A Thought of Mine in the Battle against Spyware/Adware...

Printable View

October 14th, 2004, 01:31 AM
The Grunt

A Thought of Mine in the Battle against Spyware/Adware...

I'm not sure how well this works... But it is certainly a great temporary fix... What I did was use Process Explorer to see where the adware's exe was located, then I go there, kill the process, and then set permissions on the folder and file's inside so that NOTHING can open it or run it without the permissions being changed back... Granted, this does nothing to stop most spyware and hijackers, but if you need a quick fix while downloading Spybot and ad aware on a clients computer, this just might work... It's working for me... Damn dial up... My Ad-Aware just stopped workign the other day, I would assume from some sort of adware/spyware, so I'm downloading the newest version while having all the suspicious exe's gone for the moment...

And yes, I did delete the exe's first before I did the permissions thing. They were coming back, so I figured with this fix, they will have to be smart enough to find a new directory or die. I hope they just sputter and die. I'm pretty sure it's a BHO issue on this, so I just need to run hijack this...

Well yeah... That's what I just did... So... Anyone think it sounds like a slightly good idea? (probably not, but oh well. It's working for me.)
October 14th, 2004, 07:41 AM
lostit44

Definitely a creative temporary fix one that I will have to keep on hand for this type of problem.
October 14th, 2004, 08:10 AM
Soda_Popinsky

Or you can do your malware removal in safe mode w/ networking. :p
October 14th, 2004, 12:32 PM
The Grunt

Well... :P
My idea is for people to lazy to reboot!!! HA!
October 14th, 2004, 03:26 PM
Chasm

Spyware is an increasing problem. One that isn't going away anytime soon. At any given time, I have friends, relatives complaining about spyware, popups and hijacks.

I keep a dedicated thumbdrive (it can be automatically picked up by anything>Win98). This is my tool to fight spyware, etc. Important things I have loaded on it: Ad-Aware SE, SpyBot, CWShredder, McAfee 8.0i trial (or any AV of your choice), and the latest DAT.

First I copy all contents of the thumbdrive to C:. (2) Disabled the network connection.
(3) Remove any previous version of AV and install your new and improved AV. Load the latest Definitions (DATs).
(4) Boot to safe mode. (5) Install all the good stuff (ad-aware, etc). Run them and remove bad stuff. (6) Run a full AV scan.

Last but not least after reboot, install all critical updates and SPs. (I usually keep IE 6SP1 and XP SP2 on CD just in case) (I know that the patches don't have much to do with adware, but they are the single most important thing you can do.)

It takes a little work but in the end you will remove all malicious infection. (and stop the people from calling you back, at least for a couple months :)
October 14th, 2004, 09:25 PM
romanticcowboy

Re: A Thought of Mine in the Battle against Spyware/Adware...

Quote:

Originally posted here by The Grunt
I'm not sure how well this works... But it is certainly a great temporary fix... What I did was use Process Explorer to see where the adware's exe was located, then I go there, kill the process, and then set permissions on the folder and file's inside so that NOTHING can open it or run it without the permissions being changed back... Granted, this does nothing to stop most spyware and hijackers, but if you need a quick fix while downloading Spybot and ad aware on a clients computer, this just might work... It's working for me... Damn dial up... My Ad-Aware just stopped workign the other day, I would assume from some sort of adware/spyware, so I'm downloading the newest version while having all the suspicious exe's gone for the moment...

And yes, I did delete the exe's first before I did the permissions thing. They were coming back, so I figured with this fix, they will have to be smart enough to find a new directory or die. I hope they just sputter and die. I'm pretty sure it's a BHO issue on this, so I just need to run hijack this...

Well yeah... That's what I just did... So... Anyone think it sounds like a slightly good idea? (probably not, but oh well. It's working for me.)

thank you ill definitly keep this one in my tool box ,i had a problem with lop earlier this year where this would have definitly helped in me trying to remove lop (i ended up reformating)