Question:
I regularly run three Adware/Spyware programs: Microsoft Antispyware. Adaware 6, Spybot - Search & Destroy. All are maintained with latest updates, and are sometimes run daily.
However...the same common items keep coming up time & time again.
eg. Adviva, Avenue A., BFast, Doubleclick, Hitbox, MediaPlex etc. etc.
I delete them, and if I re-scan can confirm that they have gone.
However, if I re-scan the following day, they are all back!
I don't do anything unusual on my PC. The usual surfing (no dodgy sites!) and minimal downloading.
I could understand if I were downloading a lot of stuff off the internet via P2P ow whatever, but even when I don't download anything, these items still seem to appear.
I see 2 possibilities:
1) Somehow my PC is 'infected' with 'dormant spyware' which re-install themselves periodically somehow, or
2) They automatically install from sundry well-known web-sites
If (1), how do I find them and get rid of them? As I said I run all the Adware/Spyware programs, Norton Antivirus, and Zonealarm firewall. I feel pretty comfortable against normal viruses, trojans and other attacks (I'm also behind a hardware firewall), but these Spyware programs are just annoying.
If (2) is there any point in finding/deleting them? If they're going to return daily from normal surfing, why don't I just save my time and leave them on my system rather than checking for them all the time?
Any thoughts?
Cheers,
Don
Answers:
Have you used Hijackthis yet? It finds all the trojans etc which get hidden in your windows/system32 folder, and in the registry. I would imagine this is why they keep returning each day.
Hijackthis finds the program, and not only stops it dead, but also looks for the root folder of the trojan/spyware. It then deletes all instances of it. I've used it and found it pretty effective. Not going to put my neck on the line and say that it will solve all your problems, but it's deffo another security program you should be using as part of your already substantial package.
Answers:
criminal_smile where could we get this from?
Answers:
you can get it here
Answers:
i found that my norton internet security 2005 does a really good job.
it has the whole lot, antivirus, firewall etc.
got it for £17 off ebay
Answers:
I did too! BUT I use AVG, SpyBot and Microsoft Spyware aswell and run all once a week, one will normally find something another has missed
Answers:
You should also install onto your PC. SB is different from Adaware and SpyBot in that its role is to prevent the installation of Spyware rather than cleaning it out afterwards.
Once installed, SB should be updated often, as with any anti-virus/anti-malware application, but that apart ther eis no other overhead in terms of time or processing power. SB does not need to run in the background while the PC is on.
It is not going to stop 100% of malware being installed on your system, but it should cut down the amount dramatically.
HTH
Answers:
Thanks for the advice so far. I also use Microsoft AntiSpware which is a resident program and claims to stop new malware being installed. But it doesn't catch the common ones I mentioned before.
To be honest, I don't have a big problem - besides the 7 or 8 regular ones, I only get a few others from time to time (which get spotted and cleaned by one or other of the checkers.)
My query is more to do with the regular ones. If they are able to come back daily (presumably from simple daily surfing), then is there any point in finding/deleting them regularly?
I'll try HijackThis, but I think I've tried it before, with no noticeable improvement to my system.
Cheers,
Don
Answers:
I hate the kind of post I'm about to write ..... but I have no problems at all and I run pretty much the same security that you do. (I hate this post as just because I don't have a problem doesn't mean that everyone else should be OK too).
Perhaps it's linked to some of the sites you visit?
You could try disconnecting from the net then turning off system restore. Run the scans and, when clean, turn system restore on again and immediately create a new restore point. It could be that some of this stuff is residing in the system and the restore feature is refreshing them in some way.
Other than that, I can only suggest a complete reformat & reinstallation - but that's a bit drastic, especially as the bugs are at least being caught. And do make sure you have relevant backups etc.
Cheers
Answers:
maybe it is certain sites that you visit.
i know that some of the football and other sports sites have caused problems in the past.
try going on all the sites you usually visit and then run a check after each one.
time consuming i know but if it bothers you it may be good to know which it is.
*edit*bum, look at my poor timing!*edit*
Answers:
As you surmised they are used for advertising on loads of well-known sites. LincsLad is right; SpywareBlaster will block most of the common ones and harmful sites as well.
Answers:
I've followed the advice above and installed HijackThis and SpywareBlaster and I wondered if anyone could help me determine whether the following are spyware programmes and safe to get rid of
These were picked up by HijackThis and I'm highly suspicious of their function (all other files looked ok and were ones I recognised) ...
O2 - BHO: AcroIEHlprObj Class - !!06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - !!53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - !!5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
Can I get rid of the following two as I don't need or use Freeserve products anymore
O3 - Toolbar: Freeserve - !!8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
Cheers
Answers:
Curry_Queen,
Adobe acrobat you probably downloaded to read .pdf files -so ok, and the others are Spybot & Spywareblaster by the looks of it.
If you don't use the Freeserve yes you could get rid of it.
Answers:
Thanks Fran
I'll keep the top 4 then as I've also read since posting that not all BHO's are actually harmful, and as you say, they appear to be part of programmes that I use. The other 2 can go tho
Answers:
I've mentioned Sandboxie on a few occasions and as far as I know only one other person has installed it and he reported it as being 'fantastic.' Personally I think it is better than that. The plethora of programmes that are usually mentioned in relation to spyware leave many installing several different solutions to prevent systems becoming infested. NOTHING gets past Sandboxie, all and I mean ALL spyware intent on invading your system while you browse isn't allowed to, instead it is directed to a 'sandbox,' a temp file where it is COMPLETELY CONTAINED and unable to cause any harm, infestation or penetration to your system whatsoever. Once you finish browsing you 'delete the contents of sandboxie' and everything that potentially would have harmed your pc is deleted. I've had the programme 'sandbox' a virus in the past. The incursion was immediately flagged by AVG, but when I checked the location of the virus I found it safely in the sandbox. I deleted that along with the virus. I believe Sandboxie to be the definitive solution, it is for me, and it's small, free and comes with an uninstaller.
.
Answers:
Some Spyware can lurk in SYSTEM RESTORE POINTS so, even if you delete it from elsewhere on your machine, it may re-install itself!
So, before running your anti-spyware program, you must disable SYSTEM RESTORE; this gives your anti-spyware software access to the RESTORE POINTS and can delete the spyware they contain. After running all anti-spyware software you have and deleting any spyware you don’t want, you should then re-enable SYSTEM RESTORE.
Then switch off your computer, re-boot and then re-scan with all available scanning software. Hopefully, all should be OK.