Malicious Spyware

Hi, hope some genius can help me. I have WindowsXP, IE7 and I have spyware running that I can't get rid of. I tried 2 weeks ago to download Microsoft Malware Removal Tool, Spybot, AdAware and could not download them, I got error msgs after each attempt that they were "not a valid Win32 application". Since yesterday afternoon I have been trying to run Microsoft Safety Scanner, hours at a time to download, never completed...I got an error msg 0x08402805, which indicates that my internet connection was interrupted, but it wasn't. Since this morning, I have successfully run Microsoft Clean up Scan, Microsoft Tune up Scan and have been trying for the last 10 hours to download the Protection Scan (these three make up the "Safety Scan", I just thought it would be easier one at a time) but the Protection Scan gets to about 70% and won't go any further, same error msg every time 0x08402805. I've tried all the suggestions I can find except dickering with my registry, none work. I need the spyware gone because I process sensitive info constantly...Please help:(

Have you any idea what the spyware is?

Your downloading problem might be unrelated as I have heard of people having those issues with IE7 and XP and particularly with the MS security products.

You might try Firefox or Opera and see if you can download Spybot and A-squared using them. Otherwise download them on another computer and burn them to a CD/DVD before installing on the target machine.

My preferred methods in these circumstances are:

1. Slave the HDD to another computer and run the antimalware scans from there.

2. Use a live CD and boot from that.

Of course, the "safest" method is to save your data, format the drive and reinstall.

My daughter's HD had something similar.

We use Avast for AV protection, it wouldn't let Avast get through it's memory check. I started Avast, killed the memory check. Set the computer for a boot scan and rebooted. A boot scan is when the OS only comes up and then only runs the Virus scan. There's no other program in the way. If your AV program doesn't have a boot sector scan option get Avast, it's free.

Another free product you could try is Spybot Search and Destroy. Once you get the little bugger removed, you could set up Spybot to run Teatimer as resident program. This will stop future changes to you registry and startup without your permission.

Good luck and keep us posted.

Hey Nihil, you're way above my head. I don't know what spyware I've got but someone in Germany stole a domain from me pretty much as I was paying for it. Yahoo says that the only way that can happen is if someone knows what I'm doing, it was an odd name. I've had tons of runtime errors for the past month (R6025) and very slow performance....course it's dial up so that's part of it, but much slower than usual, and wierd popup ads that seem to go along with some of my email content. So, as I said I've tried everything but what you're suggesting, can you get me started? Then I'll try fourdc's advice. Hey, could Yahoo be causing this? This all seemed to start within about a month of installing it......????

One more thing that might be important, when I first tried to dl Spybot and the others two weeks ago, they would completely download, then I would get an error msg that said "not a valid Win32 application". Last night, after I gave up on the MS Protection Scan, I tried to dl the WindowsXP Svc Pack 3, to see if that was the problem. I started at about 10:30 pm and around 4:30 am, got a msg that it failed to download, I didn't see any other msgs so I have no details there....It hasn't been 2 years since I had to re-format this thing for similar problems...I hate, hate, hate to do it again....

Download the apps on another PC.. Get the A Squared as Nihil recommends..
Load thes onto a jumpdrive..(USB Memeory Stick)

START THE PC IN SAFE MODE.. follow the following instructions..

Quote:

---

Windows XP
If Windows XP is the only operating system installed on your computer, booting into Safe Mode with these instructions.

• If the computer is running, shut down Windows, and then turn off the power
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

To use the System Configuration Utility method

• Close all open programs.
• Click Start, Run and type MSCONFIG in the box and click OK
• The System Configuration Utility appears, On the BOOT.INI tab, Check the "/SAFEBOOT" option, and then click OK and Restart your computer when prompted.
• The computer restarts in Safe mode.
• Perform the troubleshooting steps for which you are using Safe Mode.
  When you are finished with troubleshooting in Safe mode, open MSCONFIG again, on the BOOT.INI tab, uncheck "/SAFEBOOT" and click OK to restart your computer

---

Just some apps will not install in safemode.. but it should be enough to see if the Win32 errors still occure when attempting to install those apps..

Thanks so much Und3ertak3r, I'll give it a shot!

Umm.. above all "DISABLE SYSTEM RESTORE".... :)

Try doing an online scan at either safety.microsoft.com or kaspersky.com

see what is that it detects.. give us the name maybe there is a removal tool for it..

or else..

1. download - http://www.trendmicro.com/ftp/products/tsc/sysclean.com (save it in C:\clean folder, create the folder[folder name doesnt matter])

2. download - http://www.trendmicro.com/ftp/produc...ern/lpt357.zip (its' latest one as of this reply, but it should do even if you download it later; save it in C:\clean [same as above folder])

3. Deflate the second file that you downloaded and extract it in the same folder (C:\clean, as of now)

4. Run sysclean.com and let it scan..

DO THE SAME IN SAFE MODE TOO.. See if it helps.

will write a complete spyware removal procedure soon.. :)

Quote:

---

This will stop future changes to you registry and startup without your permission.

---

Better yet, why not just learn how to use your policy editor for that type of thing instead.

TeWrangler - the second file downloaded for 2 1/2 hours then, with 28 secs left, I got an error msg that said that Internet explorer could not download the file because the connection to the server was reset...!!!!!!!
I'm gonna try again.
Would you tell me what deflate and extract mean? Sorry.

Right click a zip or cab archive then click "extract all".

Hey TeWrangler, got both files now - the second is showing as 2 files in one folder named lpt357.zip. Will you tell me what to do next?

Extract both the files in the same folder as sysclean.com file was downloaded (C:\ clean) and then run sysclean.com.. after the application launches just click on scan..

have you turned off system restore ?

if not, right click on my computer > properties > system restore > click to disable system restore on all drives > ok > ok > ok....

The Spec,
"Better yet, why not just learn how to use your policy editor for that type of thing instead."

Of course if Windows wasn't such a POS, it would have put the user first and set the policy by default so that 3rd parties couldn't change settings without your permission. Nothing like a secure OS.

Hi again, can't tell you all how much I appreciate your help.

It took all night and all day, but finally Kaspersky downloaded and scanned.
This is what it found. Is there hope for me?

Scan statistics
Files scanned88044
Threat name6
Infected objects8
Suspicious objects0
Duration of the scan01:24:53

File nameThreat nameThreats count
C:\Documents and Settings\Family\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-678c1b03-602a9a61.zipInfected:
Trojan-Downloader.Java.OpenConnection.aj2

C:\Documents and Settings\Family\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-678c1b03-602a9a61.zipInfected:
Exploit.Java.ByteVerify2

C:\Documents and Settings\Family\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load13.jar-5d21e7a9-173c0ca9.zipInfected:
Trojan-Downloader.Java.OpenStream.c1

C:\Documents and Settings\Family\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load13.jar-5d21e7a9-173c0ca9.zipInfected:
Trojan.Java.ClassLoader.h1

C:\Documents and Settings\Family\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\load13.jar-5d21e7a9-173c0ca9.zipInfected:
Trojan.Java.ClassLoader.d1

D:\I386\Apps\APP31767\src\HPSummer2005.exeInfected:
not-a-virus:AdWare.Win32.MyWay.j1

I would seriously consider formating your drive, and learning how to properly protect your computer from these threats. This would include installing a firewall (I like zonealarm), and a good anti virus (AVG anti-virus), and some spyware protection (ad-aware and spybot). This site has a great community to help you learn how to better protect your computer from these problems.

So it's bad?:confused:

Isn't there anything I can do other than start over?

Quote:

---

Originally Posted by jenniferdoes

Isn't there anything I can do other than start over?

---

Was Kaspersky able to remove the viruses?

Hey, I don't know if Kaspersky can remove it, I know that it was the first program that actually downloaded and scanned successfully -- do you know? Looking at the website now and I'm not seeing guaranteed removal, just protection. The anti-virus is 70 bucks and the total/triple protection is 80, both have a 30 day free trial. But, can it be removed and then, how much jacking around with the current programs do I have to do to use Kaspersky - Norton is still running, ha, ha, great job.

Quote:

---

Of course if Windows wasn't such a POS, it would have put the user first and set the policy by default so that 3rd parties couldn't change settings without your permission. Nothing like a secure OS.

---

The sad thing is, I don't even think you're aware of how extremely silly that comment was.

Well,

Apart from the bit of adware, the infections seem to be restricted to temporary java zipped files.

I am not sure what would launch them?

It also looks like you have a rather old version of java? You really do need to keep your browser and applications up to date as well as your operating system.

Try this:

<Start>
<Settings>
<Control Panel>
<Java>
<Temporary Internet Files>*
<Settings>
<Delete Files>

* Might be called "cache" in your version?

Get CCleaner and run it after each internet session.

http://www.ccleaner.com/

Then re-run your scanners in safe mode.

Nihil, thank you so much for the instruction! I'll do that now and re-run Kaspersky tonight after everyone's in bed. I know I need to do a better job of this - four kids and four parttime jobs....

OK Jennifer, we are slowly getting there.

You should go here and get the latest Java Runtime Environment:

http://www.java.com/en/download/manual.jsp

After you have installed it, just follow the steps that I gave you earlier and on the last screen (where you can delete files) look at the top left corner. There is a little box that says "keep temporary files on my computer"............. make sure that it isn't checked. That will disable the Java cache, so bad stuff can't hide there.

I would suggest that you download the following (free) applications:

1. A-Squared:

http://www.emsisoft.com/en/software/free/

2. Spybot S & D:

http://www.safer-networking.org/en/index.html

3. AdAware

http://lavasoft.com/products/ad_aware_free.php

4. SpywareBlaster

http://www.javacoolsoftware.com/spywareblaster.html

Download, update, reboot and run them in safe mode, apart from #4, which is not a scanner, just install it and update.

In Spybot S & D take the "immunize" option as that will activate the interactive protection.

Hey Nihil! Slowly would be the operative word here. Every minute I spend on this, someone is not getting their nose wiped....

I found the Java cache and cleared it (boy is Java odd), I did have the latest version according to Java's verify tool, but I had to go around my elbow to get to my rear to find the control panel -- AND, it's not listed on my programs at all. Anyway, after I cleared the cache and ran Kaspersky again, all the same threats were still there, no difference.

I'm gonna work on your instructions today and I'll let you know as soon as I've made some progress.

You're a great help! Thank you so very much!!

Hi Jennifer,

"The joys of parenthood eh?" :lildevil:

Sorry about the Java, I should have thought. When you get into control panel go to the left hand taskbar and select "classic view" then it will display as an icon, just click there again to switch it back when you are done.

Please take a look and see if the cache has stayed cleared. Also make sure that the keeping temporary files box is unchecked. If they have returned then delete them again.

I am not too sure of how the demo version of Kaspersky works. Was that a new report or a cumulative one, and did it show the malware as being in the same location?

The first tool I suggest you run is CCleaner. That will clear a lot of temporary garbage. Then run the Registry Scan option and let it kill orphan entries. That is a pile of blue cube icons in the left hand toolbar. Run the other tools as suggested and see what they find; please make a note of the names as this may help later ;)

Please let us know how you get on.

Good Luck!

Looks like I'm cleaned up now!! Kaspersky was the winner, the only one that found it and cleaned it, although the files that were infected had to be deleted. HOWEVER - the newest version that is available for trial makes the OS painfully (take a pill and wait) slow. I had to download the previous version (7.0.0.125) as per Kaspersky's advice, and then delete the newer one. Their support site says that their people on working on that problem with the new one...) Now I'm running just at normal slow speed. :)

Do I need to start a new thread? - I need help with getting Norton off and replacing it with Kaspersky - if that's the right thing to do. Problem is, Norton doesn't show anywhere in my system except in the firewall - it says that it is up to date and running and I can't figure out how to make any changes to the virus protection.

Download this:

http://service1.symantec.com/Support...05033108162039

Do not run it yet

Which Kaspersky product do you have, the Internet Security suite or just the antivirus?

If it is the AV then you will need to get a firewall as well.

Try the free version of ZoneAlarm:

http://www.download.com/ZoneAlarm-Fi...-10039884.html

Download but don't install it.

Disconnect from the internet
Uninstall Norton
Install firewall (if needed)

Hey nihil!

Okay - I have the Kaspersky AV, not the full suite. So, I need a different product for my firewall. When I say firewall, I mean Security Center. There are three things listed when I go into start/control panel/security center. Firewall, Automatic Updates, and Anti-virus Protection. All three show "on". The Firewall says that "at least one of the firewalls installed is protecting your computer" and warns that more than one can present a conflict. The Anti-virus Protection says the same thing. I need some help to fix both. As of last night, Norton still showed running as anti-virus, so I guess Kaspersky continues to make changes after installation.

I'm downloading the files you suggested now, I'll run the Norton removal and let you know what the Security Center shows afterwards.
By the way, thank you so much. I hope I'm still making sense, or at least starting to...

I just noticed that ZoneAlarm is for DSL or cable-connected internet, I have dial-up (yes, it still exists for those of us who live in the deep dark woods), will that matter?

Jenniferdoes,

It will protect you on a dialup. You can shut it down when you're not online.

The marketing on firewalls to aDSL and cablemodem customers is that if your computer is running, you are online, even if only your desktop is running.

Deep dark woods? sounds like Vermont. I have aDSL, half a mile away from me they have dialup. We are answering the call however, check out http://www.ecfiber.net

Hello Jennifer,

Yes it does say that it is for DSL and cable. But I think that really means "especially recommended for DSL and cable" The point being that people with those sorts of connections tend to leave them on 24/7, so are permanently at risk with the same IP address. They really need a firewall.

Because dial up uses your voice line, people only tend to use it when they need, and switch off afterwards. That means that they are only exposed sporadically, and get a new IP address each time (typically).

When I look at the requirements part of their website it only specifies "internet connection".

This is what I would expect, as it is a software firewall and is really only interested in traffic, rather than the transportation means. After all your Norton Firewall works just fine, as does your Windows XP one?

Incidentally, you should only have one software firewall running at once. Same with interactive AV. Any more and you risk a serious performance degradation, particularly with Norton.

Quote:

---

(yes, it still exists for those of us who live in the deep dark woods)

---

I too have dial-up and a 56.6 in most of my machines (I also have a couple of external ones). My ADSL will only work from my home along my static landline.

My experience (living in what is very much a rural, agricultural area) is that it is reliable in remote locations where there is none of that wireless crap, cable or whatever. Sure, I could get mobile ADSL, but that is not cost justifiable for me.

Anyways, I have quite a few (older) customers who only need dial up, the time and way in which they use the internet, so I need a few "reference machines" :)

EDIT:

Y'all see that! a guy goes out for a six-pack and ddddc jumps in and hijacks him :D

Thanks ddddc, I understand.

When I download ZoneAlarm, then won't I need to disable the Windows firewall that is running now? Also, do you know if it will slow down my OS anymore? I'm noticing now, even with the quicker version of Kaspersky, my system is quite a bit slower than usual -- I almost wonder if I'm going backwards sometimes:D

Hey nihil!

Thanks for the information.

If we moved 5 miles down the road, there are all kinds of options but here, no cable, no dsl, satellite is 400 bucks to install and 60 a month - definitely not doable with 4 kids to feed and gas prices eating us all alive.

So, after I ran the Norton removal (thank you!), my Security Center shows Windows Firewall, and Kaspersky Antivirus.

Now I need to download ZoneAlarm, disconnect, disable Windows Firewall (please tell me how), then run ZoneAlarm?

OK Jennifer, let's go through the sequence of events?

1. Activate Windows Firewall & get ZoneAlarm

2. Disconnect from the internet.

3. Install Zone Alarm.

4. Reboot.

5. Connect to internet and look for Kaspersky updates, before this, I expect you will get a load of stuff from Zone Alarm, just say no thanks or next, and continue with the free product installation. In the settings bit, the first option should be moved up to "high" (it is a slider thingy) and you turn off the alerting (it will drive you mad otherwise, and will still warn you about anything important).

6. Reboot

ZoneAlarm might ask you about the Windows firewall. Allow it to disable it if it asks, otherwise will will check later.

Then run CCleaner to get rid of the debris :D

Nihil,

You're lucky you're on the other side of the pond or I'd have the six pack too, anything good? Newcastle maybe?

No, although I do drink it. Old Peculier was on offer, so I went for it :drink:

http://www.theakstons.co.uk/ales/view_detail.php?id=9

Morlands "Old Speckled Hen" is worth a visit too ;)

http://www.oldspeckledhen.co.uk/

There are many others....................:shocked::chuck:

Wow that's a first, getting carded to get on a non pr0n website!

The next time I'm in a more metropolitan area I'll try to find them, we've got some good microbrews in the area but the imports don't seem to find their way in.

I know the problem seems to be solved but I'd like to put in my two cents.

If you have a slow system I would recommend Sunbelt Personal Firewall as it is not as bloated as Zonealarm.
http://www.sunbelt-software.com/Home...onal-Firewall/

If you have limited RAM, you can install FreeRAM XP Pro (http://www.yourwaresolutions.com/software.html). It will help to keep the memory from retaining unused data and let you monitor memory usage.

Also, if the work you do really is with sensitive data, you really should think about backing up your data and reinstalling. I've cleaned out many machines where I had to run several antivirus and antispyware as well as rootkit detection to get everything out (at least I got everything I could find). So there is always a chance things could still be hiding.

As far as prevention, aside from the standard warnings of not opening attachments in email and using text only email as well as safe browsing habits, there are a few things to help keep you safe.

Use CCleaner to get rid of temp files as malware likes to hide there.
http://www.ccleaner.com/download

Keep your software updated. Especially Java, Quicktime, and Adobe Reader (I use Foxit http://www.foxitsoftware.com/pdf/rd_intro.php), since these are often neglected and always end up having exploits.

As far as antivirus, I really like Kesperskey. If you explore the settings you can set the detection to be more aggressive in finding malware. If that is too bloated for your system NOD32 (http://www.eset.com/) is a good replacement. I personally like eEye's Blink (http://www.eeye.com/html/products/blink/index.html). It is a bit of a heavy program (at least older versions) but protects against many "zero day" exploits in windows and has a nice vulnerability assessment feature that scans your system and programs and tells you what exploits they may contain and where to get patches and upgrades for them.

I would also recommend having a limited user account for daily use and installing Sudo for Windows (http://sourceforge.net/projects/sudowin/) so you can have administrative access without having to log into a different profile.

That's about all I have to offer without going overboard. Hope this is useful.

Note to Nihil: I hadn't heard of A-Squared. Looking forward to adding it to my arsenal and giving it a try.