Spyware

MadPatrick

I work in a small removals company and the boss turned up one day with a laptop and announced that we're going online. Great, I thought, coz I didn't have regular internet since my college days.

The monkey decided to go online without any protection and of course picked up more viruses than<Insert random name here>.

I dealt with all of them except for some very sticky spyware. Which can only be detected by Spybot - Search ands Destroy, and not Norton which we now have or Adaware. Spybot can't get rid of 4 problems because they are being used by memory. Every couple of days I run an Adaware search and it detects and fixes new spywares which means that the ones I can't get rid of creating the new ones. I tried running Spybot in safe mode which didn't help. I'm out of ideas. If it helps there are 2 folders, 1 called n-case which has 2 subfolders called:
HKEY_USERS\S-1-5-18\Software\Salm and HKEY_USERS\DEFAULT\Software\salm.
The other folder is DyFuCa.InternetOptimizer, which has 2 subfolders called HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt and HKEY_USERS\DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt.
I'm not sure if Folder is the right word but it's the closest one I can think of. Thanks in advance for any help you can give me

conor-mr2

adware_180search and adware_netoptimizer. thats the two I reckon.

http://sarc.com/avcenter/venc/data/adware.180search.html
http://securityresponse.symantec.com/avcenter/venc/data/adware.netoptimizer.html

HTH

MadPatrick

Wow, thanks so much. The 180search worked a charm. The other didn't find anything but it's half my problem gone. I wonder if you'd find it too much bother to give another opinion of what it is.
My boss wants me to set up internet banking but I don't think it's a super idea while there's spyware on the computer. Thanks again.

conor-mr2

When you ran spybot did it tell you what is running in memory?
If so could you post the results here?


It could be something other than Netoptimizer that is causing your problems.
When netoptimizer gets on your system it usually consists of two files.
c:\program files\Internet Optimizer\optimize.exe
c:\windows\nem220.dll

along with those registry keys (and lots more keys) that you got in your Spybot results previously posted.

irldavem

Uh oh! I smell a banning coming.

conor-mr2

irldavem wrote:

Uh oh! I smell a banning coming.

I dont understand.
why?


/edit

Ok so MAYBE this should have gone into Windows forum.

Mac daddy

yes he is correct should have been in the windows forum this is for discussing exploits and so on read the charter for more info before posting ecksor hasn't been around much lately so you might not banned just yet.....

malware problems = windows wich means Windows Forums.

Security/exploit discussions = Security Forum

ecksor

I'm about, but when dogs tried to clean up the forum by getting rid of all this crud he just got a load of grief over it. I'm not sure I can be arsed.

MadPatrick

The message that comes up says: "Some problems couldn't be fixed; the reason could be that the associated files are still in use(in memory).
This could be fixed after a restart.
May spybot S&D run on you next system startup?"
Of course the problems aren't fixed after a restart. Also, the files
c:\program files\Internet Optimizer\optimize.exe
c:\windows\nem220.dll
are nowhere to be found.

It's kinda scary that Norton and AD- aware totally missed these problems. The computer slows down a fair bit some times, which I know is a tell tale sign that there's spyware on your computer, especially when I have broadband. Thanks again for your help. I really appreciate it.
If this is in the wrong place I'm sorry. Feel free to move it to the windows forum. I swear I won't get cranky

puzzles

OK, cut the crap guys

spyware/adware and identity theft are security, people and O/S problems - and by the way they don't fall easily into any forum - they happen on OS's, and they have a human impact so get over the "what forum does it fall into" nonsense.

For spyware generally speaking adaware is fine but the more agressive/invasive stuff cannot be dealt with by a consumer program, as by definition these assume a "point and click" approach.

Coolwebsearch is a pain - I have seen experienced admins tearing their hair our over it..it got so bad that merijin.org sold the rights to cwshredder because it became his full time job - rather than his hobby.

It got taken on by intermute - http://www.intermute.com/spysubtract/cwshredder_download.html

but they toned down it's more "agressive" tendencies - i.e. not user friendly..and they therefore (while helping most users) created a knowledge gap where agressiveive spyware lives.

i.e. Not everyone who uses a computer is interested in the computer per se. they are more interested in it as a productivity tool or a gaming tool or whatever..

i.e. my dad could'nt give a toss about registry hives but he does care when he can't get his email cos his computer is burning cycles pumpimg out spam - not to mention the confusion and embarresment caused by the "did you just send me a viagra mail" nonsense..

Microsoft I think have "got" this concept now - a consumer tool thats a source of arguments with the wife is not a good idea. Neither is a computer that is too complex for my father to use a good idea - so the balance is going to have to be struck by consumer companies.

i.e. no expects their toaster to attack them, and when it does they will think twice about buying that brand of toaster.

That sort of leaves us, the computer literate, the OS39 fans, linux fans, Wintel fans and yes even VMS fans..

To realise we are "fans", "enthusiasts" even, and to pick an analogy from the consumer world -

Fords now come in any colour you like../


So if you can use your skills to help people while this gap between computing as a consumer product and as a potential hazard exists- then use 'em - its the closest most engineers ever get to charity

What really pisses me off about this is, gormless companies (you know who you are) charging people exhorbitant money to sort out a simple problem (caveat, simple to people who know what the problem is...) and charging people 1/2 the cost of the computer they bought in good faith, to "sort" it - its a disgrace.

I enjoy my job and share my skills where I can (when I can fit it in with what I get paid for) I will try and sort you out.

If you live in Bray you can reach me at rtfm@eircom.net - I don't even promise to reply but if you are a hard luck case, I will do my best.