Need Help regarding CleverIEhooker

Today | Me

[Rodney King]

About every other weekend I go over to my father-in-laws house to help him with his computer because it has slowed to a crawl and pop-ups are all over th place. Every time its the same thing: He has downloaded endless amounts of files, and his computer is loaded with spyware, trojans, you name it. I run adaware, and spybot and all sorts of stuff and clean it all out.

Only this time I have a problem: Whenever internet explorer is opened, another IE window opens with an ad. I can't seem to find the source of this. Does anyone have any ideas?

[Dan(9698)]

Bump

[IamConservative]

HiJack This is the best tool I have found for finding the more elusive of these nasty things. Once you run HiJack This, there are a number of websites you can send you results to and get advice. Spypatrol I think is one of the more popular sites.

These things make me furious. My family usually leaves when we get one of these.

[Rodney King]

cool, thanks.

[azhenfud]

You're right - I should not have included Windows 2000.

[Xenalyte]

Back up in yo ass wit da Resurrection!

[Old Professer]

bump for later

[Mo1]

Thanks .. but that didn't work .. it came back

[First_Salute]

Follow those steps in that reply, above, about dis-abling and en-abling System Restore: "dis-able System Restore before cleaning the system, then re-enable it after the system is clean."

Create a couple extra user accounts that have full administrative powers. Restart on one of those accounts.

Repeat the the cleaning steps, including the dis-abling and re-enabling of System Restore.

Use the computer for a while in order to see if the problme has persisted --- probably not. Then, restart on your perferred user account if you wish, though you might now prefer to continue operations by way of one of the new user accounts.

Then install ZoneAlarm Pro. You can purchase it online, here:

http://www.zonelabs.com/store/content/catalog/products/sku_list_zap.jsp;jsessionid=AYisWylvMio6aWkfVZ5Do1CVJcpzlpRnT3NF3Af9F2qAggicbm7u!1965445848!-1062696905!7551!7552!1463396273!-1062696904!7551!7552?lid=zasskulist_pronav

Use the default settings; during the setup, err on the side of automation and do not fret.

[First_Salute]

Also, this:

http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q263/4/55.ASP&NoWebContent=1

[Musket]

"CWShredder"

I've heard this one is good. But I have a question: how is this thing being spread? I've been surfing on an XP box for over a year now and I've not picked it up. Is there a particular type of site that is spreading this crapware?

[First_Salute]

System Restore FAQ:

http://www.microsoft.com/windows2000/community/centers/management/sysrestore_faq.mspx

[azhenfud]

Oh, you've also gotta clean all the temp files from the "temporary internet files" folder. Then you can disable Auto-Restore, reboot, and clean the system. < said thumping self on head >

[jim_trent]

Donh't feel bad. I just tried it too and it didn't work for me, either.

[chainsaw]

Mol, if you are running XP disable your registry before deleting, then delete and reboot. After rebooting enable your registry again. Presto it won't come back. Much better than formatting the hard drive. You won't lose all your information this way.

I think what is happening is your registry is restoring what you deleted.

[Mo1]

Thanks .. I'll give it a try

[First_Salute]

Some pages with tips:

http://forums.tomcoyote.com/index.php?showtopic=10121

http://www.spywareinfo.com/articles/hijacked/prevent.php

The Microsoft System Restore FAQ (for Windows 2000 and XP) in reply 52, above.

Using ZoneAlarm Pro, mentioned in reply 50, above.

In general, don't use Microsoft Internet Explorer except for downloading the Microsoft Windows Updates. Use Netscape or some other browser.

Finally, have at least two other user accounts that are administrative, so that you can start up into one of them.

[IamConservative]

My kids seems to pick it up on sites where they are offering "Free Games". Trust me they are not free, you pay with your privacy, but the allure to kids for free games is irresistible.

[Mo1]

Just wanted to thank you all for all your help

My brain turned to mush, so I had my hubby pick up with all your advice.

Looks like he may have fixed it .. cross your fingers

I wish I could explain as to what he did .. but all this computer speak is greek to me.

Maybe someone can put it into english

Any how .. he took all you advice and suggestions .. plus he also had to seek out a file/folder/whatever called TV Media/TVM.Exe

he found 3 that were causing problems

TVMSYS.EXE
TVM_BS.EXE
Yes-TVM.EXE

He said he changed the .EXE to .OLD then did a reboot and then deleted them

I hope that made some sense .. Like I said - I have not a clue on what he said or did ... but it worked

[IamConservative]

Yeah!! These things are NASTY..

They do live on your drive under different names on your disk than they instantiate themselves in memory. Sneaky.

I have seen registry entries set as read only that cannot be deleted.

Malware is appropriate. I fear it will ruin the freedom of the web.