Got hit...again

[Bruiser]

My computer is running really slow after all this Casino game crap showed up out of no where. I deleted all the stuff from the registry that I found, but something is still wrong. My Norton settins have the email scan as "Error" and my AutoProtect is turned off and will not turn on. The adware or something changed the settings and I cannot change them back to protect myself.

I did an adware scan and it turned up nothing. Same with the Norton scan.

[SLK001]

You have GOT to stop visiting all those porn sites!

[Pwyll]

Run a hijackthis report and post it at cexx.org in the spyware forum. Someone there will help if you need it.

[northcat_8]

Whooops....

You should turn off your anit-virus before using ad-aware. I think you are pretty much stuck with having to re-install Norton.

I do know casino adds you are talking about...question: how much shareware is on our PC? TMPGEnc Trial version? Bearshare or Kazaa free versions? There are tons of others but some shareware has pop-up adds like the casino adds.

I don't remember your firewall or if you even have one, but zone alarm has done a pretty good job for me. It seems to me that with all the cleaning you have done, that you have a program that runs and brings in adds or spyware just as fast as you remove them.

I would check your msconfig > startup tab for anything looking suspicious.

You might also want to try shutting down your anti-virus and scanning your PC at www.trendmicro.com, they have a free online virus scan and caught some viruses that Norton missed...back when I used Norton. It is free, but it has to download the scanning engine and the virus ID's into your temp folder which can take a while on a dialup, but I have found it so useful that I don't even have anti-virus on my PC anymore...not the smartest thing to do, I know, but I scan it at trend about once a week, I use a firewall and a router and I don't open email unless I know who sent it....I preview it on the server before I actually receive it to my HD and delete it before it gets to me.

I don't know if that will actually fix it, but I know what I had to go through when I was spyware riddled and I don't have those issues anymore. Now when I run ad-aware it finds about 13 files and they are almost always things like recent documents and sextracker cookies (which incidently are cookies sent by websites other than just pornsites too)

Damn spyware-ers....I hate em.

[Piccoro]

Know what would be a good change?
Run Mozilla or Mozilla Fire Fox instead of IE.
Built-in popup blocker too.

[arcorob]

Dumb question here but valid .....

If you have a broadband modem and run Mozilla instead of IExplorer, will that prevent alot of the MS bugs from allowing the barbarians through the gate ?

The answer is.....no.

Mozilla is just your window to the world as is IExplore. But the front door is still MS and with all those ports to defend, not to mention even the damn cable company pinging all the time

sheesh.....LOL

[vitualis]

Sure, but a lot of those hijack programs work through IE... for example, changing default IE settings like the homepage.

It doesn't happen with Mozilla or Firefox.

Best regards.

[Faustus]

Any specific Casino software this was?

Reason I ask is my mom plays some of them, for fun not money obviously, and she uses like 3 of 'em. I've not seen any just install without asking first.

Sure no one else has access to the machine?

[TBoneit]

The one I've seen here at work, is called "Golden Casino", it as a I recall, added tons of links in the favorites for gambling, shopping & porn. Hikacked home page, searches etc.

I do not know if it is any connection to the Golden Casino advertising on TV or if they are also hijacking that name to trick people into installing their hard to remove garbage.

Lots of luck cleaning it out, it can be done, just not easily.

Cheers

[redwudz]

Some of my 'favorites':
Bargain Buddy
n-case
VX2/I
VX2/H
Ie searchbar
Lycos Sidesearch
Golden Palace Casino
Blazefind
DyFuCA
Internet optimizer

These all downloaded at the same time and some didn't appear until a restart or two. You can't be sure your'e free of them until a few days go by. They can come back on their own.

Spybot S&D seems tol get rid of these, but only after you update it. You may have to go to the site as one of these programs blocks the autoupdate.

Some of these have uninstall, but I would run Spybot first as the uninstall may just load more crap. Norton did'nt detect any of these and was disabled by them.

These all came from a program that was run on the computer. You need to find that program and delete it. I got all my crap from a Kazaa download. (I should have known better.)

[Bruiser]

Not many popups, my Norton is still F'd up though.

[Faithful Follower]

Bruiser,

Do you have the memory scan test turned off when window boots to speed up the booting process? If so, enable it might solve your problem. Otherwise I can't give you anymore suggestions.

Similar incident happened to me awhile back, after blaming Norton and talking to their tech on the phone got the problem solved. What exactly really happened, I don't quite remember, its been a few years back...

[hech54]

Not many popups, my Norton is still F'd up though.

After reading this thread I decided to check my Norton Antivirus and sure enough it was disabled....I'm guessing by me running Ad-Aware also.
The status screen of Norton told me my e-mail was not protected yet the boxes in the setting window were checked.
I unchecked them and did a Windows re-start with Norton still open.
Opened Norton again and it showed me again that my e-mail was not protected...so I went and re-checked the boxes in the settings panel....again did a restart with Norton still open.
Opened Norton again it is showing all green...think it will stay that way?

[Rookie64]

Use this to scan your computer - http://www.noadware.net/

You can use Windows search to get rid of the files manually, if you don't want to pay for noadware...but use it to scan your hard drive.

Norton, Spybot, Ad-aware, firewalls and pop-up stoppers don't prevent or get rid of parasites.

There are a number of ways you can get them.

[Capmaster]

I have Norton Antivirus on all my machines. I use Pest Patrol brcause of its thoroughness and free updates. I run it almost daily and at least once a week it finds spyware/adware on one of the machines. It seems to get along with NAV too ...no need to disable the antivirus.

[Pwyll]

I'm not going to assume your level of computer knowledge. So if this is like kids stuff to you, you can give me a "You are way out of your element Donnie!".
You may or may not have tried running msconfig to take a look at what is starting when windows starts. I'm guessing this casino software entered some values in your registry. Some turn off your anti-virus software, others will block access to anti-virus software websites so that you can't update your definitions.
But if you run -> msconfig you can change your start up to diagnostic and to start in safe mode or at least disable start up programs. Then you can see if your anti-virus software is still messed up, or if another program during start up turns it off. That will most likely be your culprit or at least part of it. At least you might be able to do more specific searches on Google or Symantec on the programand how to get rid of all traces (registry and WINNT folder) of it.

[mike1061]

Nobody seams to take this tip seriously, but it worked for me 2x in windows XP computers.
Sorry I forgot to look at your profile.
The tip is "system restore". That restores your computer to an earlier date. Both times I was able to restore to the day before I got hijacked.
Thanks mike.

[gmatov]

That may work, but with many of the different trojans and worms, Norton tells you specifically to disable System Restore before running any "killer" program, or you will be reinfected on bootup.

Cheers,

George

[Bruiser]

I went back like 3 weeks, still disabled. I then tried to boot in safe mode, still was not autoprotected. I am fair game pretty much, I need to figure this out fast.

[mike1061]

Safe mode did nothing for me too. On another computer running windows 98, I had to clear the HD, and install everything again. You might have to look at a spyware remover. I would look at only top companys like Norton, and McCaffy (mispelled), that are serious about security. I have a bad feeling about some of the others, becauce when my computer got infected some of the pop-up adds were things like "your computer has been hit by spyware, so buy our remover." That just rubed me the wrong way.
Small tips to help it from happening again, are set the internet security setting high, and keep your antivirus updated.
Thanks Mike

[Bruiser]

I got spyware remover. It hasn't solved the problem.

[TBoneit]

Bruiser, I run about 6 or more programs at work to clean this stuff out.

In order, pretty much

Adaware
Spybot Search & Destroy
Spysweeper
CWS Shredder
Hijack this
Norton 2004 AV
Misc. Other programs.
And two different ones depending on what version of windows to restore the Winsock stack as cleaning some of these pests breaks Internet access.
A prog to check and/or reset the hosts file.

And last but not least a mental database of badguys I've built up that I just delete from within the Program Files directory is I see them. Got to be carefull there that you don't delete programs you need. I usually work in safe mode too. Steer clear of all those search toolbars, they're almost always bad news. They're a favorite of these guys because then they can see everything you search for easily.

Good Luck