PDA

View Full Version : Spware Full Strength Attack


mylanta
03-23-2006, 03:53 PM
Well folks I just survived a full frontal spyware and virus attack, the likes of which I haven't ever seen. I was on a site trying to play a music file (don't worry I never frequent Kazaa or Limewire and the like) and I was told I needed a codec to play it. Using Sea MOnkey browser I am used to these kinds of requests so I did it. Not only did the mpeg still not play, a little while later Win Patrol is signalling browser change, and all kinds of attempted startup and file association changes. Needless to say online scanners were tough to get through because browser was overrun with attempted screen to sell me their spyware prvention "junkola".
Here is the purpose of my writing all this. I have been using Pest Patrol and Windows Defender lately and had gotten away from Spywareblaster and Spybot, because they eat my cookies all the time and I'm sick of it. Well Defender reported the intruders, but rendered it useless to stop them. Nod32 repelled it's virus, but found nothing else. Ewido online scanner found tons of hijackers and spyware cookies, but could not remove them and I could not delete the active processes once I realized where they were.
Realize that anytime I could have restored back to an image file I made yesterday, so I was in no danger, but I wanted to fight this as if I had no backup to see what users go through.Pest patrol removed a few problems, but could not touch the hijackers so I downloaded hijackthis. This found the problem but failed to remove it and remember Win Patrol is going off every 30 seconds so I am working against time here.
I finally went back to old times and downloaded Spybot and installed and updated it.In seeing what Spybot pulled up I noticed "Vcodec"and the source of the problem became known to me for the first time. It removed most of the problems, and then rebooted to take out the rest but through all of this I learned something and that is that running Spywareblaster in the background and Spybot to scan, is still the most thorough approach to these situations, so I am back in the fold, restoring cookies now and then, but using Spywareblaster and Spybot as my main "front lines".

mommalina
03-23-2006, 04:14 PM
........ I learned something and that is that running Spywareblaster in the background and Spybot to scan, is still the most thorough approach to these situations, so I am back in the fold, restoring cookies now and then, but using Spywareblaster and Spybot as my main "front lines".

I'm so glad I never abandoned Spywareblaster and Spybot! :D They deserve contributions for their free software!

Think I'll keep Kaspersky AV, too, in spite of the redundant startup scan.:)

Lina

Dan18960
03-23-2006, 04:25 PM
Rich,

WOW what a day huh!

You know you might want to add smitfix to your arsenal too. I was banging on Spy Falcon yesterday and it is the kin of SpyAxe, SpyStriker, and SmitFraud.C! I was able to clear out the trojans, spyware, and registry keys but SpyBot still found smitfraud buried in the system. Ran smitfix and then re-ran all my fixers - everything came out clean.

I added Admuncher to the users box and reset the internet bowser back to a web page and billed 3 hours for the adventure.

Client got back the system this morning and was a happy camper when I left.

And again there was one of those darn search toolbars! I still maintain that EVERY system I have touched with these problems has had a toolbar of one flavor or the other.

Glad to hear you made it out a live ;)

mylanta
03-23-2006, 05:42 PM
Dan I had all those Spy Falcon and Spy Axe circling for "the kill" as well. What really surprised me was when Windows Defender collapsed and eWido froze...then hijack this failed to remove the main problem. I had killed System Restore (which is usually off anyway but wasn't as I forgot and this is a new install this week)...then when Pest Patrol let me down, I was crushed.
I agree on the toolbars and I never use them...everything you try to install lately tries to add yahoo toolbar too.

PeteF
03-23-2006, 06:27 PM
I have been using Pest Patrol and Windows Defender lately and had gotten away from Spywareblaster and Spybot, because they eat my cookies all the time and I'm sick of it.

Rich, just in case you or anyone else is not aware, Spybot_v1.4 allows
you to right-click on an item detected and exclude it from future scans.
That might help with the cookie eating issue.

---pete---

mylanta
03-23-2006, 10:46 PM
Rich, just in case you or anyone else is not aware, Spybot_v1.4 allows
you to right-click on an item detected and exclude it from future scans.
That might help with the cookie eating issue.

---pete---



Pete,
I do know that but just updating the thing blows away my Excite Home Page.

Smokey
03-24-2006, 09:48 AM
So, I am just curious but what is Spware????

mylanta
03-24-2006, 11:07 AM
So, I am just curious but what is Spware????

Well funny aren't you. Of course if I had more than just a "Moderfartor's Title", maybe I could correct the spelling which also isn't yet enabled here either!
Glad you have the time to "cast stones" though!

mommalina
03-24-2006, 02:37 PM
So, I am just curious but what is Spware????

Back off, Smokey! :) Me thinks you need some reading lessons from Dan.

Rich just did not follow Dan's instructions closely enough -- the first and last letters are still there, but he failed to jumble the inside letters adequately. Big deal!;)

BTW, kudos for having the titles automatically entered in the replies! :cool: It was not so on the old board, and on occasion I experienced a senior moment and got lost..

Question: Will the coming spell check include checking the titles of the posts? This was not a feature on the old board, and we had some amusing typos and misspelled words.

Lina