Tenacious Spyware Problem (Vanity)

6/16/04 | Me, Myself, and I

[Born Conservative]

Please excuse the vanity (this is my first vanity post). I am having a problem with spyware. It started when my 11 year old son installed a "really cool" screensaver on the computer (running XP Home) from "screensaver.com". As soon as he told me he did that, I knew that I was up the creek without a paddle. So, I ran Spybot, and then Ad Aware, and "fixed" my Spyware problems. Right. Needless to say, my computer is still infested.

I then did some searching on the web,and downloaded Hijack This, since my browser was hijacked to a different home page (msn.com). Since I wasn't sure which programs were spyware, and which were not, I haven't "fixed" them with Hijack This yet. I also downloaded Aluria's free spyware scanner, and it shows 17 spyware files. The files include Wild Tangent, IWon, Cydoor, 2020Search, Comet Cursor, WhenUSave, and MyWay Speedbar. I did re-run the SpyBot and AdAware, as well as CWShredder (run in Safe Mode), but the spyware persists. I am also up to date on all Windows updates. Any help would be appreciated. I do have a log file from the Hijack This if that would help.

[Old Professer]

I am pinging this open because I have been days trying to eliminate belt.exe and its associated files and decided tonight to manually delete them per Symantec's instructions; when I opened the hidden files I saw that belt.exe had been last modified 8/13/2003; the only thing is, I bought this cpu new 02/12/2004.

In other words, either CompUSA sold me a refurbished computer without wiping the drive or COMPAQ pre-installed a trojan adware pgm.

Anybody have any ideas about this before I yell at CompUSA?

[Old Professer]

I am pinging this open because I have been days trying to eliminate belt.exe and its associated files and decided tonight to manually delete them per Symantec's instructions; when I opened the hidden files I saw that belt.exe had been last modified 8/13/2003; the only thing is, I bought this cpu new 02/12/2004.

In other words, either CompUSA sold me a refurbished computer without wiping the drive or COMPAQ pre-installed a trojan adware pgm.

Anybody have any ideas about this before I yell at CompUSA?

[Tax Government]

Consider these...
CyberPatrol -- blocks undesirable sites ($39/year)
SpyBot (free)
Ad-Aware (free)
Norton or McAFee Anti-Virus (~$40/yr)

[Freemeorkillme]

Belt.exe and how to fix it.

http://computercops.biz/postt7729.html

[Souled_Out]

"System Restore to an earlier time."

Agreed, just restore to a time previous to your son using the computer.

That is the easiest and safest way to get your computer back.

[Malsua]

The only reason I'm pinging you is that I've participated in any number of spyware threads and updated my FR homepage to include and bloviate about my spyware prowess :)

I do this spyware thing daily, and have updated my homepage here on FR to reflect it.

-Mal