Adware Troubles

Radii · 09-18-2004, 10:15 AM

Oliegirl and I have Windows XP running, we each have our own user id on the system. There is no administrator login that i know of(I don't remember setting one up... I'm not the best w/ XP so I dunno what's available)

Both of us are having big problems with popups. Every 4 of 5 clicks, a new popup, often spawning a second one when its closed.

I started by running ad-aware on "my side", it found a ton of problems. Then I ran spybot search and destroy. Then I ran the free online virus scanner from trend micro.

All problems seemed fixed on "my side" but Oliegirl still had popup problems. SO I log on to her side and run ad-aware and spybot search and destroy, more problems found.

Now my side is fucked up again. Actually after a reboot both are fucked upa gain. I assume something has planted itself on our computer that's regenerating on startup or reboot or whatever.

Does anyone have any other suggestions to try to find what's going on? Every time I run spybot after a reboot/login change and a little usage, it finds problems again.

At this moment, I just ran spybot on my side, then on oliegirl's side, then logged back in as me and immediately started having problems again. I run spybot again right away, and it finds:

"DSO Exploit" is what it found this time with 6 registry entries. There are usually 3 things it finds but I can't remember the name of the other two and this time it only found the one.

Any ideas?

Radii · 09-18-2004, 10:16 AM

dola, forgot to mention that i also run CWSshredder and it never finds anything.

Cuckoo · 09-18-2004, 10:24 AM

Have you checked your running processes and start-up lists for unknown things? Answersthatwork.com has a good list of task items and what they are, necessary and shady. And there's a list of startup items at http://www.sysinfo.org/startupinfo.php that's pretty inclusive.

I'd start with that and see if you can isolate the problem and delete it. Sometimes these things put themselves on your system and change names everytime you reboot making it near impossible to remove them. Another good program is Hijack This, but you have to know how to read the log or find someone that can.

Draft Dodger · 09-18-2004, 10:27 AM

some of that spyware is VERY tough to get off your system; some are sophisticated enough to reinstall itself the next time you log on. might try emptying out your temp folder/internet cache after running spyware, on the chance that there's something residing there.

ultimately, the solution may involve editing your registry, or possibly even reinstalling the OS...

The_herd · 09-18-2004, 10:29 AM

The guy that updates CWShredder recently said he's had to give up fighting the latest versions of CWS. He said they have become so complex that he doesn't have the time or the resources availble to effectively fight them.

Cap Ologist · 09-18-2004, 11:13 AM

A good firewall can also make a huge difference. I had the same issues, but I use Zone Alarm's firewall and I can't remember when I last had a popup.

Radii · 09-20-2004, 10:40 AM

I ran hijack this, which i'd never used before, and found a few things that people on various spyware fighting sites recommended removing. Removed them, re-ran all my programs to fight ad/spyware, emptied out all temp internet folders, and cleaned up msconfig's startup a little bit.

So far, the problem seems to be fixed

Thanks to all that offered advice.

Cuckoo · 09-20-2004, 10:42 AM

Quote:

Originally Posted by Radii

I ran hijack this, which i'd never used before, and found a few things that people on various spyware fighting sites recommended removing. Removed them, re-ran all my programs to fight ad/spyware, emptied out all temp internet folders, and cleaned up msconfig's startup a little bit.

So far, the problem seems to be fixed

Thanks to all that offered advice.

Great. Yeah, Hijack this is outstanding. It took me a while to learn how to read the logs, and I usually get help from some sites that know more than I do, but it's a good one, typically does the trick.

Radii · 09-20-2004, 11:16 AM

Quote:

Originally Posted by Cuckoo

Great. Yeah, Hijack this is outstanding. It took me a while to learn how to read the logs, and I usually get help from some sites that know more than I do, but it's a good one, typically does the trick.

I just did a google search for anything I didn't recognize, for most of them I found hits to forum posts where someone had posted a hijack this log w/ similar problems as mine, and would just read the replies to see if people recommended removing the stuff that was showing up on my list. Not the most efficient thing in the world I guess but it worked and I didn't risk blowing up anything important that way

sterlingice · 09-20-2004, 01:16 PM

Quote:

Originally Posted by Radii

"DSO Exploit" is what it found this time with 6 registry entries. There are usually 3 things it finds but I can't remember the name of the other two and this time it only found the one.

Everyone I know who runs the program (including myself) gets the DSO Exploit so I went and looked it up one time. It's something like the "what's related" from Internet Explorer. It's not an "exploit" you really have to worry about as it's part of IE.

Personally, my regimen of Spyware smashing stuff is Ad-Aware then Spybot then HijackThis to see if I missed anything. I've found that if you don't run IE and use Firefox or Mozilla, you drastically reduce your number of problems. Same with running a firewall (Sygate here). The friends that I most have to help the most with fixing their system are the ones who use IE and click on any idiot link they run across, most often to watch some stupid internet humor or play some stupid game which they don't know has some malicious script in it.

SI

gi · 09-20-2004, 02:08 PM

Shut off System Restore. Reboot into safe mode. Rerun all spyware programs and antivirus programs. Reboot into normal mode. Verify things work. Re-enable system restore.

Hard battle to fight. I'm been in this buisness over 10 years and sometimes a complete system wipe is all you can do. XP System restore and booting into safe mode are key to solving these types of issues. Fully updated anti-spy ware programs and anti-virus programs is key as well.

If these programs list anything they can not remove, check symantec's site for removal tools. Or www.lavasoft.de might help as well.

iceberg414 · 09-20-2004, 02:24 PM

I need to thread jack...sorry. I also have windows XP and am having a MAJOR problem. Everytime I try to log on, it starts to log on then says "logging off." This happens on every user. I cannot log on. Isn't there a way to startup from a disc or something that will let me bypass the login screen? I think what happened was, I was running spybot. After I finished running it it said that more whatever was found, continue after restart. I clicked yes and now...this problem. Can anyone help me? It would be greatly appreciated. By the way, I hate XP. There always seems to be problems.

gi · 09-20-2004, 02:28 PM

Quote:

Originally Posted by iceberg414

I need to thread jack...sorry. I also have windows XP and am having a MAJOR problem. Everytime I try to log on, it starts to log on then says "logging off." This happens on every user. I cannot log on. Isn't there a way to startup from a disc or something that will let me bypass the login screen? I think what happened was, I was running spybot. After I finished running it it said that more whatever was found, continue after restart. I clicked yes and now...this problem. Can anyone help me? It would be greatly appreciated. By the way, I hate XP. There always seems to be problems.

If you can log on in Safe mode you can checkout the startup programs in the registry and delete what is causing this. Attempt to get into safe mode. If you can, post.

FrogMan · 09-20-2004, 05:20 PM

Quote:

Originally Posted by iceberg414

I need to thread jack...sorry. I also have windows XP and am having a MAJOR problem. Everytime I try to log on, it starts to log on then says "logging off." This happens on every user. I cannot log on. Isn't there a way to startup from a disc or something that will let me bypass the login screen? I think what happened was, I was running spybot. After I finished running it it said that more whatever was found, continue after restart. I clicked yes and now...this problem. Can anyone help me? It would be greatly appreciated. By the way, I hate XP. There always seems to be problems.

I've had problems with spywares recently and found I had a thing called wsaupdater on my computer, the more I researched about it, the more I found sites that were telling me to be cautious in the way I was gonna clean it. I used Hijack This and it worked like a charm, but I've read many stories of people not able to log in after deleting wsaupdater from their computer. Try this link for maybe some help:
http://www.lavasofthelp.com/articles/v6/04/06/0901.html

You can also google "wsaupdater.exe" and you may find some help...

Good luck!

FM

iceberg414 · 09-20-2004, 05:45 PM

Quote:

Originally Posted by gi

If you can log on in Safe mode you can checkout the startup programs in the registry and delete what is causing this. Attempt to get into safe mode. If you can, post.

How do you log on in safe mode?

gi · 09-20-2004, 07:24 PM

When the computer just gets past POST (BIOS) right before the WIN XP Loading screen shows up, hit F8. Choose Safe Mode. If you see the Win XP Loading Screen, you missed it and will have to reboot.

iceberg414 · 09-20-2004, 08:18 PM

Quote:

Originally Posted by gi

When the computer just gets past POST (BIOS) right before the WIN XP Loading screen shows up, hit F8. Choose Safe Mode. If you see the Win XP Loading Screen, you missed it and will have to reboot.

Well I'm about to go home and try to fix my computer. If I get it fixed I'll post results tonight, otherwise I won't have internet until tomorrow. Thanks for the help and I hope since Radii got his problem fixed with this thread, I will be as lucky.

iceberg414 · 09-21-2004, 10:58 AM

Well I was able to log on to my computer, but I am not exactly sure how I did it. I think I started it up in safe mode, but that did not work. I then started from the XP disc. Then I repaired XP and while that was happening Spybot popped up and asked if I wanted to check for problems. I did that and deleated more garbage. XP repaired itself and then restarted. Now I could login, but my colors were screwed up so I reinstalled my video card and restarted. Colors fixed, but everything was jumbo, all the icons and fonts. Also I could not get the internet to work. I am finished trying. Computers are too damn frustrating...I might play around later today, but it took me an hour and a half yesterday just to login. Thanks for all the help though.

09-18-2004, 10:27 AM	#4
Draft Dodger Coordinator Join Date: Jan 2001 Location: Keene, NH	some of that spyware is VERY tough to get off your system; some are sophisticated enough to reinstall itself the next time you log on. might try emptying out your temp folder/internet cache after running spyware, on the chance that there's something residing there. ultimately, the solution may involve editing your registry, or possibly even reinstalling the OS... __________________ Mile High Hockey

09-18-2004, 10:29 AM	#5
The_herd College Starter Join Date: Jul 2001 Location: Fort Lackland, Texas (San Antonio)	The guy that updates CWShredder recently said he's had to give up fighting the latest versions of CWS. He said they have become so complex that he doesn't have the time or the resources availble to effectively fight them. __________________ Oakland Raiders: HFL's 1970 AC West Champs

09-20-2004, 02:24 PM	#12
iceberg414 Mascot Join Date: Oct 2002	I need to thread jack...sorry. I also have windows XP and am having a MAJOR problem. Everytime I try to log on, it starts to log on then says "logging off." This happens on every user. I cannot log on. Isn't there a way to startup from a disc or something that will let me bypass the login screen? I think what happened was, I was running spybot. After I finished running it it said that more whatever was found, continue after restart. I clicked yes and now...this problem. Can anyone help me? It would be greatly appreciated. By the way, I hate XP. There always seems to be problems. __________________ iceberg slur...splurged on a chain

09-21-2004, 10:58 AM	#18
iceberg414 Mascot Join Date: Oct 2002	Well I was able to log on to my computer, but I am not exactly sure how I did it. I think I started it up in safe mode, but that did not work. I then started from the XP disc. Then I repaired XP and while that was happening Spybot popped up and asked if I wanted to check for problems. I did that and deleated more garbage. XP repaired itself and then restarted. Now I could login, but my colors were screwed up so I reinstalled my video card and restarted. Colors fixed, but everything was jumbo, all the icons and fonts. Also I could not get the internet to work. I am finished trying. Computers are too damn frustrating...I might play around later today, but it took me an hour and a half yesterday just to login. Thanks for all the help though. __________________ iceberg slur...splurged on a chain

09-18-2004, 10:16 AM	#2
Radii Head Coach Join Date: Jul 2001	dola, forgot to mention that i also run CWSshredder and it never finds anything.

09-18-2004, 10:24 AM	#3
Cuckoo College Starter Join Date: Oct 2000 Location: Edmond, OK	Have you checked your running processes and start-up lists for unknown things? Answersthatwork.com has a good list of task items and what they are, necessary and shady. And there's a list of startup items at http://www.sysinfo.org/startupinfo.php that's pretty inclusive. I'd start with that and see if you can isolate the problem and delete it. Sometimes these things put themselves on your system and change names everytime you reboot making it near impossible to remove them. Another good program is Hijack This, but you have to know how to read the log or find someone that can.

09-18-2004, 11:13 AM	#6
Cap Ologist College Prospect Join Date: Nov 2003 Location: Flower Mound, TX	A good firewall can also make a huge difference. I had the same issues, but I use Zone Alarm's firewall and I can't remember when I last had a popup.

09-20-2004, 10:40 AM	#7
Radii Head Coach Join Date: Jul 2001	I ran hijack this, which i'd never used before, and found a few things that people on various spyware fighting sites recommended removing. Removed them, re-ran all my programs to fight ad/spyware, emptied out all temp internet folders, and cleaned up msconfig's startup a little bit. So far, the problem seems to be fixed Thanks to all that offered advice.

09-20-2004, 02:08 PM	#11
gi College Prospect Join Date: Mar 2002 Location: Berkley, MI	Shut off System Restore. Reboot into safe mode. Rerun all spyware programs and antivirus programs. Reboot into normal mode. Verify things work. Re-enable system restore. Hard battle to fight. I'm been in this buisness over 10 years and sometimes a complete system wipe is all you can do. XP System restore and booting into safe mode are key to solving these types of issues. Fully updated anti-spy ware programs and anti-virus programs is key as well. If these programs list anything they can not remove, check symantec's site for removal tools. Or www.lavasoft.de might help as well.

09-20-2004, 07:24 PM	#16
gi College Prospect Join Date: Mar 2002 Location: Berkley, MI	When the computer just gets past POST (BIOS) right before the WIN XP Loading screen shows up, hit F8. Choose Safe Mode. If you see the Win XP Loading Screen, you missed it and will have to reboot.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)