Comments on: My Adware Adventure http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/ the blog that is not dansdata.com Fri, 10 Feb 2012 15:31:30 +0000 http://wordpress.org/?v=1.5.1-alpha by: nickthegeek http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-712 Fri, 09 Feb 2007 18:48:30 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-712 Yeah, I had a similar experience yesterday ... Somehow a trojan got onto my computer and it took me the best part of a day to figure out how to get rid of it ... I knew something was wrong when I heard the hard drive churning for 10 minutes non-stop when nothing was running onscreen. I checked Task Manager and an instance of "iexplore.exe" was sucking up CPU cycles - but Internet Explorer wasn't running so it was obviously some type of virus/trojan. But that wasn't the worst of it. * It somehow corrupted my install of AVG so I couldn't run it * It also corrupted my install of Spybot S&D so I couldn't run it * It changed all folders on my computer to Read Only, so I couldn't download and re-install AVG or Spybot * I tried using online scanners and other malware/AV programs but they were either automatically shut down after a period of time (I'm assuming when they come into contact with the file?) or they simply didn't detect the malware. * It somehow generated a BSOD when I tried to boot into Safe Mode I did some research and found a post in forum that said the only thing that someone found that got rid of it was a program called PREVX. I'd never heard of it, so I Googled it, found it was legit, installed the free trial and it detected and removed the trojan immediately. Needless to say, I purchased a subscription. I hope this helps someone. Cheers Nick :) Yeah, I had a similar experience yesterday ...

Somehow a trojan got onto my computer and it took me the best part of a day to figure out how to get rid of it ...

I knew something was wrong when I heard the hard drive churning for 10 minutes non-stop when nothing was running onscreen.

I checked Task Manager and an instance of "iexplore.exe" was
sucking up CPU cycles - but Internet Explorer wasn't running so it was obviously some type of virus/trojan.

But that wasn't the worst of it.

* It somehow corrupted my install of AVG so I couldn't run it

* It also corrupted my install of Spybot S&D so I couldn't run it

* It changed all folders on my computer to Read Only, so I
couldn't download and re-install AVG or Spybot

* I tried using online scanners and other malware/AV programs but they were either automatically shut down after a period of time (I'm assuming when they come into contact with the file?) or they simply didn't detect the malware.

* It somehow generated a BSOD when I tried to boot into Safe Mode

I did some research and found a post in forum that said the only thing that someone found that got rid of it was a program called PREVX.

I'd never heard of it, so I Googled it, found it was legit, installed the free trial and it detected and removed the trojan immediately.

Needless to say, I purchased a subscription.

I hope this helps someone.

Cheers

Nick :)

]]> by: HitScan http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-636 Wed, 24 Jan 2007 00:44:46 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-636 It isn't always guaranteed, and hopefully you won't need to do it in the future, but I've found that setting the file security to deny execute and read access to any of the files involved and then rebooting can sometimes help with the really persistent ones. It isn't always guaranteed, and hopefully you won't need to do it in the future, but I've found that setting the file security to deny execute and read access to any of the files involved and then rebooting can sometimes help with the really persistent ones.

]]> by: magetoo http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-367 Thu, 30 Nov 2006 07:13:59 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-367 So... I run <a href="http://www.netbsd.org/" rel="nofollow">BSD</a>. What's this "malware" thing I keep hearing about anyway? I've done the VMWare dance though, complete with backups of the fresh install and everything. Too bad it was completely unsupported and not very useful for me. "One of these days", I think the expression goes, I'll <a href="http://www.netbsd.org/Ports/xen/" rel="nofollow">set up</a> <a href="http://www.cl.cam.ac.uk/research/srg/netos/xen/" rel="nofollow">Xen</a> so that I can play with fire too. From behind a blast screen. So... I run BSD. What's this "malware" thing I keep hearing about anyway?

I've done the VMWare dance though, complete with backups of the fresh install and everything. Too bad it was completely unsupported and not very useful for me.

"One of these days", I think the expression goes, I'll set up Xen so that I can play with fire too. From behind a blast screen.

]]> by: Jimmy http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-360 Wed, 29 Nov 2006 10:15:25 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-360 I had a similar issue with some adware a while ago, in the end I managed to track down a tool called <a href="http://download.bleepingcomputer.com/spyware/KillBox.zip" rel="nofollow">KillBox</a>. It is an application that allows you to delete files that are in use. This was the only way I could get rid of the offending dll. Regarding Bart PE, I have found the <a href="http://www.ubcd4win.com/" rel="nofollow">Ultimate Boot CD For Windows</a> to be very useful. It is a tool for building a Windows XP Boot CD that has a lot of useful tools on it, including a registry editory. Mind you both of these tools aren't for the layman or faint of heart. I refuse to give Killbox (or recommend it) to anyone who is going to cause more damage than the adware with it. James I had a similar issue with some adware a while ago, in the end I managed to track down a tool called KillBox. It is an application that allows you to delete files that are in use. This was the only way I could get rid of the offending dll.

Regarding Bart PE, I have found the Ultimate Boot CD For Windows to be very useful. It is a tool for building a Windows XP Boot CD that has a lot of useful tools on it, including a registry editory.

Mind you both of these tools aren't for the layman or faint of heart. I refuse to give Killbox (or recommend it) to anyone who is going to cause more damage than the adware with it.

James

]]> by: onya http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-359 Tue, 28 Nov 2006 23:20:47 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-359 my favourite trick with malware files that just won't go away is to blank out the ntfs permissions and leave them in place till the system is otherwise clean then take ownership and delete. my favourite trick with malware files that just won't go away is to blank out the ntfs permissions and leave them in place till the system is otherwise clean then take ownership and delete.

]]> by: Mighty http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-356 Tue, 28 Nov 2006 15:02:54 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-356 Suggestion to MrWorf and others. When I'm trolling "free" software/screensaver/theme/etc sites I always make sure to do a Google search on the site name and "malware" before downloading anything. If a site carries bad software you'll almost always be able to figure it out by examining just the Google summaries, or by reading one or two page-one hits. Example: http://www.google.com/search?q=themexp+malware Suggestion to MrWorf and others. When I'm trolling "free" software/screensaver/theme/etc sites I always make sure to do a Google search on the site name and "malware" before downloading anything. If a site carries bad software you'll almost always be able to figure it out by examining just the Google summaries, or by reading one or two page-one hits.

Example: http://www.google.com/search?q=themexp+malware

]]> by: Daniel Rutter http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-352 Tue, 28 Nov 2006 01:21:03 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-352 Uh - yeah. I kinda, um, linked to my <a href="http://dansdata.blogsome.com/2006/11/08/file-lock-detective-work/" rel="nofollow">piece</a> about unlocking programs in the post. I use Unlocker too, now. It was perfectly useless against this adware :-). Uh - yeah. I kinda, um, linked to my piece about unlocking programs in the post.

I use Unlocker too, now. It was perfectly useless against this adware :-).

]]> by: trabpukcip http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-351 Tue, 28 Nov 2006 01:02:16 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-351 Oh and another way to remove crap from single drive computers (ie. not raid) is to rip the drive out of said computer, stick it in yum cha usb drive box of your choice and plug it into another computer (making sure the drive doesn't attempt an autorun by holding the shift key) and delete said annoying file. Oh and another way to remove crap from single drive computers (ie. not raid) is to rip the drive out of said computer, stick it in yum cha usb drive box of your choice and plug it into another computer (making sure the drive doesn't attempt an autorun by holding the shift key) and delete said annoying file.

]]> by: trabpukcip http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-350 Tue, 28 Nov 2006 00:50:40 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-350 A handy program that I always have running is Unlocker. It can get around programs that hold files in use *points finger to explorer.exe and that damn thumbnails thing*. You try to delete the offending file, normal in use message appears (even though say photoshop doesn't even have the damn file open) click ok as normal. After clicking ok unlocker will pop up a window identifying the process holding the file open, you can choose one of actions at the bottom (rename, delete, move) and/or then press unlock. The file will be released from memory, and you can delete as normal (if you didn't use one of the actions), no shutting down of offending program is required. If the file can't be unlocked then the program can delete immediately on reboot, before much of windows starts up. This little (freeware!) program has got me out of a pickle more than once, the best use is when avg and norton cleaned up most traces of a virus (not my computer), but could not clear a stupid dll that was hooked into every god damn process that was running so it could not be deleted. I installed unlocker (after clicking another 1000 detected virus screens from norton due to it running with every process). When unlocker was running I tried to delete the file (in use blah blah blah), then unlocker popped up with the scariest unlock screen I have ever seen (every running process including system idle!). I hit unlock all which of course required a reboot due to system files holding the virus file open and boom! on reboot pesky file gone! a small registry clean up later (symantec security response told me where to look) and I was done. Awesome little program for the grand cost of nothing. http://ccollomb.free.fr/unlocker/ A handy program that I always have running is Unlocker. It can get around programs that hold files in use *points finger to explorer.exe and that damn thumbnails thing*. You try to delete the offending file, normal in use message appears (even though say photoshop doesn't even have the damn file open) click ok as normal.

After clicking ok unlocker will pop up a window identifying the process holding the file open, you can choose one of actions at the bottom (rename, delete, move) and/or then press unlock.

The file will be released from memory, and you can delete as normal (if you didn't use one of the actions), no shutting down of offending program is required. If the file can't be unlocked then the program can delete immediately on reboot, before much of windows starts up.

This little (freeware!) program has got me out of a pickle more than once, the best use is when avg and norton cleaned up most traces of a virus (not my computer), but could not clear a stupid dll that was hooked into every god damn process that was running so it could not be deleted.

I installed unlocker (after clicking another 1000 detected virus screens from norton due to it running with every process). When unlocker was running I tried to delete the file (in use blah blah blah), then unlocker popped up with the scariest unlock screen I have ever seen (every running process including system idle!).

I hit unlock all which of course required a reboot due to system files holding the virus file open and boom! on reboot pesky file gone! a small registry clean up later (symantec security response told me where to look) and I was done.

Awesome little program for the grand cost of nothing.

http://ccollomb.free.fr/unlocker/

]]> by: Jax184 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-349 Mon, 27 Nov 2006 20:52:47 +0000 http://dansdata.blogsome.com/2006/11/25/my-adware-adventure/#comment-349 Deepfreeze is useful, but not quite in the way I meant. I'd like to be able to run a program when Things Go Wrong that simply stops any new programs from launching. This would greatly slow down the spreading of malware, and let me shut down parts of it without having them start back up again a half a second later. A few months ago I found myself in one of those delightful what-have-I-done positions, where any one of the 6 running tasks would restart any of the others if you were to shut one down. The solution I found was to launch several very processor intensive programs (Paint shop pro, emule, nero, trillian, etc) all at once in an attempt to tie up the CPU long enough to kill all 6 tasks. It worked, but I wouldn't count on it working with the next round of malware. Deepfreeze is useful, but not quite in the way I meant. I'd like to be able to run a program when Things Go Wrong that simply stops any new programs from launching. This would greatly slow down the spreading of malware, and let me shut down parts of it without having them start back up again a half a second later.

A few months ago I found myself in one of those delightful what-have-I-done positions, where any one of the 6 running tasks would restart any of the others if you were to shut one down. The solution I found was to launch several very processor intensive programs (Paint shop pro, emule, nero, trillian, etc) all at once in an attempt to tie up the CPU long enough to kill all 6 tasks. It worked, but I wouldn't count on it working with the next round of malware.

]]>