Hardware

Ask something
Discussion Locked

Spyware/Malware

0 helpful
16 replies

by rrdavis07

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a user who, on Friday, became infected with a whole slew of spyware/adware/malware troubles. She is our webmaster, and she knows how to protect herself online, but got bit anyway.

We have tried to rid her system of this malware, but have been having little luck. If anyone has had experience with this. We'd be thankful.

Her symptoms: Popup ads--even when IE is not currently running. She always has InterDev running and is continually being asked if she want's to debug various poorly written pop-up ads. When we've searched her system, she as the following:

AutoUpdate
msbb.exe
SaveNow
Power Scan
Bargain Buddy
EbatesMoeMoneyMaker
eZuLa
FunWebProducts
ISTsvc
xxxtoolbar
Interstitial Ad

They were all installed the day her problems started. We have run Ad-aware and cleaned her system with that, but continued to have some of the problems, but with less freqency. Some of the programs removed by Ad-aware have been reinstalled. We have tried to manually remove some of the software and have edited out all the malware run statements from her registry. However, we are still getting errant behavior every once in a while.

Another user on our network had very similar behavior on her computer and had the same programs installed. I thought this user was just surfing where she shouldn't have been.

Does this sound familiar to anyone? Is there something more I should be doing to protect our users and network from these malicious programs?

16 replies

by cactus pete

Also use SpyBot. They compliment each other well enough. Also, I would suggest getting CWSshredder. You can probably find all of these on TR's sister sites like download.com

by usrbabsitr

If she's using windows 2000 then just disable the messenger service on her box... no more pop-ups. Unless she really needs it. And get yourself a decent firewall...

by pramodpatil

also try spywareblaster along with Spybot Search and Destroy. free utility which stops any installation of spyware

by thechas

The authors of spy-ware and related mal-ware are getting trickier.

Since it is fairly easy to disable applications by removing executables and registry keys, they are moving into replacing system files.

We ran system file checker on a badly infected system and found a number of system files that had been replaced by files that were significantly larger than the originals.

The spy-ware authors actually have a stronger incentive than the virus writers in that they get paid for their work.

Chas

by worker bee

Istsvc comes with an uninstall program. Search your registry for istsvc after it reinstalls itself and you will find the command to uninstall it.

Bargain Buddy and Power Scan come from a web search and home page hijacker. I cannot remember the name but if you google the name of the web search page your home page has been reset to you should find the link that in turn links to the place that has a program to remove it. As I recall there are two versions of the uninstall program and you will probably need the second one. I think it is called something like uninst2.exe.

by chuck

The same thing happened to me. After a couple of days searching the registry for web sites that matched the sites that kept popping up, with limited success, I decided a reload (or in my case a reimage, since we have Altiris) ws the way to go. A short couple of hours later, I was back in business. It's a pain but you could grow old and gray trying to remove all of the registry traps manually...

Good Luck!
Chuck

by dbucyk

Run Zone Alarm Pro (if you aren't already). Prevent any software from accessing the internet like spyware, malware.

Run Spybot. You should be running at least two different types of removal programs for better success.

Do all your disk cleanup options as well as registry cleanup options.

by beachrat35

Run Spybot Search & Destroy. You may have to reboot and run it again. Run CWShredder (CoolWebSearch is nasty). Then run Adaware SE ( may also have to be repeated). Also, run Toolbar Cop and see what toolbars are being used.

Good luck and be vigilant!

by ssteinberg

Disconnect from the internet. Run AdAware as you did. Remove anything you can from Add/Remove programs. Run HiJack This (my favorite removal tool.) You will have to check certain things on another pc on the internet, to determine if it's spyware. (Just type in fghjfgj.exe or whatnot.) HiJack is more a manual registry removal tool, but it makes backups. Then, if some stuff won't remove, boot into Safe Mode and then delete the folder from Program Files, or wherever it may have nested.
If it's really ingrained in your pc, you may have to just reinstall like someone else suggested. I know, within a few minutes if that is what I need to do or not. But the spyware removal process I listed solves 95% of my issues.

by weehee

I'd suggest to run Spybot before running HiJackThis. My guess is that at least 80% of the problem will be fixed after running AdAware & Spybot.

This may sound obvious, but make sure that the definition files for AdAware & Spybot are up-to-date.

by advance_101

I reccomend programs that will remove, and will also protect you from various spyware.

- Spybot Search and Destroy
-Ad-Aware SE Personal
- Spysweeper

by iwayne

I am having the same problem with this ISTSVC.EXE file. I am running both MS Anti-Spyware and Spyware doctor. My O/S is WIN2000 and I have tried every solution mentioned in these posts other than reloading Windows.

I wonder if there is any organisation with which an official complaint can be laid to make the authors of the software provide working removal tools to users who do not want their software.

As a PC user I have a right to say what I want on my PC and not be forced by dishonest writers to take their software. These companies should be dealt with like virus authors and be charged for a crime. If I ever got the opportunity I will be the first to sue!!

Symantec also has a removal tool but the same thing occurs where it re-installs again.

by deepsand

The problem lies not with the authors of such programs, but with those who deploy them.

IF you can identify who caused such to be loaded onto your machine, and can prove that harm resulted from such, then any number of avenues are open re. legal recourse.

by jdclyde

First, update your spyware checkers.
Reboot into safe mode.
Run the checkers.

For ones that can't be removed, symantec has on their web site removal instructions. Sometimes they will have a utility, sometimes it is manual diving into the registry.

by deepsand

Many malware apps deliberately sabotage your system if some, but not all, of their components are removed or altered.

Also, they may remove or rename critical files and/or Registry entries, which are exceedingly difficult to manually repair, absent complete knowledge of all that was touched by the malware.

Absent a countermeasure specifically designed to target the malware here involved, I very seriously urge that you do a Restore to a point prior to the time of infestation.

Then, follow the advise given here by others re. installing a firewall, SpyBot (be sure to activate Tea Timer), & Ad-Aware. If your budget will allow such, use for-pay packages, rather than the free ones.

This discussion is closed to new replies.