Registered: Mar 2001
Location: Near the banks of the River Charles
Posts: 1684

SOAK:jeired uninstall

My wife let her PC get infected with this scumware that just generates pop-up after pop-up. Adaware (sorta) removes it, but upon reboot it just reappears. I'm googling for a solution but everything appears to be other sites riddled with more adware, or "you gotta pay to see the solution". Anyone have any ideas?

The more pessimistic sites I've seen say the only real cure is fdisk c:

It would serve her right if she lost her PC for a few days until I decided to fix it. I tell her not to let things install, but it just goes in one ear and out the other.

With all the crap I see she has on this thing, maybe fdisk isn't such a bad idea.

Bad day for virii today, one of the main test stations got hit with Sasser and we have to wait for the help desk to come and fix it. Of course they don't care that it's the end of the quarter and it's imperative to get this machine working to meet shipments.

added: There's also adroar and TV Media and who knows what else on this thing.

__________________
Paul

Don't ask for more than you can handle, you may get it. - The Great Gazoo

Last edited by trojanrabbit on 06-27-2004 at 11:14 PM

POST #1 | Report this post to a moderator | IP: Logged

Registered: Feb 2002
Location: 19th hole
Posts: 7680

You can try Spybot, it does a great job overall, a bit better than AdAware imho.

If you know the virus name, google for it.

__________________
"Happiness on earth ain't just for high achievers" -- Brooks and Dunn

Join us in Las Vegas for TC-Con '05, June 13,2005!

*5130*

POST #2 | Report this post to a moderator | IP: Logged

Registered: Oct 2003
Location: Northern Colorado
Posts: 2118

Manual removal instructions can be found at the bottom of the page here.

You can also remove the CleverIEhooker using CWShredder & HiJack This. Basic instructions are here.

Have fun...it's a messy one.

__________________
"Anyone who lives within their means suffers from a lack of imagination" -- Oscar Wilde

POST #3 | Report this post to a moderator | IP: Logged

Registered: Nov 2003
Location:
Posts: 1461

When you do scan with Adaware and Spybot be sure you're NOT online. Physically unplug the cable.

You'll probably need to do a few scans of each, then manually remove any remaining files. The easy stuff is just in program files, or the root of C. A lot of this spyware will redownload itself if there is any file remaining, which is why it's important to do all the cleanup offline.

POST #4 | Report this post to a moderator | IP: Logged

Registered: Mar 2001
Location: Near the banks of the River Charles
Posts: 1684

The list of stuff on this thing is mindboggling.

I guess the only way to make sure this is off the internet is to shut down the access point, since it has internal wireless.

Ugh. Does taking her off the administrator list for this computer help any?

Tablet PC running Win XP home (tablet edition)

__________________
Paul

Don't ask for more than you can handle, you may get it. - The Great Gazoo

POST #5 | Report this post to a moderator | IP: Logged

Registered: Jan 2000
Location:
Posts: 2401

Removing her admin priviledges will probably help. Just make sure she doesn't know the passwords to get around it.

You may also want to install FireFox and make it the default browser.

One of the anti-spyware programs I'm starting to like is Pest Patrol. It's $39.95 but the EULA says the eval is good for one year. It's got a klunky interface but they give very thorough descriptions of everything it finds.

POST #6 | Report this post to a moderator | IP: Logged

Registered: Nov 2003
Location:
Posts: 1461

You can take away admin privileges, but unless you make her a regular user it won't do much good. Power users still have access to the registry and to install applications. Users can't do it but also can't do a lot of other things. If this is her primary PC, she probably would get annoyed really quickly if she's only a user.

POST #7 | Report this post to a moderator | IP: Logged

Registered: Mar 2001
Location: Near the banks of the River Charles
Posts: 1684

Thanks for everyone's help. Finally got it cleaned this afternoon, hopefully it stays that way. Most important thing was to do everything in safe mode, as it all kept coming back.

__________________
Paul

Don't ask for more than you can handle, you may get it. - The Great Gazoo

POST #8 | Report this post to a moderator | IP: Logged

Registered: Mar 2002
Location: Gilbert, AZ
Posts: 691

Actually taking away admin privileges doesn't help much at all. This stuff is very similar to viruses. It doesn't matter what your rights are on the machine it's getting installed anyway. A good way to prevent it from coming back though is a program called Spywareblaster. I saw Leo hocking it on The ScreenSavers last night. I downloaded and checked it out this morning, and it looks pretty good. Like virus software you'll have to keep it updated, but you have to pay for auto updates. I wouldn't. I'd just click and update it every so often manually. Like before I quit for the day. Only takes a sec to do. You can pick it up here

I'm going to do so testing with it to see just how well it works, on a user here who's notorious for having spyware on her computer but claims she never downloads anything , stuff just appears. Like that darn weatherbug.... argh

__________________
Bruce
Philips DSR6000R (96Hrs)
Philips DSR7000R (120Hrs)
Even a Broken clock is right twice a day!

POST #9 | Report this post to a moderator | IP: Logged