Adware, spyware -- How to stop this crap

vanity

[no nau]

My computer is infested with this crap and I can't get rid of it. None of the free services can solve the problem, and I might even pay for such a service, except that all of them seem to be just folks willingly to take advantage of you and charge you more money, and possibly infect you more. Has anyone here seen this? How should I and anyone else deal with this?

[airedale]

You get it anymore mostly from the sites you visit. They’ve gotten much better at it.

[Imperialist]

Put a NAT enabled hardware router/firewall (typical wireless broadband router), denying pings, between your computer and modem. Hooking a computer directly to a cable or dsl modem is risky if you are not prepared properly. That will not solve everything, but it should cut down a lot of the mal/spyware once you get your computer clean...

Google: remove smitfraud

There is an automated removal tool for smitfraud (spyaxe and similar)...

Hijackthis

AVG antivirus free edition

Windows Defender

AVG antispyware

[philetus]

I started using Ubuntu about three years ago.

“In that time, I have NEVER had a virus infection.
I’ve NEVER had a spyware infestation.
I’ve NEVER encountered a Trojan.
What is “adware”? NEVER seen any of it on my computers at home.
I visit wherever I want, download freely, open attachments freely - no worries here.
I run NO virus protection on my home computers - NOTHING. There’s simply no need for it.”

And I sometimes forget I’m running Linux.

[sten]

how about stop downloading porn viewers, installing cracked software and never run any attachments other then images.

and whatever you do, stop using internet explorer. use firefox.

also, get a hardware firewall.. it’ll keep the bad traffic off your machines. (netgear is top shelf... a good netgear firewall router wil run $40 at best buy)

[xone]

bttt

[L_Von_Mises]

I use Kaspersky Internet Security on my main workstation and have never ever had a virus, trojan or any spyware. I also use a combination of Nod32 antivirus and Agnitum Outpost firewall on all my other machines and have also never had a virus, trojan or any spyware on any of those machines.

I switched from Symantec when it became a resouce hog and was getting spyware all the time. Since I switched about four years ago I have not had any problems.

Both of these solutions have very little impact on performance and they both provide multiple updates per day.

All three of these apps can be purchased for multiple PCs for multiple years at a significant discount. Also, all offer a thirty day free trial.

[MarkL]

There are some cases where the computer simply has to be wiped and a fresh load of the OS installed.

Some important things though...

1) Be sure that you have a reasonably up-to-date copy of anti-virus and anti-malware programs to install BEFORE hooking the computer up to the Internet.

2) If you have multiple networked computers, and there’s even the slightest chance that they’re infected, be sure that they’re turned off BEFORE reloading the OS on the infected computer. If all of your networked computers are infected, leave them ALL off, and then bring them up 1 at a time, and get the computer you’re bringing up fully patched and have the AV and anti-malware software up to date BEFORE starting on any other computers.

3) Don’t even think of connecting to the Internet without a router/firewall. Tests have shown that an unsecured Windows system connected directly to the Internet generally lasts about 10 minutes or less before it starts getting hit by attacks.

There are free web sites devoted to analyzing HiJackThis reports, and if you haven’t checked those out, it would be a good idea to try. These are run by volunteers who will help you clean badly infected computers. But like I said, sometimes you run into a computer that’s just too badly compromised.

Mark

[MarkL]

Don’t forget JavaCoolSoftware’s “SpywareBlaster,” a free utility that will help keep your computer from being infected.

Mark

[MarkL]

You are inviting it in. Never open an attachment that you are not absolutely certain as to what it is. That means no cute crap that your relatives and friends send you. Never open it... period. Eventually they will quite sending it (usually because their computers have been killed by all of their crap).

The default for older versions of Outlook and Outlook Express was to have the preview pane active by default. By simply clicking on the message in order to delete it, you've already launched the embedded code and infected your computer. Other mail clients, like Thunderbird are safer. Or the latest, patched versions of Outlook and Outlook Express, configured WITH THE PREVIEW PANE SHUT OFF is relatively safe. Also, be sure that your anti-virus scans incoming (and outgoing) mail.

Mark

[MarkL]

I tried Bit Defender about 6 months ago and it found 25 virus’s that either McAfee put on my hard drive or they failed to find

It's possible that BitDefender simply found some virus infected files that McAfee had quarantined but was unable to "cure." They do that since there may be valuable data in the infected files, and it's possible that an eventual "cleaning method" could be developed in the future.

Mark

[Island Girl]

Worst Vacation Ever - I went to visit my daughter in college. Sent her to school with Detailed, Easy to Understand instructions on how to keep her computer happy. Was horrified to find how completely she had Crapified it. Pulled out my bag of tricks. Tried Trend Micro Housecall, took forever, Nada. Tried AVG, Nada. Downloaded avast! and Holy Mary Mother of God it worked! avast! can scan from the boot sector, where most of the serious baddies lurk. Finished up with SpyBot and Crap Cleaner. Ran everything three times. Success!

If I had had enough time, I would have preferred to reformat, but this saved her. Reformatting will have to wait for another “vacation.”

And yes, I did put her in Time Out, with a searing Mom Lecture...

[MarkL]

I’ve done it in an earlier post, but it would be worth adding to your list of valuable software:

http://www.javacoolsoftware.com - Get SpywareBlaster.

It will help protect your computer from infections, but if you use the free version, you will need to do the updates manually. No big deal, just remember to do them.

Mark

[MarkL]

OpenBSD is the answer to that,

OpenBSD is pretty secure, right out of the box, but it's NOT for everyone... In fact, somewhere around here, I still have my mad-cow t-shirt! Mark

[Titan Magroyne]

bfl

[MarkL]

Also, if you don’t have a second clean HD preloaded with Windows, you can alway use a boot disk, like BART PE. Bart can be configured to run Spybot, McAfee Stinger, or Ad Aware without having to boot to the OS of your affected HD.

Stinger has NEVER been a fully-featured virus scan. It just scans for certain infections, depending on the version. And the last version I saw on their site was WAY out of date. And the config files on the BartPE config are also WAY OUT OF DATE, and I must have spent about 6 hours trying to get a number of different AV programs to work, none of which would.

Mark

[FreedomCalls]

He has had an exceptionally good relationship with AVG an anti virus company. You can check it out at his website [SPAM link deleted] and purchase it through him, which I highly reccomend

AVG is free. Why would you recommend someone BUY it from your friend?

[MarkL]

Formating a drive is not practical for most people.

In some cases, the infections can be so bad that it will take longer to wipe the disk and reinstall the OS than to completely clean it, and then there's the little thought that just maybe if it was that badly compromised, you might not have gotten it all. The rule for C2 security is that once the trusted computer base has been compromised, you're done: The only way to trust the computer again is to wipe it and start all over. Of course most people never need that level of security.

Mark

[FreedomCalls]

I have no idea how I got the trojans; when they appeared, I had downloaded nothing for several days.

There were a bunch of trojans that came in via Javascript links in web ads in late December and January. Just visiting a web site that hosted an infected ad was enough to get you infected. You didn't even have to click on the ad, it auto loaded the malware via Javascript when you visited the page. Disabling Javascript and blocking any and all ad links is the recommended course of action.

[gungadin]

Lots of good advice here. I find that a-squared is a brilliant anti (virus, trojan, spyware etc) tool.

To check for rootkits, AVG's free checker is good value. This appears to be also incorporated into their Internet Security Suite.

[dennisw]

Avira does it all (adware malware viruses) for me and is free
I also use zone alarm
I also use a router which has a hardware firewall
Also use windows defender
All the above for XP

For Vista I omit Zone Alarm and use Vista firewall due to conflicts.... on my machine at least

http://www.google.com/search?sourceid=navclient&ie=UTF-8&rlz=1T4GGIH_enUS259US259&q=Avira