Articles

Free spyware removal program?

July 24, 2005 at 21:41:13
Specs: Windows 98, Intel Pentium, 32 MB RAM

Just tonight as I was surfing the internet, my computer began to make weird buzzing sounds every few seconds for no reason. Then I got out of Internet Explorer and saw that my wallpaper was gone and it was replaced by some kind of ad, warning me about spyware and to get the latest spyware removal program, which was only a trial to download. When I went to change my background back, I found out in the desktop Properties menu, I no longer had the Backgrond option, so I'm stuck with the ad now O.o

I've tried numerous programs to remove both adware and spyware, all of them claiming to locate and remove all infected files for free, when all they really did was take 4 hours to find the corrupted files and then tell me I would need to buy the full version to remove these files.

Do any of you know where I can download a completely free adware and/or spyware program? I believe that, wherever this ad came from, it must have added more spyware to my computer.

I'd appreciate any help on this....because this buzzing is really getting to me XD


See More: Free spyware removal program?

Report •


#1
July 24, 2005 at 21:52:09


Report •

#2
July 24, 2005 at 21:52:47

Where have you been the past few years?

Two of the most widely used applications are the freeware Ad-aware & Spybot - links at the top of the forum page.

HiJackThis! can also be effective, but requires an interpretation of the resulting logfile

No one app is guaranteed to detect or remove everything, and the malware authors are increasingly devious, but those would be an excellent starting point.

The 'hijacked wallpaper' you are describing may require a determined effort to repair though

Computers in the future may have only 1,000 vacuum tubes and perhaps only weigh 1 1/2 tons.


- Popular Mechanics, 1949


Report •

#3
July 25, 2005 at 01:33:22

ScreenShots of CWS Desktop Scareware Take Overs
http://webhelper4u.com/CWS/index.html

Expert hijackthis log readers found below.

Getting Help w/ Spyware:

Hijack prevention tips


Report •

Related Solutions

#4
July 25, 2005 at 14:53:29

For the future, always check with this website (or a website you trust) before downloading anything that purports to fix malware/spyware. Most of these are malware/spyware themselves. The ones given above are fine of-course.

If all else fails try this freebie trojan finder/fixer too:
A2FREE - JUST DOWN PAGE

DerekW


Report •

#5
July 25, 2005 at 22:26:34

I downloaded Spyware Search and Destroy tonight and I had it running, but it only found one corrupted file, something called "BDE Projector", and I got rid of it. I'm basing this wholly on instinct, but I am assuming that Spybot Search and Destroy only seeks out and removes Spyware? X3

I know at one point I scanned my system for corrupted files, and almost all of them were Adware. I am moments away from downloading the Ad-Aware program, in hopes that it will help me out, because my computer has gone back to an old annoying habit of blinking the screen and exiting out of Internet Explorer.

I thank you guys for taking the time to reply and offering me your advice ^-^


Report •

#6
July 25, 2005 at 22:37:34

Spybot will search for known malware (spyware and adware). It'd be good to run both spybot and adaware. Generally they both will find the same things but sometimes one will catch something the other doesn't.

Check for online updates before running them.

With adaware you can run a thorough scan which will search for known files even if they're not in use.


Report •

#7
July 25, 2005 at 22:40:43

BDE Projector (Brilliant Digital Entertainment) is one of the 'goodies' you could get along with Kazaa - well worth getting rid of.

Yes - Spybot & Ad-aware are used to remove adware, spyware, browser hijackers - that sort of thing, although some trojans are associated with certain adware infestations and may also be identified and removed.

For best results the applications should be updated to the latest definitions, as there are new threats all of the time.

While those two are quite good, there are so very many kinds of malware that you may require a specific tool or procedure to identify and repair a particular problem.

Quite a bit can be determined by checking msconfig, or running a HiJackThis! scan (and analysis)

The Windows System File Checker (SFC) can identify and replace corrupted files, but unless you regularly use it (and are familiar with its quirks), you shouldn't replace everything that it declares 'corrupt'

Computers in the future may have only 1,000 vacuum tubes and perhaps only weigh 1 1/2 tons.


- Popular Mechanics, 1949


Report •

#8
July 26, 2005 at 22:15:03

I downloaded and ran Ad-Aware today, but I am not sure if the process of removing the corrupted files was completed or not. The full system scan took roughly 20 minutes, and more than 1400 files were found (which I know isn't a lot) that were corrupt; apparently Ad-Aware caught a whole bunch of files that SpyBot had missed O.o. I asked to quarantine and delete all these files, and I waited until both processes were finished...at least, according to those progress bars that popped up.

Was some kind of window supposed to open up after removing the files telling me that the removal process had been completed successfully? I only ask this because I know how tempermental my computer can be. Also, even after the files were allegedly removed, none of the buttons on the screen (Quarantine, Show Logfile, Next, Add-ons, Status, Scan Now, etc.) could be clicked, except the Help button. I checked the program's response many times by pressing Ctrl+Alt+Delete and bringing up that menu, but the program was functioning at all times.

So far today, I've run Ad-Aware 3 times, and I can't get past that menu screen that lists the critical files and negligible files - it's just stuck there. If I pick one particular file and attempt to quarantine it alone, the program will begin to quarantine all the files. I did this even after removing the files once, and it still claimed to have deleted the same number of corrupted files as before.

I think Ad-Aware is a bit too advanced for my crappy system. Is it possible that there are too many files to remove? Is it also possible that some malware is causing Ad-Aware to malfunction?

My uncle uses a program that, I believe, is called NoAdware. I don't know anything about this program. Have you guys heard of it? If so, is it worth trying to find, download, and put to use?

*sighs* At the very least, I cured my computer's annoying little problem of blinking the screen and closing all internet windows - I restored a registry from February (it isn't the most recent, but it's the only one without errors).

Once again, I thank you for your help, and ...Word to the Wise, I will try and find the program, HiJackThis!, that you suggested. Also, I'm assuming that to check under msconfig, I would go into the Start Menu and go to Run?

I know these are all stupid questions, but my computer just seems to be in a perpetual state of intense PMS.



Report •

#9
July 26, 2005 at 22:40:41

With adaware I've noticed the quarantining and deletion can take quite awhile when a large number of files are found. But when the progress bars are gone it should be done.

After it does the scan and shows the scanning results, you can click on the 'scan summary' tab and it'll list the malware by type. If you check just one of those to remove, the process should be quicker. Then you could run adaware again and delete another. (I'm using version 1.05 and you probably used 1.06 but I imagine their display screens are the same.)


Report •

#10
July 27, 2005 at 07:25:15

Were you joking?:
"more than 1400 files were found (which I know isn't a lot)".

That is a heck of a lot. One would hope for none or maybe the odd one or two (excluding cookies).

Ad-Aware will run on the most basic machine but I agree that there are some nasties that can deliberately disrupt spyware/malware finders.

Best to check any anti-malware programs with this website:
ROGUE ANTI-MALWARE PROGRAMS

DerekW


Report •

#11
July 27, 2005 at 10:10:57

What's up with that homepage??? Is that a deliberate (if not peculiar) choice?

"Corrupted files"? Not really what Ad-aware does. If the scans are taking an excessive amount of time, it may be expedient to delete any temporary internet files first - those are often infected, and since they are 'temporary', don't really need to be scanned

"NoAdware" - plenty of knockoffs and imitators to suck in the unwary and ill informed. Some are useless or worse, most try to 'encourage' you to buy their product.

Computers in the future may have only 1,000 vacuum tubes and perhaps only weigh 1 1/2 tons.


- Popular Mechanics, 1949


Report •

#12
July 27, 2005 at 22:04:11

I noticed that also, ...Word to the Wise, about the homepage link. I never type anything in for that and I just visited the link after reading your post. *sighs* I have a good feeling that something is putting that in automatically...everyone, please disregard my homepage link. O.O

One more question I have to ask you guys...have any of you ever heard of a spyware removal program called PSGuard? Honestly, I don't believe it's a genuine program; the night that my wallpaper changed to the advertisement asking me to download a spyware removal program, PSGuard installed by itself and will open by itself at random. According to my computer search, it's in Program Files, but the folder is not there. I'm guessing that this program is spyware itself?

Once again, I thank everyone for their advice. I really appreciate your help, you guys. Thank you for taking the time to help out a computer novice.



Report •

#13
July 27, 2005 at 22:28:11

You're not the only one - there have been a number of those porno homepage links appearing here lately - the webmaster is now blocking any new occurrences.

It seems to me that you have a compromised machine - PSGuard is 'scareware' and is trying to panic you into purchasing their (dubious) product. It's often associated with the dreaded Smitfraud trojan, which installs a variety of applications and changes (semi permanently) your desktop wallpaper.

It would probably be a good idea for you to download and run HiJackThis! in order to get a better idea of what's going on. That 'homepage link' insertion is something of a new one

Once you have the log, copy and paste it back here for inspection.

Computers in the future may have only 1,000 vacuum tubes and perhaps only weigh 1 1/2 tons.


- Popular Mechanics, 1949


Report •

#14
July 27, 2005 at 22:50:47

Oh - and a couple of things:

my username here is 'jboy' (although maybe I'll change it) - 'word to the wise' is just the joking title for that terrifying link I include in my messages ; )

Just visiting those 'porno homepages' could very well infect a machine running Internet Explorer in 'drive-by' fashion. Seriously.

Computers in the future may have only 1,000 vacuum tubes and perhaps only weigh 1 1/2 tons.


- Popular Mechanics, 1949


Report •

#15
August 21, 2005 at 19:18:21

Hi, This is a post after this post has been closed for some time. I just recently got the same irratating bug on my PC, I did however manage to get rid of it. (I think)The program that it is, changes the registry values and seems to save its infected settings over several backups. I lost windows and reinstalled. but guess what? It was still there. it basically consists of several componants.
When Trojan.Desktophijack.C is executed, it performs the following actions:

Creates the following files:

%System%\intell32.exe (A component of Trojan.Desktophijack.C)
%System%\oleext.dll (A component of Trojan.Desktophijack.C)
%System%\oleext32.dll (A copy of wininet.dll that is infected with W32.Desktophijack)
%System%\wppp.html (A component of Trojan.Desktophijack.C)
%Windir%\uninstIU.exe (Trojan.Desktophijack.B)
Also a GIF, the image you see on your screen. It works with the HTML file.
It was found in System also.
Adds the value:

"intell32.exe" = "%System%\intell32.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run

so that it runs every time Windows starts.


Creates the following registry subkeys:

HKEY_CLASSES_ROOT\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Update


Modifies the value:

"Background" = "0 0 0"

in the registry subkey:

HKEY_CURRENT_USER\Control Panel\Colors

to modify the desktop background color.


Modifies the value:

"NoActiveDesktopChanges" = "1"

in the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer


Adds the values:

"WallpaperStyle" = "0"
"Wallpaper" = "%SystemRoot%\%System%\wppp.html"

to the registry subkey:

HKEY_CURRENT_USER\Control Panel\Desktop

to modify the desktop wallpaper.


Adds the values:

"NoDispBackgroundPage" = "1"
"NoDispAppearancePage" = "1"

to the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

to modify the desktop wallpaper.


Displays the following desktop wallpaper:

Warning!
Your computer might be infected with spyware
or adware !!!

Strange homepage, popups, loss of important data and unstable
functioning are the sure signs that you are infected.

Click here to get the
latest spyware removal
software.

Note* Be very careful anytime changing your registry but in my case it was either throw the pc out the window or investigate and work in the registry.

I have AVG, and Spybot and this program uninstalls your explorer upgrades, leaving you wide open for more invasion. It modifies your programs and multiplies everytime explorer page is opened.
I used RegCleaner, to find the files and change the registry, because msconfig had been changed to not show edit command.
I used RegRun in a free 30 day trail and Spybot. All found only the tracer files. But not the reason they kept coming back with every delete, reboot or explorer opening. I deleted and changed everything above in registry and files but could not remove the oleext.dll file. So I rebooted into DOS and took intell32 and PSGuard out of the started menu for the umpteenth time. AFTER doing search in registry for any ref to oleext.dll. It came up with 12 to 15 places. inside AVG, Spybot ect. everywhere I needed to go. I clicked delete on all, Then booted into DOS and deleted the oleext.dll through DOS as all its connections were windows based. Path is C:/windows/system/
then type delete oleext.dll
I am saying only because I am reminded many ppl do not use DOS and do not know the commands.
This was 24 hours of work on a pC. My modem speed was compromised immensly, downloads were at 1.34kb per second. (I am on Dial up but reg is 5-6kb)This thing was very malicious.
PS. Very, very little was found on the web, House Call and AVG don't show it in definitions as many others I looked at did not either. This must be fairly recent. Norton does show the Registry Values that needed changed but left out the things that keep it from returning.
I hope this helps and gives you a chance at having fun on the web again.


I'm learning but figure thats a lifetime mission


Report •


Ask Question