Yet another spyware problem

[BlueDaisy]

We have tried everything we can think of to get rid of a program that keeps popping porn up. We've run Ad-Aware, cleaned out temp files and cookies. Put the link in the IE "Restricted Sites". What are we missing?

The thing that keeps happening is, when we change profiles (we have WinXP Home), turn on the computer, or reboot, our IE "homepage" switches itself to http://teen-biz.com/. It is an adult search engine (the top of the window reads "Promo material generated for account [and gives a number])". DON'T CLICK ON THAT LINK. I TRIED TO UN-PARSE (OR WHATEVER YOU CALL IT). HOPE IT WORKED!

Even when we don't have an IE window open, porn websites suddenly pop up. And when we are using IE actively, the page we're using will switch to a porn website. Happened when my 10 year old son was playing an online game the other day.

So...what else do we need to do to get rid of this damn thing?

Thanks....

 

[BlueDaisy]

Ok....I'm desperate for help. Gonna bump my own thread. I know it hasn't been that long since I posted it, but I don't want it getting lost.

 

[offacue]

Make sure you have the latest updates for Ad-Aware. Also get spybot and run that. I use them both and sometimes one finds something that the other one didn't.

 

[BlueDaisy]

Make sure you have the latest updates for Ad-Aware. Also get spybot and run that. I use them both and sometimes one finds something that the other one didn't.

OK....I'll try spybot, too. I've seen it mentioned; guess I should have already tried that, too.

 

[norcalman662003]

Let me know if that helps ...

If not shoot me an email - I'll see what I can do to help.

Sometimes these progams get installed on your "C" drive and have an Autorun feature.

I got something from ESPN that installed the other day - I will have to check and see where I removed it from.

 

[BlueDaisy]

Re: Let me know if that helps ...

If not shoot me an email - I'll see what I can do to help.

Sometimes these progams get installed on your "C" drive and have an Autorun feature.

I got something from ESPN that installed the other day - I will have to check and see where I removed it from.

Ok. I'm running Spybot right now. Thanks

 

[BlueDaisy]

When something shows in Spybot as being in the Registry, is it safe to remove that? I'm afraid to mess with anything that says "Registry". These are showing up as "Registry Key" and "Registry Value". I ought to wait until hubby gets home to do any of that.

 

[norcalman662003]

Sent you some suggestions by email

let me know

 

[Weird Harold]

When something shows in Spybot as being in the Registry, is it safe to remove that? I'm afraid to mess with anything that says "Registry". These are showing up as "Registry Key" and "Registry Value". I ought to wait until hubby gets home to do any of that.

Your problem with the hijacking of your homepage setting is probably in the registry, so you'll have to "mess with the registry" to fix it.

Spybot gives an explanation of each thing it finds -- right click the entry you're curious about. It also gives a "risk level" assessment.

Spybot does do only what you tell it to do in removing registry entries, but it's a little ontheparanoid side about "tracks" like "most recently used files" histories and the like -- I don't remove those kinds of hits.

 

[txmike]

I recently had the same problem and i know how much it sucks. Your homepage has been hijacked. Go to this site: http://www.spywareinfo.com/~merijn/
Download "coolwebshredder" and run it. Check to see if the problem is fixed. If it is then reboot your computer and see if the prob is still fixed because sometimes the program will still be on your comp and hijack your homepage again at restart. If the prob isnt fixed then download "hijackthis" and run it. Then post the info it gives you in the forums there. These programs are both free and the people there fix these sort of problems all the time. They were a big help to me.
Good Luck

 

[BlueDaisy]

Thanks for your input, folks.

I tried the links, txmike, and neither of them did the trick.

I finally did a "system restore", and so far so good. I hope it stays that way. Unfortunately, I don't know how that hijack came about, so I don't know how to prevent it from happening again.

Thanks again for taking the time to assist.

 

[ReadyOne]

Thanks for your input, folks.

I tried the links, txmike, and neither of them did the trick.

I finally did a "system restore", and so far so good. I hope it stays that way. Unfortunately, I don't know how that hijack came about, so I don't know how to prevent it from happening again.

Thanks again for taking the time to assist.

Since you have spybot, go to the immunize option and do both installs. Note the second one that may be off the screen at the bottom.

It will also point you to SpywareBlaster which will immunize against a greatly overlapping but slightly different set of hijackers.

 

[BlueDaisy]

Since you have spybot, go to the immunize option and do both installs. Note the second one that may be off the screen at the bottom.

It will also point you to SpywareBlaster which will immunize against a greatly overlapping but slightly different set of hijackers.

OK, I'll check into it. Thanks

 

[Nonchalant]

LOL you did a system restore just to get rid of spyware? thats really excessive.

 

[BlueDaisy]

LOL you did a system restore just to get rid of spyware? thats really excessive.

I was desperate. Couldn't do anything online without porn popping up suddenly. If it was just my hubby and me to worry about, it wouldn't have bothered me as much, but there are the kids to consider, especially our 10 year old son.

One day he was playing a game online and he said, "Mom...something came up that showed a guy peeing in a girls mouth...and she LIKED it! Cool!" After that, I realized that I had to take desperate measures to get rid of it.

 

[thejokker]

use the immunization from spybot, it disables some common ways those things get inside your comp.

use an anti-virus ALL WAYS, its needed

run ad-aware or similar proggram often

also if you are on a WIN XP comp, create non-admin users and use that for web browsing. if you are on as an admin user you will open you computer to lots of possible problems.

a non-admin cannot install programies like that so it just wont happen to you

 

[idoyoganaked]

hijackthis definitely helped me out. It found things ad-aware and spybot didn't. Also, check your startup folder bc once you get rid of everything, it could come back when you restart because the program is sitting in there.

 

[BlueDaisy]

use the immunization from spybot, it disables some common ways those things get inside your comp.

use an anti-virus ALL WAYS, its needed

run ad-aware or similar proggram often

also if you are on a WIN XP comp, create non-admin users and use that for web browsing. if you are on as an admin user you will open you computer to lots of possible problems.

a non-admin cannot install programies like that so it just wont happen to you

I hadn't thought about using a separate non-admin profile. I'll have to think about that. Thanks for the idea.

Welcome to Lit, by the way!

 

[BlueDaisy]

hijackthis definitely helped me out. It found things ad-aware and spybot didn't. Also, check your startup folder bc once you get rid of everything, it could come back when you restart because the program is sitting in there.

Good suggestion! Thanks.

 

[VSE]

also if you are on a WIN XP comp, create non-admin users and use that for web browsing. if you are on as an admin user you will open you computer to lots of possible problems.

If you dont know (and dont care) how windows works, this is one of the single best pieces of advice I can think of.

There is also a lot to be said for creating separate accounts for yourself/hubby and your kids, especially if you like browsing adult sites and/or want to save "risque" material to hard disk without too much danger of young prying eyes getting at it.

 

[BlueDaisy]

If you dont know (and dont care) how windows works, this is one of the single best pieces of advice I can think of.

There is also a lot to be said for creating separate accounts for yourself/hubby and your kids, especially if you like browsing adult sites and/or want to save "risque" material to hard disk without too much danger of young prying eyes getting at it.

We have profiles set up for each child, and one admin profile each for hubby and me. So what I'm hearing from this is: make a separate non-admin profile for myself and hubby for everyday browsing and playing on the computer, and leave the admin profiles we have for doing admin type stuff. Am I interpreting this correctly?

Thanks....

 

[Bobmi357]

This is one of the reasons why I hate Internet Explorer so much. If you MUST use this program, go into the internet options, select security, go to the advanced section and set everything that mentions downloads to either "prompt" or "disable".

Or get yourself a more secure browser, opera, or netscape. Both do the same thing as Internet Explorer (and in some things they even do it better). And you won't have as many problems.

Also I highly recommend switching out of Outlook Express for the same reasons. For some reason microsoft seems incapable of building an email program that isn't full of holes. I recommend pegasus, its free, does most of what the other email programs do, and its not nearly as prone to transmit a virus as outlook express is.

http://www.pmail.com

 

[BlueDaisy]

This is one of the reasons why I hate Internet Explorer so much. If you MUST use this program, go into the internet options, select security, go to the advanced section and set everything that mentions downloads to either "prompt" or "disable".

Or get yourself a more secure browser, opera, or netscape. Both do the same thing as Internet Explorer (and in some things they even do it better). And you won't have as many problems.

Also I highly recommend switching out of Outlook Express for the same reasons. For some reason microsoft seems incapable of building an email program that isn't full of holes. I recommend pegasus, its free, does most of what the other email programs do, and its not nearly as prone to transmit a virus as outlook express is.

http://www.pmail.com

I've thought about doing all of the above, but hubby makes the final decisions on the 'puter, so....we're still with IE and the "regular mail". We've tried other mail programs (including Pegasus) but he didn't like them. *shrug*

Thanks for the input.

 

[VSE]

So what I'm hearing from this is: make a separate non-admin profile for myself and hubby for everyday browsing and playing on the computer, and leave the admin profiles we have for doing admin type stuff.

Absolutely, its still far from perfect on windows but it will help limit the potential damage.

With regards to IE, Bobmi is spot on, set it to at least prompt before it installs anything and as a rule of thumb, if you dont know what it does, click no.

If you are still getting nuisance popups, you could do a lot worse than install a simple firewall program like zonealarm. It can be a fairly annoying program in its latest incarnation, but the one thing it is great at is showing up just what is running on your computer that is trying to access the internet. SO when it pops up and asks you if youwant to let somethingorother.exe access the internet and you dont know what it does, run a google search on it and find out. Again it is by no means fool proof but it will go a long way to helping you learn what to watch out for, the vast majority of viruses, spyware and so on rely on crappy windows security and the, to be blunt, ignorance of the average windows user. (edit: Not having a dig with that last comment, its certainly not aimed at you)