Spyware Help, Please....

Demiurge

Ok guys...this one is tricky. My fiance was using my computer the other night before she went back to school and the next morning I was having all of these spyware problems. She was doing some reasearch for her veterinary medicine course at her college and she must have inadvertently gotten this crap installed on my computer.

I use Spybot S&D, but that didn't fix this particular problem at all.

It seems to have nullified ALL of my search engines. In other words if I type something into it all I get is a generic page from whatever search engine i'm using to the companies that they allow advertise on their seach engines, like the 2020 Toolbar and crap.


Not having a search engine is a PROBLEM. I wouldn't be posting this here if I could get to a computer help message board, but since I can't search it i'm out of luck. A lot of you guys are pretty savy with the programs and stuff...so i'm hoping you guys can help. I only build computers.

Here is the picture:




As you can see it highlights targetwords. What determines what gets highlighted, must be something in the spyware. As you can see it highlighted MUSIC and CAR on this forum. I had the cursor over music and notice how it links to a search engine? How the heck to I get rid of this crap so I can use my old search engines and stop getting all of these annoying highlights? It also creates a bunch of pop-ups, but since I use the google popup blocker all is well with that.

Any help would be VERY MUCH appreciated. Thanks guys.

AsSiMiLaTeD

What OS/browser versions you running?

I assumed you already tried the add remove programs bit in the control panel???

Demiurge

Originally posted by Polkmaniac
What OS/browser versions you running?

I assumed you already tried the add remove programs bit in the control panel???

Yeah, I tried that. I run Windows XP Professional.

steveinaz

Try "Adaware" brother, its free.

PhantomOG

i think the program that highlights and links words on all pages is called "top text" or something like that.

AsSiMiLaTeD

Originally posted by Demiurge
Yeah, I tried that. I run Windows XP Professional.

Then I'll assume you've deleted all your temp internet files and stuf as well...

On the Internet properties box where you deleted the temp files, there's a link to Settings, you need to get in there...

There will be several choices and then a few buttons, you should have one says something like View Folder, click on that and delete all that stuff...then there will be another one for View Objects, check that one out and see what you have there...

You'll have you java apz and stuff like that there, but I'm also thinking that's where this little program you have is...see if you've got something there that doesn't look right...

You also might trashing your cookies as well 'cause it may be there...

Now, you'll need a good spyware killer program thing...here's a couple I've found for you...you can actually remove it manually in the registry, but you have to know what you're looking for and not f*** anything up...so I'd just check one of these programs...I've never used these so use at your own risk...

http://www.spykiller.com/index3.asp?ref=2401&engine=adwords!1167&keyword=%28spyware%29

http://www.freespywarescan.org/google2-spyware/index.html

Try that stuff and report back...

dylan

This article indicates that Ad-Aware did the trick. You can see the targetwords.com url towards the bottom of your screen shot. Ad-Aware is great, great software and the price is right.

You can get it here: Ad-Aware

Make sure to update it before scanning, by clicking on the globe icon towards the top right before scanning.

Jstas

Spybot S&D requires regular definitions updates as well as programs like AdAware. If you look for it in Spybot, there is an update setting. I don't remember exactly where it is but the Spybot guy makes regular updates almost bimonthly at times.

Demiurge

Now...it appears Ad-Aware worked for getting rid of the targetwords...so that's awesome, but i'm still having search engine issues.

When I try to search the search runs SOOOOOO slow....then when something finally pops up this is what I get:




If I click on the #s that google dispays on the bottom is DOES go to the search results, but it takes for ever to bring up the first batch of crap that I don't even want. I have no idea how to solve this problem.

Jstas

Stop using IE. Install Mozilla. Problems solved.


Seriously, I'm not trying to be a jerk. Mozilla seems relativly unaffected by this kind of BS. Part of teh problem with IE is that it is so tightly integrated into the Windows operating system. It has security issues that Microsoft tries to patch but people always find new ways to exploit IE. Since it is so tighly connected to Windows, even a security issue that is totally unrelated to IE can end up affecting it.

Demiurge

Yeah, I tried Mozilla before, it's better, but it doesn't recognize a lot of the message boards I go to.

dylan

Unless I missed it, is XP hiding your antivirus icon in the systray? What are you running for that? It sounds more browser related, just curious.

This page has a tool called cwshredder that I've used successfully for certain hijacks (CoolWebSearch based). If you run this program, I would be curious what it finds under the Browser Helper Objects section, about 1/3rd of the way down the list after it runs.

nadams

jstas- not to nit-pick or anything, but FYI bimonthly is every two months. I think you were meaning semimonthly, which is twice a month. Still, that's not very often. Ad-Aware is updated more frequently than that.

Demiurge

Originally posted by dylan
Unless I missed it, is XP hiding your antivirus icon in the systray? What are you running for that? It sounds more browser related, just curious.

This page has a tool called cwshredder that I've used successfully for certain hijacks (CoolWebSearch based). If you run this program, I would be curious what it finds under the Browser Helper Objects section, about 1/3rd of the way down the list after it runs.

Heres what I got:



I just blacked out what looked like important serial #'s

and I just deleted NAV 2003 and am buying 2004 this weekend.

I gotta run to the store real quick. I'll be back in awhile....all the help is appreciated!!!!

dylan

The dealhlpr.dll file reeks to me... any site that has this sounds goofy:
"DealHelper's Reactive Marketing Technology (RMT) enables advertisers to contextually target potential customers when they express an interest in a particular category that matches your product - INSTANTLY."

What about renaming that dll and rebooting? We might have to do some unregistering of dll's later, but the renaming should be the safest way now. First, check under Start/ Run/ msconfig/ and check the startup tab. Let's see what looks suspicious in there.

Can you leave 2003 on until you have 2004 handy? There's a lot of crap floating around right now.

Jstas

Originally posted by nadams
jstas- not to nit-pick or anything, but FYI bimonthly is every two months. I think you were meaning semimonthly, which is twice a month. Still, that's not very often. Ad-Aware is updated more frequently than that.

Eh, same difference!

Twice a month may seem like nothing when you think about it but once you realize that it is this dude in like Europe who did all the programming himself and relies upon donations to keep the site up and running in his spare time, twice a month is pretty impressive to keep up the work and wage the anti-spam/anti-virus war without profit.

nadams

I wasn't trying to downplay anyone's work. I merely wanted to point out that you can get updates more often, for the same price, for free.

fireshoes

I have ad-aware and spybot. My problem is lately when I run spybot it closes right away, without running. I tired uninstalling and reinstalling but same results. Any ideas?

Demiurge

I'm appreciating all the help guys. I'm at work right now so things are good here....I still need to figure out what happened to my search engines.

Would it be possible to uninstall IE and then re-install it?

steveinaz

I doubt that will help. These entries are more than likely in seperate keys in the Registry. Try searching for them in Regedit and deleting the offending entries. back-up first of course.

dylan

I agree on both counts with Steve, the updated version would still probably use those "helper" objects. Backing up via a Restore Point has worked well for me, under Start/ Programs/ Accessories/ System Tools/ System Restore. This copies the registry to another part of the HD.

The Hijack This! program should show the offending files, but it shows everything so would need to be combed through thoroughly for legit stuff. Take a screen shot or save the log of that, and let's see what it shows.

Information like this shows pop-up blockers are convenient, but they may be hiding the root cause of the pop-ups, like local programs generating them.

BTW: Those blacked out numbers won't mean much to us humans, they're ID numbers in the registry.

Demiurge

Thanks for all your help Dylan...This is a big picture...sorry...I have a 21" monitor and I wanted to get them all in one shot:

steveinaz

Look specifically at the "run" commands, if you see something that looks bogus, suspect it as a problem.

What happens when you CTRL-ALT-DEL and look at Task Manager>Processes? Do you have some flaky processes running? If so, end them and then go into IE and see if the problem is solved, you can always recover by simply rebooting the system....

this is frustrating, if I was sitting at your PC I would have this fixed in 15 mins....

Demiurge

Originally posted by steveinaz
Look specifically at the "run" commands, if you see something that looks bogus, suspect it as a problem.

What happens when you CTRL-ALT-DEL and look at Task Manager>Processes? Do you have some flaky processes running? If so, end them and then go into IE and see if the problem is solved, you can always recover by simply rebooting the system....

this is frustrating, if I was sitting at your PC I would have this fixed in 15 mins....

I know man....I appreciate all your help!!! I owe you all beer!!!

I'll hit that suggestion up a little later. I gotta finish some work real quick.

This means a lot though. I'm learning too!