SoftwareSpyware/Adware Removal?

  

Press Ctrl+Enter to quickly submit your post
Quick Reply  
 
 
  
 From:  PNCOOL   8 Apr 2004 10:55 
 To:  ALL 1 of 44 
13631.1 

I need something to get rid of this spyware that seems to have integrated itself into IE. It's changed the homepage, made my PC want to connect at startup and every now and them pops up random IE windows telling me "Warning! Your ISP is watching you. Buy our cleanup software now!". It won't let me change the homepage (it changes it straight back) and it's right pissing me off. Neither Adaware or Spybot could find or get rid of it.

 

I think it's the CoolWebSearch spyware, and it's a nightmare. Help!
0/0
 Reply   Quote More 

 From:  Kenny J (WINGNUTKJ)   8 Apr 2004 11:00 
 To:  PNCOOL      2 of 44 
13631.2 In reply to 13631.1 
I had something similar, and had similar removal problems; I ended up guddling about in the registry and file system to remove a couple of keys & dlls. RegMon and FileMon from sysinternals are your friends if you get to that stage, but only if you know what you're doing. I found good advice on the interweb somewhere as well.
Kenny
The Wisdom of Amazon customer reviews:
Cuttlefish Bones - E Montale
Montale is the great Italian poet of this century, and this is his best book. English Horn is of a stunning beauty.
0/0
 Reply   Quote More 

 From:  Mike (QUIGABYTE)   8 Apr 2004 11:44 
 To:  PNCOOL      3 of 44 
13631.3 In reply to 13631.1 

You need CWS Shredder.

 

See attachment.

 

Its worth using the update function too, mine is a few weeks old :0)
0/0
 Reply   Quote More 

 From:  PNCOOL   8 Apr 2004 13:41 
 To:  Mike (QUIGABYTE)      4 of 44 
13631.4 In reply to 13631.3 
Cheers, I'll give it a go. I'm on the spywareinfo site at the moment, following all of their steps to remove this shit. It's annoying as sometimes I'll click to post a message on here and the spyware will decide to randomly reroute it to one of its pages instead. Even though I've got them on the restricted sites list, it still tries.

0/0
 Reply   Quote More 

 From:  PNCOOL   8 Apr 2004 14:07 
 To:  Mike (QUIGABYTE)      5 of 44 
13631.5 In reply to 13631.3 
Nice one Mike. A couple of passes with that thing and it seems to have got rid of it.

0/0
 Reply   Quote More 

 From:  JonCooper   8 Apr 2004 16:34 
 To:  PNCOOL      6 of 44 
13631.6 In reply to 13631.1 
I see Quig has something that's dealt with it, but the attached will look at every change that's ever been made to IE, by you and by crapware - then you get to fix it.
Jon - A yllyth-ta leverel henna arta mar plek yn Kernewek?
0/0
 Reply   Quote More 

 From:  PNCOOL   8 Apr 2004 21:42 
 To:  JonCooper      7 of 44 
13631.7 In reply to 13631.6 

Cheers. I got that off of the web site mentioned earlier, just in case I had to save the log file to put on their forum. It had a few entries that it fixed, but then they came straight back again. That proggie Mike put up here fixed it all though (at least I hope it did).

 

Does the built-in XP firewall protect you from spyway/adware attacks like this, or not?
0/0
 Reply   Quote More 

 From:  Mike (QUIGABYTE)   9 Apr 2004 03:41 
 To:  JonCooper      8 of 44 
13631.8 In reply to 13631.6 
That's a damn good proggie too, I think the same guy made both actually.

0/0
 Reply   Quote More 

 From:  Menace! (DENNIS)   9 Apr 2004 20:21 
 To:  PNCOOL      9 of 44 
13631.9 In reply to 13631.1 
Now that you've got rid, you can set Spybot so it won't permit owt to do it again. Works for me.
The Menace
0/0
 Reply   Quote More 

 From:  PNCOOL   9 Apr 2004 23:42 
 To:  Menace! (DENNIS)      10 of 44 
13631.10 In reply to 13631.9 
But Spybot never found it, so Spybot can't immunise against it. I've got something called Spy Guard and another called Spyware Blaster to hopefully stop any further problems.

0/0
 Reply   Quote More 

 From:  Golden Axe   11 Apr 2004 11:41 
 To:  PNCOOL      11 of 44 
13631.11 In reply to 13631.10 
You have to watch out for some of these rogue spyware removal applications, that claim to remove but actually install spyware!
0/0
 Reply   Quote More 

 From:  PNCOOL   11 Apr 2004 12:39 
 To:  Golden Axe      12 of 44 
13631.12 In reply to 13631.11 
I will do, thanks. Although, I think all of the ones on spywareinfo.com would be safe.

0/0
 Reply   Quote More 

 From:  Richy (GAJIT)   12 Apr 2004 00:49 
 To:  Golden Axe      13 of 44 
13631.13 In reply to 13631.11 

And some of them do a bad job of it. A good example being Ad-aware trying to remove the sponsor that is optionally installed with Messenger Plus! 2.

 

Ad-aware doesn't actually get rid of it all, and so some shit is still left over and popups still occur. However, it removes enough to fuck-over the uninstall program, so even if you uninstall Messenger Plus! 2 (which genuinely removes the sponsor when you uninstall) the nasty stuff will still be there.


Gajit
Website: Indigo Onion -BETA-
MSN: inspectorgajit (with the usual Hotmail bit)
E-mail: tehforum (blah) indigo-onion.co.uk
0/0
 Reply   Quote More 

 From:  Golden Axe   12 Apr 2004 12:29 
 To:  Richy (GAJIT)      14 of 44 
13631.14 In reply to 13631.13 

Yeah, Ad-Aware screwed up the removal of new.net scum, forcing a OS reinstall.
I find Spybot to be a lot safer in removal, but I find that I need to run run both so that nothing is missed.

 

 
0/0
 Reply   Quote More 

 From:  Digby   14 Apr 2004 03:51 
 To:  PNCOOL      15 of 44 
13631.15 In reply to 13631.10 

That's weird, I swear by Spybot. I've got everyone at work using it now, too. Can't believe it missed something so obvious.

 

You got the *real* Spybot, right? The one with the thumbprint icon? There's a faker commercial-y venture out there that manages to make itself come up first on Google when you search "spybot"

 

 

 

Edit: If I was ALLOWED to go to work, which I'm not...
0/0
 Reply   Quote More 

 From:  Mike (QUIGABYTE)   14 Apr 2004 04:06 
 To:  Digby      16 of 44 
13631.16 In reply to 13631.15 
The icon on my version is two windows with a spyglass, the thumbprint is used on the internal logo though. Its the genuine one though as its from a coverdisk ;)

Anyway it lists coolwwwsearch but not coolwebsearch. Perhaps they are the same...
0/0
 Reply   Quote More 

 From:  PNCOOL   14 Apr 2004 14:48 
 To:  Digby      17 of 44 
13631.17 In reply to 13631.15 
It found coolwebsearch and coolwwwsearch. It just didn't get rid of them properly. And yes, it is the version with the thumbprint, but like Mike's it's on the program rather than the icon itself.

0/0
 Reply   Quote More 

 From:  JonCooper   14 Apr 2004 15:01 
 To:  ALL 18 of 44 
13631.18 In reply to 13631.17 

AARRGGHH!!!!!

 

on leaving the house last night I said to the babysitter 'fell free to use the internet'

 

today I have had to run adaware, spybot, hijack, system mechanic & delete 3 folders manually - it's taken over 30 mins to remove all the crap (including a 'helpfull' toolbar).

 

babysitter will NOT be invited to 'use the internet' next time.

Jon - A yllyth-ta leverel henna arta mar plek yn Kernewek?
0/0
 Reply   Quote More 

 From:  PNCOOL   15 Apr 2004 02:10 
 To:  JonCooper      19 of 44 
13631.19 In reply to 13631.18 
Welcome to my world.

0/0
 Reply   Quote More 

 From:  Richy (GAJIT)   15 Apr 2004 13:16 
 To:  JonCooper      20 of 44 
13631.20 In reply to 13631.18 

PC Licence.

 

I say no more.

 

(And no, the European Computer Driving Licence is NOT what I'm talking about)


Gajit
Website: Indigo Onion -BETA-
MSN: inspectorgajit (with the usual Hotmail bit)
E-mail: tehforum (blah) indigo-onion.co.uk
0/0
 Reply   Quote More 

Reply to All  
 

1–20  21–40  41–44

Rate my interest:

Adjust text size : Smaller 10 Larger

Beehive Forum 1.5.2 |  FAQ |  Docs |  Support |  Donate! ©2002 - 2024 Project Beehive Forum

Forum Stats