, available at http://www.cexx.org/lspfix.htm and
http://www.spychecker.com/program/winsockxpfix.html
A BHO disabler such as BHO Cop, BHO Demon or BHOCaptor (non XP SP2 users
only)
http://www.pcmag.com/article2/0,4149,270,00.asp
http://www.definitivesolutions.com/bhodemon.htm
http://www.webattack.com/get/bho.shtml
AdAware (note that Lavasoft have now released Ad-Aware SE Personal Edition,
available from http://www.lavasoftusa.com/support/download/ AdAware 6 users
should update to SE as soon as possible. All previous versions are NO LONGER
SUPPORTED)
Spybot Search and Destroy - http://spybot.eon.net.au
HijackThis - http://209.133.47.12/~merijn/files/HijackThis.exe
CWShredder - http://www.intermute.com/spysubtract/cwshredder_download.html
HackerDefender Disabler - http://www.aumha.org/downloads/unhackdef.zip
Extract the BAT file to your desktop.
After obtaining the required software above, make sure you check for updates
and run the programmes in safe mode.
Malware removal (beginner's guide):
Go to Control Panel, Folder Options, View Tab. Turn on the option to show
hidden files. Turn off the option to hide protected system files.
***WARNING!! Files are hidden by Windows for a very good reason. It is not
wise to 'experiment' with these files. Unfortunately, to successfully remove
modern malware we must turn this protection off. There is a risk to doing
this. Please turn the protection back on when you have finished cleaning
your system.***
Run HackerDefender Disabler. A DOS window will flash onto your screen and
then disappear. This is normal.
If you are using Windows XP SP2 download and install Update KB888240 to
solve a known problem where add-ins will sometimes hide themselves from the
Add-On Manager. The hotfix is available from:
http://www.microsoft.com/downloads/...9e-b116-4d38-b00c-ff1d529106c8&displaylang=en
Go to Control Panel, add/remove programs. Check for malware entries and use
the uninstall programs, then reboot. Check all 'startup' folders at
...\Documents and Settings\All Users\Start Menu\Programs\Startup or
...\Documents and Settings\<username>\Start Menu\Startup
Go to start/run and type MSCONFIG. Go to the startup tab. Disable everything
that you do not recognise as legitimate (do not disable any power profile
options).
Now go to the Services tab. Turn on the option to 'hide all Microsoft
Services'. Disable everything that remains. If you don't have this option,
don't worry about it.
Reboot your computer and hold down the F8 key until the boot menu options
appear. Choose Safe Mode as your startup choice. You will find information
about what safe mode is, and what it does, at this link
[http://inetexplorer.mvps.org/data/safe_mode.htm]
If you are using Windows XP, go to Tools, Manage Add-Ons and disable
anything you don't want or recognise. If you are not running XP SP2 use one
of the BHO disablers mentioned earlier.
Empty your IE cache and your other temporary file folders, eg: c:\temp,
c:\windows\temp or C:\Documents and Settings\<name>\Local Settings\Temp (the
path to your temp folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for mysterious *.exe files or
*.dll files in those folders.
Go to IE Tools, Internet Options, Temporary Internet Files {Settings
Button}, View Objects, Downloaded Program Files. Check for unrecognised
objects there.
Go to IE Tools, Internet Options, Accessibility. Make sure there is no style
sheet chosen (under User Style Sheet - format documents using my style
sheet). If the option is turned on, turn it OFF.
Start CWSHREDDER and fix anything it finds. Reboot back into safe mode.
Start AdAware.
Remember to update using the 'check for updates now' button. Update, then
select 'start' option.
Make sure that 'search for negligible risk entries' is turned on. Select
'use custom scanning options' then select 'customise'. Make sure the
following options are enabled: 'scan within archives', 'scan active
processes', 'scan registry', 'deep scan registry', 'scan my IE favorites for
banned URLs', 'scan my Hosts file'.
Select the 'tweak' option. Under 'scanning engine', make sure 'unload
recognized processes and modules during scan' is enabled. Enable 'scan
registry for all users instead of current users'.
Under 'cleaning engine' turn on 'always try to unload modules..', 'during
removal unload explorer and IE if necessary', 'let windows remove files in
use at next reboot', 'delete quarantined items after restoring'.
Use the 'select drives and folders to scan' option to ensure that your
ENTIRE hard drive is scanned (if you have more than one hard drive, scan all
of them (of course, do not include floppy and CD/DVD).
Once finished, reboot again into safe mode. Run Spybot S&D. "Fix" anything
marked red.
If you are unable to get on to the internet after cleaning up your computer,
run LSPfix. If that doesn't work, run Winsockfix.
If you are using XP SP2 and are unable to access the internet after removing
malware, the following commandline may help - it will reset the winsock
catalogue:
netsh winsock reset
If the malware problem comes back further specialised assistance is
available via the Hijackthis forum at http://forum.aumha.org - make sure you
read the top announcements about pre-post steps you should take before
generating a hijackthis log.
Removing the registry keys may work, temporarily, but you still have to get
rid of the active files.
Before trying to remove spyware:
Back up all essential data.
Download the recommended software
After all software has been downloaded, installed and updated disconnect the
computer from the internet and/or any network to which it may be attached.
The software you should download and have ready to use is:
Lspfix and Winsockfix, available at http://www.cexx.org/lspfix.htm and
http://www.spychecker.com/program/winsockxpfix.html
A BHO disabler such as BHO Cop, BHO Demon or BHOCaptor (non XP SP2 users
only)
http://www.pcmag.com/article2/0,4149,270,00.asp
http://www.definitivesolutions.com/bhodemon.htm
http://www.webattack.com/get/bho.shtml
AdAware (note that Lavasoft have now released Ad-Aware SE Personal Edition,
available from http://www.lavasoftusa.com/support/download/ AdAware 6 users
should update to SE as soon as possible. All previous versions are NO LONGER
SUPPORTED)
Spybot Search and Destroy - http://spybot.eon.net.au
HijackThis - http://209.133.47.12/~merijn/files/HijackThis.exe
CWShredder - http://www.intermute.com/spysubtract/cwshredder_download.html
HackerDefender Disabler - http://www.aumha.org/downloads/unhackdef.zip
Extract the BAT file to your desktop.
After obtaining the required software above, make sure you check for updates
and run the programmes in safe mode.
Malware removal (beginner's guide):
Go to Control Panel, Folder Options, View Tab. Turn on the option to show
hidden files. Turn off the option to hide protected system files.
***WARNING!! Files are hidden by Windows for a very good reason. It is not
wise to 'experiment' with these files. Unfortunately, to successfully remove
modern malware we must turn this protection off. There is a risk to doing
this. Please turn the protection back on when you have finished cleaning
your system.***
Run HackerDefender Disabler. A DOS window will flash onto your screen and
then disappear. This is normal.
If you are using Windows XP SP2 download and install Update KB888240 to
solve a known problem where add-ins will sometimes hide themselves from the
Add-On Manager. The hotfix is available from:
http://www.microsoft.com/downloads/...9e-b116-4d38-b00c-ff1d529106c8&displaylang=en
Go to Control Panel, add/remove programs. Check for malware entries and use
the uninstall programs, then reboot. Check all 'startup' folders at
...\Documents and Settings\All Users\Start Menu\Programs\Startup or
...\Documents and Settings\<username>\Start Menu\Startup
Go to start/run and type MSCONFIG. Go to the startup tab. Disable everything
that you do not recognise as legitimate (do not disable any power profile
options).
Now go to the Services tab. Turn on the option to 'hide all Microsoft
Services'. Disable everything that remains. If you don't have this option,
don't worry about it.
Reboot your computer and hold down the F8 key until the boot menu options
appear. Choose Safe Mode as your startup choice. You will find information
about what safe mode is, and what it does, at this link
[http://inetexplorer.mvps.org/data/safe_mode.htm]
If you are using Windows XP, go to Tools, Manage Add-Ons and disable
anything you don't want or recognise. If you are not running XP SP2 use one
of the BHO disablers mentioned earlier.
Empty your IE cache and your other temporary file folders, eg: c:\temp,
c:\windows\temp or C:\Documents and Settings\<name>\Local Settings\Temp (the
path to your temp folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for mysterious *.exe files or
*.dll files in those folders.
Go to IE Tools, Internet Options, Temporary Internet Files {Settings
Button}, View Objects, Downloaded Program Files. Check for unrecognised
objects there.
Go to IE Tools, Internet Options, Accessibility. Make sure there is no style
sheet chosen (under User Style Sheet - format documents using my style
sheet). If the option is turned on, turn it OFF.
Start CWSHREDDER and fix anything it finds. Reboot back into safe mode.
Start AdAware.
Remember to update using the 'check for updates now' button. Update, then
select 'start' option.
Make sure that 'search for negligible risk entries' is turned on. Select
'use custom scanning options' then select 'customise'. Make sure the
following options are enabled: 'scan within archives', 'scan active
processes', 'scan registry', 'deep scan registry', 'scan my IE favorites for
banned URLs', 'scan my Hosts file'.
Select the 'tweak' option. Under 'scanning engine', make sure 'unload
recognized processes and modules during scan' is enabled. Enable 'scan
registry for all users instead of current users'.
Under 'cleaning engine' turn on 'always try to unload modules..', 'during
removal unload explorer and IE if necessary', 'let windows remove files in
use at next reboot', 'delete quarantined items after restoring'.
Use the 'select drives and folders to scan' option to ensure that your
ENTIRE hard drive is scanned (if you have more than one hard drive, scan all
of them (of course, do not include floppy and CD/DVD).
Once finished, reboot again into safe mode. Run Spybot S&D. "Fix" anything
marked red.
If you are unable to get on to the internet after cleaning up your computer,
run LSPfix. If that doesn't work, run Winsockfix.
If you are using XP SP2 and are unable to access the internet after removing
malware, the following commandline may help - it will reset the winsock
catalogue:
netsh winsock reset
If the malware problem comes back further specialised assistance is
available via the Hijackthis forum at http://forum.aumha.org - make sure you
read the top announcements about pre-post steps you should take before
generating a hijackthis log.
H
HH
rick said:
Nor does it get rid of CoolWebSearch. It calls it trojan.z and the
description is "they are researching the issue." When I open IE, it hijacks
the homepage and search registry keys.
I guess that's why they call it a beta.
F
Frank Saunders, MS-MVP IE/OE
HH said:
Yep, that's why they call it a beta.
First, if you don't have WinXP SP2, get LSP-Fix - a free program to repair
damaged Winsock 2 stacks
http://www.cexx.org/lspfix.htm
save it because you might need to repair the Winsock 2 stacks after removing
the culprit.
For WinXP SP2 this command will restore the Winsock stacks if you can't
connect after clearing the malware.
Go to Start | Run and type
CMD
In the command window type
netsh winsock reset
Then get CWShredder
http://www.intermute.com/products/cwshredder.html
--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/