Comments on: Spy attacks my PC’s performance, IE & Desktop

By: joelsplace

joelsplace — Sat, 25 Jun 2005 14:12:31 +0000

I’ve found that it’s a lot easier to run Hijackthis to edit the registry instead of doing it manually. It also backs up the changes in case you delete something you need. It’s free.
I’ve also found that IE doesn’t always dump the temp files. If you have files with extra long filenames explorer won’t even delete them and you have to use the command prompt. Sometimes the subfolders in content.ie5 are invisible even when your view is set correctly but you can see them from a command prompt.

By: wheels

wheels — Fri, 24 Jun 2005 02:42:00 +0000

You can, as suggested, completely wipe your hard drive and re-install. It may very well be an “easier” way. But, if you have a lot of data, programs, documents, and other stuff, you may want to do things the hard way. It may take many hours of your time, and you have to be willing to do some homework/research, but it can be done.

Here are some suggestions:
Disable System Restore
Run your anti-spyware tools in safe mode (after updating them). It may not be enough to just run them. Don’t just accept the defaults, learn how to get the most out of these tools.
Poke into your registry, and find the Run, RunOnce, and RunServices keys, and (after researching which ones are bad) delete any offenders found. Note: making changes in the registry can be very dangerous to the health and well-being of Windoze, so _please_ tread with caution here.
Also, while in safe mode, clean out all the temp folders – the Windows temp directory, as well as all user temp directories. (Temp means temporary, if there are files there older than 1 day, you shouldn’t miss them if they are gone!) I’ve found a lot of viruses and spyware in these directories, but YMMV.
Don’t forget to delete all temporary internet files – when you click, don’t forget to put a check mark in the box next to where it says “Delete all offline content”.

After you get rid of the crap, to prevent this from happening again, I have 2 suggestions:
An antivirus program (most of them these days have some sort of spyware protection features).
Don’t use Internet Explorer anymore, unless you have to.

Happy hunting

By: darthzakkie

darthzakkie — Wed, 22 Jun 2005 14:48:54 +0000

I agree with steve.. clean install is the best way, but it does no good if you don’t find out where you got the SPYware/virus in the first place, as you can just get it all over again if your not careful.. cheers..

By: stevesz

stevesz — Tue, 21 Jun 2005 23:19:01 +0000

Sometimes you just have to bite the bullet and reload your machine from scratch. However, first, you might want to try this to see if it helps.

Turn off your system restore. This is very important, as spyware can be reloaded from there.

Run a virus scan with your current Av software, amking sure it is updated to current versions of engin and definition files. Let it clean, delete, or quarantine anything it finds, then delete those files.

Run an online virus scan from another company. Again let it clean, delete, or quarantine anything it finds, then delete those files.

Run Spybot S&D. There is a new version out–just downloaded it tonight, so I haven’t tried it yet, but the blurb I read in the online arm of a respected magazine gave it the thumbs up. Be sure to update defintions and immunize the machine.

Download and run the Microsoft anti-spyeware program, again ensuring that it is updated.

Get a copy of Hijackthis and run that. Be sure you know that the entries you are deleting do not belong in your registry. It will pick up valid entries as well as invalid entries.

Check your HOSTS file for entries other than 127.0.0.1 localhost and anything you may have entered. Remove all extraneous entries.

Run Adaware, again ensuring it is updated.

Reboot and repeat.

If you find repeat offenders, look them up via Google and follow the instructions found for removal.

Reboot and repeat.

If you are sstill having problems, hang it up and do a bare metal install, after saving your data.

Steve//

By: jrmorency

jrmorency — Tue, 21 Jun 2005 14:12:07 +0000

Hello,

I have been using SpyKiller from SpyKiller.com. It is reasonable priced and doesn’t seem to let any spyware in.

John R. Morency
763-546-2137

By: darthzakkie

darthzakkie — Mon, 20 Jun 2005 18:26:53 +0000

I feel sorry for you.. I really do.. I had the same problem once after listing accounts on a free server website.. it seems that this spybouy is all over the net now and is annoying lot’s of people.. what i did was unplugged my cable modem power cord, changed my homepage to blank in IE, then i went into the registry and deleted all known instances of the word SPY, I then went back to IE and pulled it up(without the modem plugged in), and typed in google in the address bar.. from there i then plugged the modem back in and then refreshed the page.. once google hit, i navigated to download.com where i downloaded a free trial version of a program called SPY Doctor.. I ran this program like 40 times before it stopped the page from loading on my desktop.. Also, you can check the Startup group from MSconfig and disable it and then find the paths for any obvious dll files and simply delete them..

hope this helps..