[SeptemberMorn]

Did you know that program installs Adware to your computer and could possibly mess up your Internet Explorer?

I've had lots of problems since I installed my smilies. It has even changed the front page to my explorer and things keep getting downloaded that I don't want or haven't asked for. It has slowed down my new computer considerably!

My Spy-Bot doesn't catch the adware. I use McAfee and that catches it every time.

Just thought I'd give ya'll a heads up.




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[gloria]

WOW! thanks for the info.

gab

[PlanningtoLive]

Tomi, do you know the name of the adware? Is it that stupid Gator?

I don't have have anything to catch spyware....hmmmm, maybe I should.

Courage is fear that has said its prayers.
Dorothy Bernard

[dexter]

I use "Spybot Search and Destroy" which is also free. I am now using Firefox browser instead of IE which helps in that regard.

I never used the smilies because they asked for my name and email before you can access them. I think at times I am overly cautious, and I never heard of any problems with the smilies before and I know everyone uses them. If this is an issue though I am glad you mentioned it.

I just fixes a computer for someone with the worst case of popup installations I had ever seen... as soon as he turned the computer on before even doing anything browser windows would pop up. As another tip... if ever you get a browser window asking if you want to join or get an offer or anything, and there is a "yes" button and a
"no" button... don't press either button. Close the window with the "X" in the top corner. In many cases clicking "no" has the same effect as clicking "yes"

That is even more true with email spam... it always says at the bottom "click here if you do not want to receive any more emails from us" or something. NEVER CLICK THAT! In most cases it does NOT take you off their list, but rather confirms in their database that your email address is "real" and active. People who sell the email address lists make more money with lists that have "confirmed" email addresses.

Welcome to the 21st century . Don't forget that for all the annoying stuff there is also a lot of good stuff available to us now as well.

------------------------------------
--http://www.idexter.com

[SeptemberMorn]

I have Spy-Bot but it either doesn't catch the adware or it's not working properly.

I've been trying to delete IE from the program list but that's not working, either. IE confirms that if your IE opening page has changed recently then you've been "infected" (not a virus) and need to clean your computer. However, I'm afraid to start deleting files because I'm not sure which are needed and which aren't.

I'm afraid I'm guilty on occasion of clicking the "no" box! ARGH!! What's really annoying me now is that IE keeps opening up with some ad of some kind.

What would you suggest??

OH! I forgot to mention... I have McAfee delete the adware but the very next time I use a smilie from SC, the adware is back. Deleting the adware files does NOT eliminate the problem!





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>
<div class="foot">(Edited by SeptemberMorn on 08/20/04 12:43 PM.)</div>

[dexter]

Adware is sooo annoying. You are right about deleting the adware files... the "installation" of the adware puts a bunch of files all over the place and they reload the whole thing as soon as you connect to the internet. The computer I cleaned recently was so incredibly frustrating... I went through all of their files and everything loading at startup and I STILL couldn't prevent the popups. What finally worked was deleting as much as I could manually, then I ran Ad-aware AND Spybot one after the other... let each reboot and finish the file cleanup.

I just realized that I have been misreading your messaged... you mention adware and my eyes have been seeing ad-aware... which is another piece of software that blocks adware.

So that would be my first recommendation if you haven't tried it already. You can get Ad-Aware at
-- The world is what we make of it --
-- Dave
-- <A target="_blank" HREF=http://www.idexter.com>http://www.idexter.com</A>

Webroot's SpySweeper picks up tons of stuff that AdAware and SpyBot miss.

It is free download and easy to use. <A target="_blank" HREF=http://www.spysweeper.com/download.html>http://www.spysweeper.com/download.html</A>

I'm no genius when it comes to explaining these programs but I know that the security of my computer is more important than smilies and free music so keep your antivirus up to date and do sweeps with free programs often.

Thanks Dexter for good info. I thought I was covered with EZTrust antivi. and AdAware and SpyBot. Nope! SpySweeper finds so many other little things.

I know you have a lot going on personally right now so once those things settle maybe you can explain over in the tech forum more about adware and bots and such............possible? No rush at all.

Take care and I'm saying a prayer for smooth sailing for the next few days for you.

<font color=purple> --zh </font color=purple>

[SeptemberMorn]

ARGH! Your link didn't work. Said page couldn't be found but it gave me a search page. First, I downloaded "SpyKiller" and it found 77 spy files, but to clean them, I had to buy the software. Then I downloaded "NoAdware" and it only found 33 files and I had to buy that, too! Both are the same price, and I'm sorely tempted to buy SpyKiller... unless you have a working link...





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[SeptemberMorn]

Well, now! We're back in business and so am I. Your link to Lavasoft worked just about the time the site went down yesterday so I downloaded NoAdware and SpyDoctor... but that wasn't before SpyKill(er?) messed with some of my files. It wanted me to "close" Microsoft Money and I had never installed it... so I supposedly "removed" it and made SpyKiller happy. The computer kept wanting to reinstall Money so what I did was delete SpyKiller. Well... it deleted some .dll! That now keeps popping up! LOL That's okay. I'm just gonna run a "rescue" operation after bit.

If I was impressed with the number of infected files that SpyKiller found, I was amazed with Spyware Doctor!!! It found AND cleaned 200+ files where the adware had attached itself! YIKES!!! No wonder I kept getting all kinds of popups!! Even with IE popup swatter! The biggest culprit was "My Search Bar" on IE! Somehow I don't think that's a legitimate MS product! I had gotten to the point of being afraid to download the so called upgrades form MS. I'm pretty sure there was a spyware program attached to one of those downloads. I couldn't even stop it from downloading! It had icons with it and all! gggrrrrrrrr It reinstalled itself three times!

Anyway... hope everything is taken care of now... SHEEESH!





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[dexter]

I think the Google searchbar, which is very popular, installs spyware. Almost anything that they offer you for "free" has strings attached, they are giving you the software in exchange for being able to track your info.

Not all the adware is malicious (I guess depending on how you look at it). Stuff like the Google bar never causes any problems on my machine... I was using it for quite a while but then decided to be more conservative with my machine so got rid of it.

Some of course are monsters that really effect the use of your machine... slowing it down and putting up popups everywhere... and of course some can be downright viruses designed to mess up your machine.

The biggest problem with ALL of them is the issue of privacy. The most basic purpose of spyware is to track what kind of sites you visit and what kind of purchases you make. So when you get ads they are more likely to be something you are interested in. That's how the ads at the bottom of these pages work (note that they are provided by Google) now these aren't "spyware" because they don't search your machine or your habits, they just try to make recommendations based on things mentioned on that page. But the spyware on your computer can be intended for the same purpose.

For a lot of people it really bugs them that there is an invasion of privacy issue there. It's nobody's business what they are buying. It doesn't bother me personally, so I leave my cookies active on Amazon.com for instance because I like the suggestions it makes for me. But although it doesn't bother me, I really have to agree that if it does bother you, you should be able to avoid it. Worst for me is that most people have no idea that this is even happening. If someone is tracking your purchases, you should know about it, and not in the fine print of the website. (Amazon does say that it makes recommendations based on purchases you have made in the past... that is clear on every page where they recommend something, so I think that is the upfront way to do it).

A lot of people don't realize that supermarkets do that too. If you have any sort of discount card for your supermarket, they didn't give that to you out of the goodness of their heart ya know . They keep track of your purchases... for the most part I don't think they are interested in what individuals are buying but more to study trends in groups of buyers... maybe people in a certain zip code purchase a lot of baby products so the stores in that area might want to carry more merchandise for parents. They also in a lot of stores give you coupons that print out right at the checkout... a lot of times it is obvious that it is related to something you just purchased, but sometimes they are coupons based on trends of things that you have purchased in the past.

You can look at this really as a way for the store to serve you better, or you can look at it as an invasion of privacy. As I said, I don't mind it, but I am cautious and try to be aware. (I also get very little spam in my email without the help of a spam blocker... I do sign up for stuff on websites but I am very conservative about that).

Also personally, I don't tend to believe there is any big conspiracy to collect all our data. But it can be scary to think of the possibilities.

This is not completely new.... manufacturer's have people fill out warrantee cards forever as far back as I can remember. The point of these is to collect data (they have to honor the warrantee on your product whether you send in the card or not). Some people may remember a HUGE stink about Windows 95 or 98 because during the registration process it scanned the specs of your system and sent it back to Microsoft. I think they really wanted to be able to track the kinds of machines the software was being used on but when people found out they freaked out. I think, once again, the biggest problem was that it was doing so without people knowing about it. MS still does that but they make it very clear during the process that they want to send information, they offer you a check box in case you don't want to send your data, and it is set not to send the data by default. That pretty much pleased everyone. I don't worry too much about MS software anymore because I think they learned their lesson and are always going to make it clear now when something might be a matter of privacy.

Sept like I started this with... although not all adware is necessarily malicious, I don't think there's any harm in being very conservative, so I think it was a good idea to just scan and wipe everything clean. There certainly isn't any need for any of it, if any of it was serving any useful purpose to you, you can always put that back in at a later date if you decide you want to.

------------------------------------
--http://www.idexter.com

[SeptemberMorn]

Well, nothing I've done so far has reinstalled two .dll files that are missing. DANG! I reinstalled Money from the CD and also reinstalled MS Plus! and nothing. At least now the computer doesn't interupt me constantly trying to reinstall Money. I've deleted SpyKiller but it seems to have left something behind, anyway. gggrrrrrr Maybe it had it's own spyware?? @#$% &%*#$@ #$%&&*@@@




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[dexter]

Sept, found this:

<blockquote><font size=1>In reply to:</font><hr>

Question:

I have tried the free scan but am not interested in purchasing. I have uninstalled SpyKiller, but I still keep getting the purchase pop-ups. How do I get rid of them?

Answer:

The reason the pop-up ads still keep showing is because the software did not completely uninstall. In most cases, SpyKiller was still running during the installation. To completely uninstall SpyKiller please do as follows:

Step 1: re-install SpyKiller by downloading the trial version at http://www.spykiller.com/downloadmain.asp

Step 2: hold down Ctrl, Alt, and Delete keys to open Windows Task Manager ---> end task for SpyKiller if you see it running in here.

If you do not shutdown SK before you uninstall it will not fully uninstall!

Step 3: click Start ---> click Programs ---> locate SpyKiller folder ---> click Uninstall SpyKiller.

This should fully remove SpyKiller. Please let us know if you have further questions.

<hr></blockquote>

I don't know that much about SpyKiller but it looks to be reputable software so I doubt if it installs its own spyware.

------------------------------------
--http://www.idexter.com

[SeptemberMorn]

I'm pretty sure that I was wrong in thinking that SpyKill wasn't completely deleted. I can't find the folder anywhere and I'm sure I had every other program turned off except my control panel when I deleted it. I used the "remove program" option.

Whenever I get the "x" box, it says "Error downloading 'winupd.dll' or "Error downloading 'wincore.dll." When I was removing SpyKill, it gave me a warning that some other programs may be affected be removing some files. Yep! I didn't believe it, though. Anyway, when I click ok on there warning boxes, what happens is I get a box on my task bar at the bottom of my screen saying "RUNDLL." I'm not sure, but doesn't that kind of file go with game files? I know that I lost two of my Plus! games by deleting the SpyKill. However, installing them didn't stop the error from happening again.

Let me see if I can find that help page you posted. I'm overstressed by personal problems today so I don't know if I can get this pea brain to work.

"If it ain't one thing, it's another!"




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[SeptemberMorn]

Sweety, I don't have Gator... or at least I don't think so! Dex is right. You get this adware also by downloading music from the internet. Now I can't access MusicNet@AOL to find music. I can play what I've put on my playlist and downloaded, but that's it. I had also tried iPod. gggrrrrr Bad idea!

Right now I'm using SpyDoctor that I found on Lava. At the time, I couldn't access the program Dave told me to get (Ad-aware?). It seems to be working really good. When I go to other sites, it tells me of the cookies it stopped... which are also culprits. I was afraid it would delete the cookie for this site and I would have to log on every time. It didn't do it! Seems to know what cookies to stop.

Be careful deleting infected files!!





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[dexter]

Check the processes and applications in the box after using "ctrl-alt-delete" like in the instructions above and see if you can find spykill in the list. When you install it, it runs all the time (so that it can protect your system), but the part that is always running is "in the background" meaning it doesn't have a button on the taskbar... that only shows when you have spykill open to make changes or run a manual scan.

IOW when you close that spykill application window, a part of spykill is still running and runs everytime you start Windows. The only way to stop that is with the ctrl-alt-del like in the instructions above. The part that runs this way may be in the Windows system folder and not in the spykill folder, so an empty or missing folder doesn't necessarily mean it is completely gone.

I'm heading to the lawyer now... hope your stressful stuff works out... later we can talk about dlls

------------------------------------
--http://www.idexter.com

[dexter]

septmorn

I just did a quick check in the net... those two dlls you mention are SPYWARE DLLs so you do not want them back. What has happened it that the spyware is removed, but the instruction when Windows is starting that says "run this software" hasn't been removed. So Windows is still trying to start the spyware, but the files for the spyware are gone, so you get the error messages.

If you do a search on those on google you'll find a lot of info but a lot that suggests more software to download to remove them (not free software, I think) I was able to get rid of those things without the extra software.

More about this later or tomorrow... just didn't want you to spend time trying to "restore" files that you really want GONE... Basically you have to fix the error messages, not reinstall those files.

It may be your current spy software that is preventing the download and causing the error messages... if you shut that off the spyware may just reinstall itself the next time you run... so for now DON'T stop your anti-spy software!

------------------------------------
--http://www.idexter.com

[SeptemberMorn]

Well, I found a help page, too, but I don't think it's the same one you found. I asked the question directly and I'm supposed to get an answer back in my email?

DAMN! I wish I could go hide under my blankie... but I can't do that today.

BTW, I deleted SpyBot. It wasn't doing a thing!!





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[dexter]

See what they say... they may have a simple answer.

Were you finally able to get to lavasoft and install ad-aware? (I think I missed whether you were successful with that or not over the course of this thread).

In the meantime is the machine working for you or still giving you lots of problems? Can you tell me what it is doing? I know you are getting the error messages, are those just when you start the computer or do they keep popping up?

I wish I was near you... I could probably come over and fix this all up. It is fixable, I guess just see what kind of reply you get from the help site. If it doesn't help, post back here...

------------------------------------
--http://www.idexter.com

[SeptemberMorn]

Nope, didn't download Ad-Aware. Still working with SpyDoctor. I figured out how to copy what they have to say about the spyware. Check this out! Didn't I say I deleted Microsoft Money yesterday and then reinstalled it??? Never have seen the "silly little dog" but I WAS getting the bubble crap, especially when I logged onto my checking account. It was for low cost mortgage. LOL I don't even own property, but it made sense to me because it only appeared on a bank's page. Now that I think about it!!!!... I've been getting a lot of Phone Calls about refinancing my real estate! What a laugh!!!

<blockquote><font size=1>In reply to:</font><hr>

C:\PROGRAM FILES\Nova Development\Photo Explosion Deluxe\Bar.dll

Displays ads, and a silly dog on your browser. NewtonKnows comprises a IE search-hijacker and toolbar, and a targeting pop-up system that works across many browsers. Speech-bubble-style site links pop up in the bottom-right corner of the browser window whilst browsing. When a targeted site is visited, NewtonKnows sends a request back to its controlling servers include the hostname of the site being viewed, and a unique ID. This can be used to track your usage of different web sites. If you entered an e-mail address at the time of install, such a browsing record is personally identifying. The privacy policy explicitly allows NewtonKnows's makers to combine personally identifying web usage records with other databases (which might include, for example, addresses and telephone numbers), and to use this database for marketing. NewtonKnows also has a silent self-updating feature which allows its controlling server to execute arbitrary unsigned code.

The other two are in Microsoft Money but all the description box says is Microsoft Money.

<hr></blockquote>

AAAHHHH! Get me outta here!! I want my shower but this danged little bulldog won't let go!






<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[SeptemberMorn]

Ok... somewhere, I think you asked me when I get those error messages. I get them from the time I start the computer and every program I try to use. If the computer is idle, like it was when I was taking a shower, it seems every five minutes that particular program wants to start itself. When I came back to the computer, I had, get this, 35 error messages and got more when I started AOL! What you said makes sense!

I ran a virus scan with McAfee and it found FOUR more spyware files, all from Advirtim...? I quaranteened them because McAfee doesn't give you the option of checking too see exactly where and what they are. This is what I found:

In Docs and Settings: System Volume Info
2 in Windows\System32\winhost. The names?

AOO36068.exe
AOO37016.exe ... and
two - Winhost32.exe

I'm not going to do anything until you're free to advise me. I'm thinking, though, that these four exe's should be deleted?





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[SeptemberMorn]

Hey, Dave... I know you're pretty busy right now with your own things, but if you get a chance, could you help me out with this adware problem?

I've pretty much decided I have to do the same thing with IE's "My Web Search" as I did with SpyKiller and that's to download it again and delete it like I did SpyKiller according to their directions.

One adware that is really causing me problems is the one found here: Nova Development\Photo Explosion Deluxe\Bar.dll I don't even use Photo Explosion so what the heck is going on? Did the software come with it? NOW... IE is popping back up on my screen. I don't know if I can delete it because I think AOL uses IE.

I'm afraid to delete IE for fear it may screw up AOL. Should I change servers? I really don't want to. Don't ask me why. AOL is all I've ever used and I guess I'm used to it.

Anyway, when you have a spare moment...




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

[dexter]

I'm sorry, I missed this when you posted it (on some days I've only been skimming through the forums)

I'm poking around a little right now and I'll tell you what I find...

------------------------------------
--http://www.idexter.com

[dexter]

Some things to try...

In "add/remove programs" is there a program listed called "Newton Knows"? That is adware that uses a file called "Bar.dll" and does the symptoms you are describing. And the company that makes it is named "Virtumundo" which matches part what McAffee found.

If you have that listed, remove it. If you are lucky that may just solve your problem, but there may be other steps you have to take. Have you ever edited your registry? That might be best left for someone else to do, you can screw up your machine so that it won't boot if you make a mistake.

Try the "add/remove" for Newton Knows, reboot, and see if there is any change. If you don't have Newton Knows let me know and I'll dig a little more...

I am going to see if I can find anything about Photo Explosion now...

------------------------------------
--http://www.idexter.com

[dexter]

There's way too much info on the web about this stuff. Most of it involves really heavy registry editing that would probably not be a good idea. A lot of the pages just recommend purchased software to take care of it... but there is so much of that as well, and the spyware updates itself subtly in so many ways, that there's no guarantee that it will remove it.

Something else you can do that I can look through...

Click your start button and find the icon that says "Run..." and start that. A small box will come up. Type "msconfig" (without the quotes) into that box and click "OK". That brings up a really handy tool for stopping things that load when you start windows.

Click on the "Startup" tab on the far right. If you can, give me a list of the items there. I just need the "Startup Item" column and the "Command" column (you'll probably have to make the "Command" column bigger to see the whole lines).

If the list is too long you probably won't be able to get it all for me (you can't copy/paste from there.) If that's the case just scroll down the list and see how much stuff you recognize and what you don't. There will be a lot of stuff you don't know what it is but that's OK and normal. You should though, for example, see something somewhere on the list for "McAffee" since that should be loading at start to keep you protected...

A lot of the names in the "item" column may look unfamiliar, but if you look at the "command" column you'll see that they start, for example, from your program files/mcaffee folder. So there may be several entries starting from the same folder, that's OK.

See if anything just doesn't seem right and let me know those entries that might be suspicious.

------------------------------------
--http://www.idexter.com

[heatherm]

Just another thought here too......

try going to http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button click on download now and follow the directions to install. I think I gave this to you before Tomi? when you had your old computer? This is what I use to scan my system every couple of days to clean it up as well.

Hopefully this may help some too


Heather