Ask Windows XP Expert Walter Clayton About Spyware

Norred [MSFT]@discussions.microsoft.com Chris Norred [MSFT]

unread,

Aug 2, 2004, 6:51:05 PM8/2/04

to

Hello and welcome to our first Ask-the-Experts discussion, moderated by the Windows XP Expert Zone Community. This is a new trial effort and our goal is to make it easy for you to ask questions and find answers on a specific topic from a recognized expert in the online community. We’ll continue this discussion in the newsgroups for one week and our volunteer expert will select one or two questions each day and respond. Other experts and users online may also chime in with advice. At the end of the week, we hope to have a single thread filled with good information that can be preserved for the benefit of other users in the future.

This week, our expert host is volunteer MVP Walter Clayton who will be discussing the topic of spyware and adware and his experience helping users in the newsgroups deal with spyware issues. Walter is an IT professional from Frankfort, Kentucky. He is a self-trained computing pro with 20 years of experience, and he has been helping people in the online community for many years. Walter is a recipient of the Microsoft Most Valuable Professional (MVP) award for his volunteer efforts helping Windows users over the past five years.
A quote from Mr. Clayton:
“I enjoy working the newsgroups because it forces me to think and learn. Everyday I get a slightly different perspective on something or see a new situation or problem. There is also the challenge of keeping communication skills sharp. Determining the answer to a problem, and communicating it in the newsgroups can present its own set of challenges, especially at times when the wrong answer can leave the user in a no-boot situation.”

Our Ask the Experts discussion is different from the live chats hosted on the Windows XP Expert Zone Community site (http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000077).

In these discussions, you may not get an immediate answer. The hosts will check-in at a time convenient for them and answer questions. You can post a question any time. Then you may want to add the discussion to your Favorites list in Internet Explorer (Click Favorites, and then click Add to Favorites). You should check back later in the day, or the next day, to see if your question has been answered. Click the Refresh button to see if any new posts were added while you have been reading. If you’re more comfortable using Outlook Express or another newsreader, please do.

To post a question or reply in this discussion, using the Web-based newsgroup reader:
1. Click Reply.
2. If prompted, sign in with your .NET Passport.
3. Edit the subject line if you like.
4. In the Reply form, type your message or question in the Message box.
5. Review the text you typed in the Body box to make sure it says what you want; you cannot revise your message after you click Post.
6. To receive e-mail notification when someone posts to this thread, select the Notify me of replies check box.
7. Click Send.

This is a new trial effort and your feedback and assistance are appreciated. We’ll keep links to these discussions in the Windows XP Expert Zone Community Columns Archive
(http://www.microsoft.com/windowsxp/expertzone/columns/archive.mspx).
Truly
Chris Norred
Editor
Windows XP Expert Zone Community
cno...@microsoft.com

vtx

unread,

Aug 3, 2004, 8:03:02 AM8/3/04

to

Harry Ohrn

unread,

Aug 3, 2004, 10:02:07 AM8/3/04

to

"The Unknown P" <( mik...@msn.com )> wrote in message
news:0EF4534F-3B3F-4C37...@microsoft.com...
> How in God's name do you think this is going to differ from the numerous
> NG's and the posts pertaining to this topic. In short this is not only a
> waste of space but a little redundant as we have been dealing with
> thousands of questions pertaining to spyware\adware for years. If this
> supposed eXPert has anything to add he or she can feel free to answer the
> questions posted in any number of these NG's as the rest of us
> unrecognized or unheralded individuals do. Please don't go out of your way
> for us or the general public. Like any of the people who reply to these
> NG's it is at our conveniance and we certainly don't need your majesty to
> point this out to us. }:~)
> --
> There are three types of people in computing, those that can count and
> those that can't.
>

Who dumped in your Cheerio's this morning?. There are any number of non
Microsoft newsgroups on Usenet that you can post your valuable knowledge to.
If you dislike the way that Microsoft wishes to use their groups then
perhaps you should just move on over.

--

Harry Ohrn MS-MVP [Shell/User]
www.webtree.ca/windowsxp

novice77

unread,

Aug 3, 2004, 5:55:01 PM8/3/04

to

Could you tell me how to get rid of adware from my pc. Norton scan tells me I have 9 threatning files but can't delete them.

Shenan Stanley

unread,

Aug 3, 2004, 6:27:15 PM8/3/04

to

novice77 wrote:
> Could you tell me how to get rid of adware from my pc. Norton scan
> tells me I have 9 threatning files but can't delete them.

If you don't wish to follow all of the advice immediately, just want to
get rid of your current dilemma, then you are welcome to scroll down to
the section titled "SPYWARE/ADWARE/POPUPS", where your problem as
stated should be resolved by the applications and suggestions found in
that section. If this helps solve your problem then I again HIGHLY
suggest you follow the rest of the advice below (matter of fact, I
suggest it either way.)

Suggestions on what you can do to secure/clean your PC. I'm going to try
and be general, I will assume a "Windows" operating system is what is
being secured here.

SPYWARE/ADWARE/POPUPS
---------------------

There are annoyances out there you can get without
trying. Your normal web surfing, maybe a wrong click on a web page, maybe
just a momentary lack of judgment by installing some software packages
without doing the research.. And all of a sudden your screen starts filling
up with advertisements or your Internet seems much slower or your home page
won't stay what you set it and goes someplace unfamiliar to you. This is
spyware. There are a whole SLEW of software packages out there to get rid
of this crud and help prevent reinfection. Some of the products already
mentioned might even have branched out into this arena. However, there are
a few applications that seem to be the best at what they do, which is
eradicating and immunizing your system from this crap. Strangely, the best
products I have found in this category ARE generally free. That is a trend
I like. I make donations to some of them, they deserve it!

Two side-notes: Never think one of these can do the whole job.
Try the first 5 before coming back and saying "That did not work!"
Also, you can always visit:
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.

Spybot Search and Destroy (Free!)
http://www.safer-networking.net/

Lavasoft AdAware (Free and up)
http://www.lavasoft.de

CWSShredder (Free!)
http://www.spywareinfo.com/~merijn/downloads.html

Hijack This! (Free)
http://mjc1.com/mirror/hjt/
( Tutorial: http://www.spywareinfo.com/~merijn/htlogtutorial.html )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/

IE-SPYAD (Free!)
http://www.staff.uiuc.edu/~ehowes/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/index.html

Browser Security Tests
http://www.jasons-toolbox.com/BrowserSecurity/

The Cleaner (49.95 and up)
http://www.moosoft.com/

That will clean up your machine of the spyware, given that you download and
install several of them, update them regularly and scan with them when you
update. Some (like SpywareBlaster and SpyBot Search and Destroy) have
immunization features that will help you prevent your PC from being
infected. Use these features!

Unfortunately, although that will lessen your popups on the Internet/while
you are online, it won't eliminate them. I have looked at a lot of options,
seen a lot of them used in production with people who seem to attract popups
like a plague, and I only have one suggestion that end up serving double
duty (search engine and popup stopper in one):

The Google Toolbar (Free!)
http://toolbar.google.com/

Yeah - it adds a bar to your Internet Explorer - but its a useful one. You
can search from there anytime with one of the best search engines on the
planet (IMO.) And the fact it stops most popups - wow - BONUS! If you
don't like that suggestion, then I am just going to say you go to
www.google.com and search for other options.

One more suggestion, although I will suggest this in a way later, is to
disable your Windows Messenger service. This service is not used frequently
(if at all) by the normal home user and in cooperation with a good firewall,
is generally unnecessary. Microsoft has instructions on how to do this for
Windows XP here:
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

UPDATES and PATCHES
-------------------

This one is the most obvious. There is no perfect product and any company
worth their salt will try to meet/exceed the needs of their customers and
fix any problems they find along the way. I am not going to say Microsoft
is the best company in the world about this but they do have an option
available for you to use to keep your machine updated and patched from
the problems and vulnerabilities (as well as product improvements in some
cases) - and it's free to you.

Windows Update
http://windowsupdate.microsoft.com/

Go there and scan your machine for updates. Always get the critical ones as
you see them. Write down the KB###### or Q###### you see when selecting the
updates and if you have trouble over the next few days, go into your control
panel (Add/Remove Programs), match up the latest numbers you downloaded
recently (since you started noticing an issue) and uninstall them. If there
was more than one (usually is), install them back one by one - with a few
hours of use in between, to see if the problem returns. Yes - the process
is not perfect (updating) and can cause trouble like I mentioned - but as
you can see, the solution isn't that bad - and is MUCH better than the
alternatives. (SASSER/BLASTER were SO preventable with just this step!)

Windows is not the only product you likely have on your PC. The
manufacturers of the other products usually have updates as well. New
versions of almost everything come out all the time - some are free, some
are pay - some you can only download if you are registered - but it is best
to check. Just go to their web pages and look under their support and
download sections.

You also have hardware on your machine that requires drivers to interface
with the operating system. You have a video card that allows you to see on
your screen, a sound card that allows you to hear your PCs sound output and
so on. Visit those manufacturer web sites for the latest downloadable
drivers for your hardware/operating system. Always (IMO) get the
manufacturers hardware driver over any Microsoft offers. On the Windows
Update site I mentioned earlier, I suggest NOT getting their hardware
drivers - no matter how tempting.

Have I mentioned that Microsoft has some stuff to help secure your computer
available to the end-user for free? This seems as good of a time as any.
They have a CD you can order (it's free) that contain all of the Windows
patches through October 2003 and some trial products as well that they
released in February 2004. Yeah - it's a little behind now, but it's better
than nothing (and used in coordination with the information in this post,
well worth the purchase price..)

Order the Windows Security Update CD
http://www.microsoft.com/security/protect/cd/order.asp

They also have a bunch of suggestions, some similar to these, on how to
better protect your Windows system:

Protect your PC
http://www.microsoft.com/security/protect/

FIREWALL
--------

Let's say you are up-to-date on the OS (operating system) and you have
Windows XP.. You should at least turn on the built in firewall. That will
do a lot to "hide" you from the random bad things flying around the
Internet. Things like Sasser/Blaster enjoy just sitting out there in
Cyberspace looking for an unprotected Windows Operating System and jumping
on it, doing great damage in the process and then using that Unprotected OS
to continue its dirty work of infecting others. If you have the Windows XP
ICF turned on - default configuration - then they cannot see you! Think of
it as Internet Stealth Mode at this point. It has other advantages, like
actually locking the doors you didn't even (likely) know you had. Doing
this is simple, the instructions you need to use your built in Windows XP
firewall can be found here:

http://support.microsoft.com/?kbid=320855

If you read through that and look through the pages that are linked from it
at the bottom of that page - I think you should have a firm grasp on the
basics of the Windows XP Firewall as it is today. One thing to note RIGHT
NOW - if you have AOL, you cannot use this nice firewall that came with
your system. Thank AOL, not Microsoft. You HAVE to configure another
one.. So we continue with our session on Firewalls...

But let's say you DON'T have Windows XP - you have some other OS like
Windows 95, 98, 98SE, ME, NT, 2000. Well, you don't have the nifty built in
firewall. My suggestion - upgrade. My next suggestion - look through your
options. There are lots of free and pay firewalls out there for home users.
Yes - you will have to decide on your own which to get. Yes, you will have
to learn (oh no!) to use these firewalls and configure them so they don't
interfere with what you want to do while continuing to provide the security
you desire. It's just like anything else you want to protect - you have to
do something to protect it. Here are some suggested applications. A lot of
people tout "ZoneAlarm" as being the best alternative to just using the
Windows XP ICF, but truthfully - any of these alternatives are much better
than the Windows XP ICF at what they do - because that is ALL they do.

ZoneAlarm (Free and up)
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp

Kerio Personal Firewall (KPF) (Free and up)
http://www.kerio.com/kpf_download.html

Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/download/

Sygate Personal Firewall (Free and up)
http://smb.sygate.com/buy/download_buy.htm

Symantec's Norton Personal Firewall (~$25 and up)
http://www.symantec.com/sabu/nis/npf/

BlackICE PC Protection ($39.95 and up)
http://blackice.iss.net/

Tiny Personal Firewall (~$49.00 and up)
http://www.tinysoftware.com/

That list is not complete, but they are good firewall options, every one of
them. Visit the web pages, read up, ask around if you like - make a
decision and go with some firewall, any firewall. Also, maintain it.
Sometimes new holes are discovered in even the best of these products and
patches are released from the company to remedy this problem. However, if
you don't get the patches (check the manufacturer web page on occasion),
then you may never know you have the problem and/or are being used through
this weakness. Also, don't stack these things. Running more than one
firewall will not make you safer - it would likely (in fact) negate some
protection you gleamed from one or the other firewalls you ran together.

ANTIVIRUS SOFTWARE
------------------

That's not all. That's one facet of a secure PC, but firewalls don't do
everything. I saw one person posting on a newsgroup that "they had
never had a virus and they never run any anti-virus software." Yep - I used
to believe that way too - viruses were something everyone else seemed to
get, were they just stupid? And for the average joe-user who is careful,
uses their one-three family computers carefully, never opening unknown
attachments, always visiting the same family safe web sites, never
installing anything that did not come with their computer - maybe, just
maybe they will never witness a virus. I, however, am a Network Systems
Administrator. I see that AntiVirus software is an absolute necessity given
how most people see their computer as a toy/tool and not something
they should have to maintain and upkeep. After all, they were invented to
make life easier, right - not add another task to your day. You
can be as careful as you want - will the next person be as careful? Will
someone send you unknowingly the email that erases all the pictures of your
child/childhood? Possibly - why take the chance? ALWAYS RUN ANTIVIRUS
SOFTWARE and KEEP IT UP TO DATE! Antivirus software comes in so many
flavors, it's like walking into a Jelly Belly store - which one tastes like
what?! Well, here are a few choices for you. Some of these are free (isn't
that nice?) and some are not. Is one better than the other - MAYBE.

Symantec (Norton) AntiVirus (~$11 and up)
http://www.symantec.com/

Kaspersky Anti-Virus (~$49.95 and up)
http://www.kaspersky.com/products.html

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

AVG 6.0 Anti-Virus System (Free and up)
http://www.grisoft.com/

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

AntiVir (Free and up)
http://www.free-av.com/

avast! 4 (Free and up)
http://www.avast.com/

Trend Micro (~$49.95 and up)
http://www.trendmicro.com/
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/

Did I mention you have to not only install this software, but also keep it
updated? You do. Some of them (most) have automatic services to help you
do this - I mean, it's not your job to keep up with the half-dozen or more
new threats that come out daily, is it? Be sure to keep whichever one you
choose up to date!

SPAM EMAIL/JUNK MAIL
--------------------

This one can get annoying, just like the rest. You get 50 emails in one
sitting and 2 of them you wanted. NICE! (Not.) What can you do? Well,
although there are services out there to help you, some email
servers/services that actually do lower your spam with features built into
their servers - I still like the methods that let you be the end-decision
maker on what is spam and what isn't. If these things worked perfectly, we
wouldn't need people and then there would be no spam anyway - vicious
circle, eh? Anyway - I have two products to suggest to you, look at them
and see if either of them suite your needs. Again, if they don't, Google is
free and available for your perusal.

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

As I said, those are not your only options, but are reliable ones I have
seen function for hundreds+ people.

DISABLE (Set to Manual) UNUSED SERVICE/STARTUP APPS
---------------------------------------------------

I might get arguments on putting this one here, but it's my spill. There are
lots of services on your PC that are probably turned on by default you don't
use. Why have them on? Check out these web pages to see what all of the
services you might find on your computer are and set them according to your
personal needs. Be CAREFUL what you set to manual, and take heed and write
down as you change things! Also, don't expect a large performance increase
or anything - especially on todays 2+ GHz machines, however - I look at each
service you set to manual as one less service you have to worry about
someone exploiting. A year ago, I would have thought the Windows Messenger
service to be pretty safe, now I recommend (with addition of a firewall)
that most home users disable it! Yeah - this is another one you have to
work for, but your computer may speed up and/or be more secure because you
took the time. And if you document what you do as you do it, next time, it
goes MUCH faster! (or if you have to go back and re-enable things..)

Task List Programs
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Black Viper's Service List and Opinions (XP)
http://www.blackviper.com/WinXP/servicecfg.htm

Processes in Windows NT/2000/XP
http://www.reger24.de/prozesse/

There are also applications that AREN'T services that startup when you start
up the computer/logon. One of the better description on how to handle these
I have found here:

Startups
http://www.pacs-portal.co.uk/startup_content.php

That's it. A small booklet on how to keep your computer secure, clean of
scum and more user friendly. I am SURE I missed something, almost as I am
sure you won't read all of it (anyone for that matter.) However, I also
know that someone who followed all of the advice above would also have less
problems with their PC, less problems with viruses, less problems with spam,
fewer problems with spyware and better performance than someone who didn't.

Hope it helps.

--
<- Shenan ->
--
The information is provided "as is", with no guarantees of
completeness, accuracy or timeliness, and without warranties of any
kind, express or implied. In other words, read up before you take any
advice - you are the one ultimately responsible for your actions.

Walter Clayton

unread,

Aug 3, 2004, 6:49:52 PM8/3/04

to

First thing is to try running Norton in safe mode (reboot the machine, start
tapping F8 while the BIOS is POSTing to get the boot menu then take the safe
mode option. If you can't get to safe mode that way, use msconfig
(start->run->msconfig) boot.ini tab. Enable the safeboot option and leave
the option for minimal boot set. If you have to use msconfig to force
safemode don't forget to reverse the process in order to return to normal
mode).

Run NAV in that environment.

If that still fails, I need to know specifically what NAV is calling the
nasties. There's some other free tools and options that can be used, but
stay with what you have at present. Depending on exactly what you've been
hit with you may have to be talked through manual removal.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"novice77" <novi...@discussions.microsoft.com> wrote in message
news:3C4D979D-9B89-457A...@microsoft.com...

unread,

Aug 4, 2004, 12:10:47 AM8/4/04

to

New promotional program. Yes, Chris is legit MS.

Use the feed back link, it won't bite. ;-)

FWIW, I picked the topic of spyware for the simple reason that it's gotten
totally out of hand. 100% of my personal business the last 6 months has been
nothing but crapware cleanup. And generally I was called for what the client
thought was a completely unrelated reason.

FYI: The major AV vendors are starting to step up to plate. The only issue
is how broadly they'll address such "innocuous" things as Gator/Claria vs.
VX2 and the cool web search crap.

Now if we can just get MS to step into the fray officially, with both feet,
with proper tools to facilitate removing the nasties via 3rd party or MS
tools rather than having to rely on tricks I have up my selves courtesy of
hands on experience and other folks.......

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"JAX" <slip...@pop.not> wrote in message
news:e2LV5Pde...@TK2MSFTNGP11.phx.gbl...

David Candy

unread,

Aug 4, 2004, 12:24:56 AM8/4/04

to

That ain't entertainment. Shape up.

--
----------------------------------------------------------
'Not happy John! Defending our democracy',
http://www.smh.com.au/articles/2004/06/29/1088392635123.html

"Walter Clayton" <w-cla...@SPmvpsAM.org> wrote in message news:O0bzGkd...@TK2MSFTNGP09.phx.gbl...

JAX

unread,

Aug 4, 2004, 1:15:29 AM8/4/04

to

Hi Walter,

To tell the truth, I don't really recall hearing anything from you, but if
you carry the title "MVP'" and it is not earned, someone will be jumping on
you with both feet. I don't agree with the approach of "Unknown P", but the
subject of spyware, scumware, hijackers, etc. has been worn out in the
newsgroups for the past several months. Windows offers, pretty much, all the
pointers you need when you go to updates. It is something like, "protect
your computer 1,2,3".

I visit the XP newsgroups and follow the advice of the MVP's, as well as
other responders who have something to say that I consider credible. A year
or more ago, I deleted my "canned" responses to posts about spyware, etc. I
became tired of reading posts about the same problem that was posted two
lines down in the group.

I think you will agree, most posters get to the groups for the first time
via the XP Help and Support function on their computer, using CDO. There is
a FAQ's available there, but it is rather obscure and very limited. Not to
mention, it is not updated frequently.

Chris's post will "time-out" in a few days, and even before then, it will
move so far down the line in posts that the people who would have questions
about such a common problem will not scroll down/up to see it. I would like
to see MS add to its Help and Support site, an improved FAQ's link that
would be more in tune with current problems people are having. They would,
no doubt, have to have a relatively small crew to monitor the XP groups to
determine what customers were having problems with and to come up with
appropriate answers, but I think it would be within the resources of MS and
a way of promoting customer relations.

FWIW, JAX

"Walter Clayton" <w-cla...@SPmvpsAM.org> wrote in message
news:O0bzGkd...@TK2MSFTNGP09.phx.gbl...

JAX

unread,

Aug 4, 2004, 1:47:55 AM8/4/04

to

From my experience, self taught too; First thing is to try to get rid of
Norton.

JAX

"Walter Clayton" <w-cla...@SPmvpsAM.org> wrote in message

news:%23Zkrxwa...@TK2MSFTNGP10.phx.gbl...

Harry Ohrn

unread,

Aug 4, 2004, 9:16:54 AM8/4/04

to

JAX check this out
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&q=walter+clayton&btnG=Search
--

Harry Ohrn MS-MVP [Shell/User]
www.webtree.ca/windowsxp

"JAX" <slip...@pop.not> wrote in message

news:u0IXQIee...@tk2msftngp13.phx.gbl...

Will Denny

unread,

Aug 4, 2004, 10:01:21 AM8/4/04

to

Hi Jax

I have followed Walter's postings over the few years and had the privilege to meet Walter earlier this year. He's a minefield of knowledge as are a lot of the other MVPs I met.

The Expert Zone is very good facility:

http://www.microsoft.com/windowsxp/expertzone/default.mspx

The CDO interface for a first visit to the News Groups isn't a good idea. Not sure why MS puts that above OE!!

The following article will show how to setup OE as a News Reader:

http://www.michaelstevenstech.com/outlookexpressnewreader.htm

--

Will Denny
MS-MVP Windows Shell/User
Please reply to the News Groups

"JAX" <slip...@pop.not> wrote in message news:u0IXQIee...@tk2msftngp13.phx.gbl...

Chris Norred [MSFT]

unread,

Aug 4, 2004, 1:09:03 PM8/4/04

to

Thanks everyone for participating in the thread.

Novice 77, Thanks for posting the spyware question. Hopefully you'll have a chance to post again and tell us what you've tried and how it's worked for you.

Shanen, thanks for the extensive post.

Everyone else, thanks for the support of Walter, and the feedback on this trial.
Of course spyware has been discussed to great length and is old hat to newsgroup regulars . As Walter pointed out, it's still a major frustration for many people. What's new here? With Webnews 3.0 being used now on Microsoft.com Web sites, we can link from the Web directly to this discussion, making it easier for inexperienced users to find valuable newsgroup discussions. We also have the ability to preserve helpful threads so they don't expire from the MS server. And this is a way to recognize some of the helpful volunteers like Walter who've made their reputations in the online community.

Walter will be on this thread all week so keep the questions coming.

-Chris Norred

Editor
Windows XP Expert Zone Community

-This posting is provided "AS IS" with no warranties, and confers no rights.

JAX

unread,

Aug 4, 2004, 11:23:10 PM8/4/04

to

Hi All,

I will sum up my point in posting to this thread in the first place, this
has all the earmarks of a Troll! The OP has done nothing but get the
attention of those who haven't asked for anything from them in the first
place, with the exception of the post from "novis77",

So far as Walter Claton's customers,

"FWIW, I picked the topic of spyware for the simple reason that it's gotten
totally out of hand. 100% of my personal business the last 6 months has been
nothing but crapware cleanup. And generally I was called for what the client
thought was a completely unrelated reason."

Those people would not have gone to your web-site/newsgroup message/ help &
support/whatever. They only want their computer to run the way they expect
it to and don't want to do anything on their own to make it happen.

I don't mean to sound like a cynic, but those are the facts, as I see them.

Good luck with your venture,
JAX

>

irishsetter

unread,

Aug 5, 2004, 10:03:10 PM8/5/04

to

I installed McAfee 2005 Anti Spyware. Immediately, my MSN Premium software, i.e. MSN Explorer shut down. I can't sign in our out. I was advised to uninstall/install, but whether from disc or download, I get an "error that MSN can't complete" and may be due to memory....." but I have the memory, can download other pgms, etc. I've pulled McA off the computer and still can't get the MSN Exp. to work/install.

The Original error was:
MSN error report
7/22
description of event 1000 can not be found. local computer may not have
nec
registry info or message DLL files to display messages from remote. You
may
use /AUXSOURCE=flag to retrieve this description. The following info is
part
of the eent msn.exe:
9.0. 12.3101.hhctrl.ocx.5.2.3735.0.00011aa0

windows cannot unload your classes registry file...its still in use by
other
aps or svc. file will be unloaded when not in use
userenv
fault bucket 82548512

Walter Clayton

unread,

Aug 6, 2004, 6:17:26 PM8/6/04

to

The easiest thing you can try is a system restore to prior to installing
AntiSpyware. If you don't have a restore point that far back things may get
interesting.

Unfortunately this is a brand new product from McAfee and it's like looking
for hen's teeth to find out anything about it. It sounds like they're trying
to hook activeX controls as well as a number of things and botched it.
Badly. Without knowing what they stomped on in the registry.

Does "Help and Support" (start->help and support) currently work?

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"irishsetter" <irish...@discussions.microsoft.com> wrote in message
news:F6C37FFC-C528-4E9C...@microsoft.com...

Andrew

unread,

Aug 7, 2004, 9:21:02 AM8/7/04

to

"Walter Clayton" wrote:

> I already know what Spyware can do and all to your computers but what is the best Spyware and Ad-aware remover programs out there I'm using Spybot 1.3 and Ad-aware 6.0 from Lavasoft and I heard having two good Spyware and Ad-aware remover programs that it will remove about 90% of Spyware and Ad-aware off your computer and keep it out.

Shenan Stanley

unread,

Aug 7, 2004, 11:23:05 AM8/7/04

to

Andrew wrote:
> I already know what Spyware can do and all to your computers but
> what is the best Spyware and Ad-aware remover programs out there I'm
> using Spybot 1.3 and Ad-aware 6.0 from Lavasoft and I heard having
> two good Spyware and Ad-aware remover programs that it will remove
> about 90% of Spyware and Ad-aware off your computer and keep it out.

The best applications I have found for spyware removal and prevention are
found in the spill below. Along with other application for avoiding and
preventing other types of infections/problems. Matter of fact, these
applications are not based merely on my experience (although if they are on
the list below, I have used them in one form or another) - but also based on
suggestions seen in and around these forums and throughout the Internet.

Walter Clayton

unread,

Aug 7, 2004, 11:47:30 AM8/7/04

to

Generally all I use is AdAware first followed by SpyBot. There's a lot of
overlap in the two tools, but they also concentrate on non-overlapping
areas. It's also wise to follow up with installing SpywareBlaster. None of
these require run time presences although SpyBot will offer to install such.
No harm in doing so and in some instances, especially with multi-user
machines, a necessity. The biggest issue is remembering to run them
periodically after checking for updates. The latter is one of the reasons,
other than not changing usage habits, that people get reinfected. It's
easier to avoid being click happy than it is to clean up the mess
afterwards.

There are instances where AdAware/SpyBot may be neutralized or unable to
clean something. I handle those on a case by case basis since you're looking
at going with some highly specialized tools that if misused will leave the
machine unbootable (note that there is a nasty that the current version of
AdAware had been cleaning incorrectly that would make it impossible to log
on to the machine without taking corrective action).

Depending on your level of expertise there are some tools that circumvent
issues with removing nasties that are resident in memory even in safe mode.
If an XP machine is being disinfected I use a bootable CD created using
Bart's tools with fully updated AdAware, Trendmicro, McAfee and Kaspersky
tools (all free versions) incorporated. This also allows me to correct any
registry issues on the host machine without any major hassles other than
knowing what parts of the registry need be hacked. The reason I include and
run AV scanners is generally if some one has a load of spyware it's not
unusual they'll have nastier stuff as well.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Andrew" <And...@discussions.microsoft.com> wrote in message
news:97E53975-D207-4D60...@microsoft.com...

Michel

unread,

Aug 8, 2004, 3:41:01 AM8/8/04

to

Michel

unread,

Aug 8, 2004, 3:43:02 AM8/8/04

to

Michel

unread,

Aug 8, 2004, 3:45:02 AM8/8/04

to

My Internet Exp has been hijacked by CoolWebSearch and AdAware, Spybot &
SpywareBlaster have not detected it or removed it! What can I do??

zippy

unread,

Aug 8, 2004, 3:50:50 AM8/8/04

to

Have you made sure that you updated products? Are you running these
programs in safe mode? Have you disabled system restore *before* running
these programs? Try these steps and see if they help.
"Michel" <Mic...@discussions.microsoft.com> wrote in message
news:0F43D42F-89AF-4732...@microsoft.com...

Ronnie Vernon MVP

unread,

Aug 8, 2004, 8:12:05 AM8/8/04

to

Michel wrote:
> My Internet Exp has been hijacked by CoolWebSearch and AdAware,
> Spybot & SpywareBlaster have not detected it or removed it! What can
> I do??
>

There is a tool made specifically for this nasty application.

Download the utility CWShredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Unzip, close all instances of IE & OE, start the executable and follow the
prompts.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
http://www.dts-l.org
http://www.mvps.org

Walter Clayton

unread,

Aug 8, 2004, 9:23:21 AM8/8/04

to

Disabling system restore is a bad idea. The system may be in a bad shape
now, but at it basically functions. If the spyware rip out goes awry SR may
be the only way to get back to make a second attempt.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"zippy" <zippy...@nospamearthlink.net> wrote in message
news:uXkRc.12607$cK....@newsread2.news.pas.earthlink.net...

Walter Clayton

unread,

Aug 8, 2004, 9:27:21 AM8/8/04

to

Like zippy said update AdAware and Spybot *before* scanning and run them in
safe mode. If that still doesn't solve the problem the you can try
CWShredder but don't be surprised if it doesn't work. The developer has quit
maintaining it so depending on exactly what flavor you have that might not
work.

Give that a try first.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Michel" <Mic...@discussions.microsoft.com> wrote in message
news:0F43D42F-89AF-4732...@microsoft.com...

zippy

unread,

Aug 8, 2004, 11:48:27 AM8/8/04

to

I meant just to disable it while doing the scans, then put it back on. I've
found this method the only way to completely rid the system. If he had to
repair to a previous date, guess what he's going to get back? Coolweb. I
thought you were the expert?
Even Norton says to disable system restore.........

"Walter Clayton" <w-cla...@SPmvpsAM.org> wrote in message

news:eef3erU...@TK2MSFTNGP09.phx.gbl...

Walter Clayton

unread,

Aug 8, 2004, 12:48:44 PM8/8/04

to

;-)

Trust me or not. Disabling SR during the weed out is dangerous. Once the
machine is clean *then* purge SR and snap a base line. Yes, if a system
restore must be done because the weed out trashed the machine, then yes,
you're back with the crapware but at least the system is usable so that you
can try a different approach that won't leave the machine in worse shambles.

Or to rephrase it, why do think Spybot, by default, takes a SR snapshot
prior to altering anything on the system?

Ripping some of this stuff out is dangerous and NT kernels are rather
fragile in this regard. SR is the only graceful mechanism that people have
to restore functionality if something in the TCP stack gets ripped out
incorrectly leaving the machine DOA as far at getting on the 'net is
concerned. Unless they happen to have the proper repair tools on hand in
advance. Or if they hook the shell in such a manner that GUI fails on normal
startup.

Frankly I'm concerned about what Norton says. They have less than a stellar
reputation.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"zippy" <zippy...@nospamearthlink.net> wrote in message

news:fXrRc.12936$9Y6...@newsread1.news.pas.earthlink.net...

mbrennen

unread,

Aug 8, 2004, 2:51:01 PM8/8/04

to

I have been having challenges with adware.iefeatsl & winshow. Norton
identifies entries to remove from the registry(most of them not there) they
also suggest that I delete files manually that norton will not. Bottom line
is that I am going to have to delete alot of files to de-possess my IE. I
have already deleted some of the files and noticed some system instability .
My search function in explorer craters .(as an example) I have tried Spybot
etc... No luck. Any suggestions? I am about to reload windows xp. I am
looking into linux as well.

thanks,

"Chris Norred [MSFT]" wrote:

> Hello and welcome to our first Ask-the-Experts discussion, moderated by the Windows XP Expert Zone Community. This is a new trial effort and our goal is to make it easy for you to ask questions and find answers on a specific topic from a recognized expert in the online community. We’ll continue this discussion in the newsgroups for one week and our volunteer expert will select one or two questions each day and respond. Other experts and users online may also chime in with advice. At the end of the week, we hope to have a single thread filled with good information that can be preserved for the benefit of other users in the future.
>
> This week, our expert host is volunteer MVP Walter Clayton who will be discussing the topic of spyware and adware and his experience helping users in the newsgroups deal with spyware issues. Walter is an IT professional from Frankfort, Kentucky. He is a self-trained computing pro with 20 years of experience, and he has been helping people in the online community for many years. Walter is a recipient of the Microsoft Most Valuable Professional (MVP) award for his volunteer efforts helping Windows users over the past five years.
> A quote from Mr. Clayton:
> “I enjoy working the newsgroups because it forces me to think and learn. Everyday I get a slightly different perspective on something or see a new situation or problem. There is also the challenge of keeping communication skills sharp. Determining the answer to a problem, and communicating it in the newsgroups can present its own set of challenges, especially at times when the wrong answer can leave the user in a no-boot situation.”
>

> Our Ask the Experts discussion is different from the live chats hosted on the Windows XP Expert Zone Community site (http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000077).

>
> In these discussions, you may not get an immediate answer. The hosts will check-in at a time convenient for them and answer questions. You can post a question any time. Then you may want to add the discussion to your Favorites list in Internet Explorer (Click Favorites, and then click Add to Favorites). You should check back later in the day, or the next day, to see if your question has been answered. Click the Refresh button to see if any new posts were added while you have been reading. If you’re more comfortable using Outlook Express or another newsreader, please do.
>
> To post a question or reply in this discussion, using the Web-based newsgroup reader:
> 1. Click Reply.
> 2. If prompted, sign in with your .NET Passport.
> 3. Edit the subject line if you like.
> 4. In the Reply form, type your message or question in the Message box.
> 5. Review the text you typed in the Body box to make sure it says what you want; you cannot revise your message after you click Post.
> 6. To receive e-mail notification when someone posts to this thread, select the Notify me of replies check box.
> 7. Click Send.
>

> This is a new trial effort and your feedback and assistance are appreciated. We’ll keep links to these discussions in the Windows XP Expert Zone Community Columns Archive
> (http://www.microsoft.com/windowsxp/expertzone/columns/archive.mspx).
> Truly

> Chris Norred
> Editor
> Windows XP Expert Zone Community

> cno...@microsoft.com
>
>
>

zippy

unread,

Aug 8, 2004, 4:20:20 PM8/8/04

to

Well I hear what you are saying. But I wouldn't want to have to restore to
a point where I had the scumware and have to start back at ground zero
trying to get rid of it. I'd lose all my hair. Guess I've just got lucky
with the way I have been doing it for a while. I have found that this
Coolweb thingy has many variants and some variants are easier to get rid of
with just adaware, spybot, CWShredder, and HijackThis. While on other
computers I've worked on weren't quite so easy. The version I had even got
past my firewall. Mistyped an address and got directed to a malicous
website and before I knew it I had programs like NotePad and Windows Media
player asking for permission to access the net through ZoneAlarm. Right
then and there I knew something was wrong as these shouldn't have been
asking for permission. I tried running Spybot, Adaware, and Hijack this,
even from safe mode. But I was unable to get rid of it totally till I
disabled system restore and then scanned in safe mode. It was still asking
for permission. I usually use AVG free for virus scans, but this program is
unable to scan in safe mode normally and was not detecting any viruses so I
ran norton from CD, incase the variant I had disabled installed Scanners.
This also found Trojan Downloader that was created on the same day as
Coolweb. I'm thinking these two went hand in hand. I was still getting
Pop-ups, programs still asking for permission. Once I disabled restore and
then ran all these programs again it was able to quarentine most items.I was
no longer getting all the pop-ups. Programs were no longer asking for
permission. But I still had to manually remove Content.IE5. These infected
items were found in the index dat file that Norton was unable to remove.
Had to fix Notepad. So, I've found that even with Virus Scanners, spyware
removal tools and a firewall doesn't mean you are protected 100%. To date,
they still don't have software for Operator Error :-)) That's why now I've
been very dilligent backing up to CD any information that I really really
need, and something does go wrong, it's just as easy for me now to just do a
clean install of XP rather than restore. Although this is a last resort.

"Walter Clayton" <w-cla...@SPmvpsAM.org> wrote in message

news:Ob17PeW...@TK2MSFTNGP09.phx.gbl...

Walter Clayton

unread,

Aug 8, 2004, 6:53:03 PM8/8/04

to

Yep, t'ain't nothing can be done about the person at the keyboard. BTDTBTTS
:-)

Depending on how compotent you are you can do what I do when I'm on site. Go
to http://www.nu2.nu and grab Bart's PE. You'll need either a standard
retail/oem CD (not a restore set) or an I386 directory on disk. Following
the instructions and you can create a stand alone XP environment that has
AdAware, command line AV scanners, and other tools you feel you need. It's a
lot easier to nail some of the tricker variants that load themselves in safe
mode. And since it has full networking support you can push data across a
network to another machine if things get really nasty.

I've tussled with some of the more willey varieties myself and never had to
disable SR. I have hand massaged the registry and clipped nasties off the
drive either in safe mode when AdAware and Spybot were prohibited from
correcting the registry (and that gets tricky with an active nasty :-) or
via Bart's.

TrendMicro has stepped up to the plate and offers a free tool
(http://www.trendmicro.com/download/dcs.asp) that I've started to use. Also
there's a tool at http://www.silentrunners.org/ that identifies stuff
launching with the system that isn't part of a default virgin install. Use
extremely care when interpreting the results. Some people have
unintentionally shot themselves in the foot extremely badly (flat lined the
system) when hacking the wrong thing out of the registry. Couple that with
http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml and, if you're
really compotent at ftp://ftp.kaspersky.ru/utils/ you'll find a Trojan
Finder tool that will let you determine what is preventing you from
terminating a task. It will also let you kill tasks. There's some other
handy stuff there as well.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"zippy" <zippy...@nospamearthlink.net> wrote in message

news:8WvRc.13353$cK....@newsread2.news.pas.earthlink.net...

Walter Clayton

unread,

Aug 8, 2004, 7:10:13 PM8/8/04

to

Linux will simply leave you with a different set of vulnerabilities and a
hefty learning curve initially. Staying with Windows and switching to a
different browser, although less of a learning curve, will simply change the
vulnerabilities with regard browser hijacking. They are alternatives, but
for the average user, not what I would call as attractive as some people
would like to think.

Go to http://www.trendmicro.com/download/dcs.asp and download the Sysclean
package. You'll also need the template file linked on the same page. Read
the instructions on how to run this.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"mbrennen" <mbre...@discussions.microsoft.com> wrote in message
news:B4635D75-3663-4152...@microsoft.com...

GaryC

unread,

Aug 9, 2004, 1:07:02 AM8/9/04

to

Walter: NAV found a trojan horse called pwsteal.banker.b on my machine. NAV
has denied access to the file but NAV always generates a pop up. It seems to
me that the trojan horse is succesfully isolated but a program is constantly
calling for it....therefore the NAV popup. The suggested Symantec fix says
to repair the registry in safe mode. I've never edited the registry before.
I have a couple of questions:

1) how do you backup the registry in WinXP Home Edition, and

2) Symantec says to delete certain values after navigating to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft NT\CurrentVersion\Winlogon\Notify\f3dsl
and to HKEY_LOCA-MACHINE\System\CurrentControlSet\Control. I can't seem to
find these. Are these in XP?

Thanks,

"Walter Clayton" wrote:

> First thing is to try running Norton in safe mode (reboot the machine, start
> tapping F8 while the BIOS is POSTing to get the boot menu then take the safe
> mode option. If you can't get to safe mode that way, use msconfig
> (start->run->msconfig) boot.ini tab. Enable the safeboot option and leave
> the option for minimal boot set. If you have to use msconfig to force
> safemode don't forget to reverse the process in order to return to normal
> mode).
>
> Run NAV in that environment.
>
> If that still fails, I need to know specifically what NAV is calling the
> nasties. There's some other free tools and options that can be used, but
> stay with what you have at present. Depending on exactly what you've been
> hit with you may have to be talked through manual removal.
>

> --
> Walter Clayton - MS MVP(WinXP)
> Associate Expert
> http://www.microsoft.com/windowsxp/expertzone
> Any technology distinguishable from magic is insufficiently advanced.
> http://www.dts-l.org
> http://support.microsoft.com/servicedesks/fileversion/default.asp|
>
>

Airman

unread,

Aug 9, 2004, 7:31:03 PM8/9/04

to

I have been using ZoneAlarmPro firewall and from time to time receive an
alert: "Microsoft Windows Based Script Host is trying to connect to the
internet..." - no information is available...
so I have been denying access but I wonder if this is an authentic Microsoft
Update download - and should be allowing access.

David Candy

unread,

Aug 9, 2004, 7:38:29 PM8/9/04

to

Depends on why it wants access.

--
----------------------------------------------------------
'Not happy John! Defending our democracy',
http://www.smh.com.au/articles/2004/06/29/1088392635123.html

unread,

Aug 12, 2004, 10:39:01 AM8/12/04

to

My computer has so much spy-ware on it I'd prefer just to reformat the hard
drive and start fresh. The only problem is I bought my HP desktop with XP
already installed and I don't have a disc. Can I reformat my drive without
getting rid of XP?

Shenan Stanley

unread,

Aug 12, 2004, 11:02:02 AM8/12/04

to

pdthorin wrote:
> My computer has so much spy-ware on it I'd prefer just to reformat
> the hard drive and start fresh. The only problem is I bought my HP
> desktop with XP already installed and I don't have a disc. Can I
> reformat my drive without getting rid of XP?

Format - to erase everything.
In that lies your answer (which is NO.)

You CAN clean it up!

Ken Blake

unread,

Aug 12, 2004, 11:22:22 AM8/12/04

to

In news:1986AB3C-39E4-450E...@microsoft.com,
pdthorin <pdth...@discussions.microsoft.com> typed:

> My computer has so much spy-ware on it I'd prefer just to
> reformat
> the hard drive and start fresh. The only problem is I bought
> my HP
> desktop with XP already installed and I don't have a disc. Can
> I
> reformat my drive without getting rid of XP?

That's like asking "if I take everything out of my house, will my
furniture still be there?"

No, formatting means that *everything* on the drive will be gone.

However, OEM vendors are required by their agreement with
Microsoft to give you a means of reinstalling, should it be
necessary. They can do this in one of three ways:

1. An OEM copy of Windows

2. A restore CD

3. A hidden partition on your drive, with restore information.

If you don't have 1 or 2, you should have 3, but you should
contact your vendor to find out.

--
Ken Blake - Microsoft MVP Windows: Shell/User

Walter Clayton

unread,

Aug 12, 2004, 5:41:05 PM8/12/04

to

Your choice, but as Ken and Shenan pointed out, that's not necessarily the
best solution. I had a personal client that called wanting me to look at why
they had to replace their modem just about every two to three weeks. Turns
out they were on cable attached via NIC, were in fact replacing their
internal modem then flatlining the system with an OEM image *without*
patching up and *without* changing any usage habits. When I sat down at the
machine it was so choked up with malware and crapware, including winsock
hijack, that the machine couldn't get out to the internet. Cleaning the
machine in place then holding a safe computing forum while watching the
clean up tools do their thing did wonders.

Back to your specific issue. If you want to flatline the system, that's
certainly an option. I do not recommend it since you'll immediately have to
download and install 70-80M of patches (if you're sitting at SP1) some of
which you'll need just to get online safely in order to patch unless you're
sitting behind a firewall (and yes, I stated that exactly the way I meant).

It's easier in a lot of ways, and generally safer with your data to clean in
place.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"pdthorin" <pdth...@discussions.microsoft.com> wrote in message
news:1986AB3C-39E4-450E...@microsoft.com...

JR

unread,

Aug 15, 2004, 8:49:02 PM8/15/04

to

Hi Chris,
Just to let you know that I'm a person who knows nothing much when it comes
to technology.I have a spybot- search and destroy software installed on my
laptop which I run on a daily basis.I notice a spyware 'DSO EXPLOIT'
appearing everyday and actually everytime I run the spy catching program.I
wonder what I can do in order to block it for good.Again I'm not sure if this
spy comes from some imp site I visit everyday.Pls advise.
Regards

Shenan Stanley

unread,

Aug 15, 2004, 9:15:56 PM8/15/04

to

JR wrote:
> Just to let you know that I'm a person who knows nothing much when it
> comes to technology.I have a spybot- search and destroy software
> installed on my laptop which I run on a daily basis.I notice a
> spyware 'DSO EXPLOIT' appearing everyday and actually everytime I run
> the spy catching program.I wonder what I can do in order to block it
> for good.Again I'm not sure if this spy comes from some imp site I
> visit everyday.Pls advise.
> Regards

You need to uninstall Spybot S&D 1.2 or the Release Candidate for 1.3 and
install the FULL version of 1.3 and update it.

Other advice to follow:

Suggestions on what you can do to secure/clean your PC. I'm going to try
and be general, I will assume a "Windows" operating system is what is
being secured here.

UPDATES and PATCHES
-------------------

Windows Update
http://windowsupdate.microsoft.com/

FIREWALL
--------

http://support.microsoft.com/?kbid=320855

ANTIVIRUS SOFTWARE
------------------

SPYWARE/ADWARE/POPUPS
---------------------

So you must be thinking that the above two things got your back now - you
are covered, safe and secure in your little fox hole. Wrong! There are
more bad guys out there. There are annoyances out there you can get without

CWSShredder (Free!)
http://www.spywareinfo.com/~merijn/downloads.html

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/

IE-SPYAD (Free!)
http://www.staff.uiuc.edu/~ehowes/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

Walter Clayton

unread,

Aug 15, 2004, 9:23:00 PM8/15/04

to

That's an issue with Spybot.
http://www.safer-networking.org/en/contact/bugs.html

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"JR" <J...@discussions.microsoft.com> wrote in message
news:D5088A09-9FCA-4988...@microsoft.com...

JAX

unread,

Aug 15, 2004, 9:30:36 PM8/15/04

to

I'm not one of the whiz bangs you addressed your post to, but I can tell
you, DSO exploit is a known issue with Spybot S&D. You will see 5 entries
each time you run S&D. There is nothing to worry about and a fix is supposed
to be on the way. Do a Google search and it will confirm what I say.

JAX

"JR" <J...@discussions.microsoft.com> wrote in message
news:D5088A09-9FCA-4988...@microsoft.com...

chuckgolf

unread,

Aug 16, 2004, 3:05:02 PM8/16/04

to

"Chris Norred [MSFT]" wrote:

> Hello and welcome to our first Ask-the-Experts discussion, moderated by the Windows XP Expert Zone Community. This is a new trial effort and our goal is to make it easy for you to ask questions and find answers on a specific topic from a recognized expert in the online community. We’ll continue this discussion in the newsgroups for one week and our volunteer expert will select one or two questions each day and respond. Other experts and users online may also chime in with advice. At the end of the week, we hope to have a single thread filled with good information that can be preserved for the benefit of other users in the future.
>
> This week, our expert host is volunteer MVP Walter Clayton who will be discussing the topic of spyware and adware and his experience helping users in the newsgroups deal with spyware issues. Walter is an IT professional from Frankfort, Kentucky. He is a self-trained computing pro with 20 years of experience, and he has been helping people in the online community for many years. Walter is a recipient of the Microsoft Most Valuable Professional (MVP) award for his volunteer efforts helping Windows users over the past five years.
> A quote from Mr. Clayton:
> “I enjoy working the newsgroups because it forces me to think and learn. Everyday I get a slightly different perspective on something or see a new situation or problem. There is also the challenge of keeping communication skills sharp. Determining the answer to a problem, and communicating it in the newsgroups can present its own set of challenges, especially at times when the wrong answer can leave the user in a no-boot situation.”
>
> Our Ask the Experts discussion is different from the live chats hosted on the Windows XP Expert Zone Community site (http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000077).
>
> In these discussions, you may not get an immediate answer. The hosts will check-in at a time convenient for them and answer questions. You can post a question any time. Then you may want to add the discussion to your Favorites list in Internet Explorer (Click Favorites, and then click Add to Favorites). You should check back later in the day, or the next day, to see if your question has been answered. Click the Refresh button to see if any new posts were added while you have been reading. If you’re more comfortable using Outlook Express or another newsreader, please do.
>
> To post a question or reply in this discussion, using the Web-based newsgroup reader:
> 1. Click Reply.
> 2. If prompted, sign in with your .NET Passport.
> 3. Edit the subject line if you like.
> 4. In the Reply form, type your message or question in the Message box.
> 5. Review the text you typed in the Body box to make sure it says what you want; you cannot revise your message after you click Post.
> 6. To receive e-mail notification when someone posts to this thread, select the Notify me of replies check box.
> 7. Click Send.
>
> This is a new trial effort and your feedback and assistance are appreciated. We’ll keep links to these discussions in the Windows XP Expert Zone Community Columns Archive
> (http://www.microsoft.com/windowsxp/expertzone/columns/archive.mspx).
> Truly
> Chris Norred
> Editor
> Windows XP Expert Zone Community
> cno...@microsoft.com

> Have installed norton anti virue protection but since I have installed it my computer will not turn off. Have to push off button to get to turn off completly. Says windows is shutting down then it locks up. Also am recieving a script message that says ca version not defined email address is Http://value ad.com/code? casn you tell me how to correct all these problems and how do you stop all the pop up ad wares have tried everthing I know even blocking all the address on internet options.
>
>

Walter Clayton

unread,

Aug 16, 2004, 5:32:31 PM8/16/04

to

Your system hang is probably unrelated to Norton directly. Most likely that
issue is a by product of your current situation.

First there are three free apps you'll need to download.

Trendmicro sysclean package from http://www.trendmicro.com/download/dcs.asp
and the virus signature package from
http://www.trendmicro.com/download/pattern-cpr-disclaimer.asp - be sure to
read and follow the instructions.

Get AdAwareSE from http://www.majorgeeks.com/download506.html and SpyBot
from http://www.majorgeeks.com/download2471.html

Run Trendmicro's scanner first. Once that completes run AdAware. Before
letting AdAware run the first time, make sure that you allow it to do an
update. This is *extremely* important. Failure to allow AdAware to update
can cause it to miss things. If AdAware requests a reboot in order to
complete cleanup then allow it to do so. After you run AdAware then run
SpyBot. Again, it is *extremely* important that you update Spybot before
first run. Repeat a scan with both products until clean. If they fail to
clean then post back.

Once you have the machine clean, go to
http://www.majorgeeks.com/download2859.html and download and install
SpywareBlaster. Follow the instructions.

To minimize pop-ups, once you're clean there are a variety of pop-up
blockers out there. I use Google Tool bar myself at
http://toolbar.google.com

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"chuckgolf" <chuc...@discussions.microsoft.com> wrote in message
news:C3A5FFCF-0B54-4A9F...@microsoft.com...

Mushabbar

unread,

Aug 17, 2004, 8:09:02 AM8/17/04

to

Hello I would like to manage the windows 2000 active directory from my
windows XP professional PC, kindly help me on this topic you could also email
me on this ID xa...@mtkhoory.com

Shenan Stanley

unread,

Aug 17, 2004, 5:43:40 PM8/17/04

to

Mushabbar wrote:
> Hello I would like to manage the windows 2000 active directory from my
> windows XP professional PC, kindly help me on this topic you could
> also email me on this ID xa...@mtkhoory.com

Install the Windows 2003 Admin Kit

Fran

unread,

Aug 17, 2004, 11:15:02 PM8/17/04

to

I scrolled down the list of messages posted and didn't see any advice on
spyware removal software. I downloaded Spybot (free) and when I use it, it
keeps finding the same 5 or 6 windows-related changes to the registry. If I
click on "Fix the problem", it changes the registry. Is this really
necessary, or should I get rid of this software. I had Ad-aware before, and
it just removed suspicious cookies, never actually made any registry changes.
Please tell me which of these two programs is the best to use.
Fran

Walter Clayton

unread,

Aug 17, 2004, 11:27:28 PM8/17/04

to

Both together. AdAware does in fact address registry issues. Spybot address
registry and some other things. The fact that you're clean and staying clean
does not mean that either product is not working.

If you want to see what really happens, load up with a boat load of
crapware. However that's not something I really recommend you do unless you
have a throw away copy of the OS. There's some serious stuff out there. ;-)

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Fran" <Fr...@discussions.microsoft.com> wrote in message
news:740F4A7C-055E-4996...@microsoft.com...

Shenan Stanley

unread,

Aug 18, 2004, 3:02:20 AM8/18/04

to

Fran wrote:
> I scrolled down the list of messages posted and didn't see any advice
> on spyware removal software. I downloaded Spybot (free) and when I
> use it, it keeps finding the same 5 or 6 windows-related changes to
> the registry. If I click on "Fix the problem", it changes the
> registry. Is this really necessary, or should I get rid of this
> software. I had Ad-aware before, and it just removed suspicious
> cookies, never actually made any registry changes. Please tell me
> which of these two programs is the best to use.
> Fran

Not really sure how you missed the posts like this:

If you don't wish to follow all of the advice immediately, just want to
get rid of your current dilemma, then you are welcome to scroll down to
the section titled "SPYWARE/ADWARE/POPUPS", where your problem as
stated should be resolved by the applications and suggestions found in
that section. If this helps solve your problem then I again HIGHLY
suggest you follow the rest of the advice below (matter of fact, I
suggest it either way.)

Suggestions on what you can do to secure/clean your PC. I'm going to try

and be general, I will assume a "Windows" operating system is what is
being secured here.

SPYWARE/ADWARE/POPUPS
---------------------

CWSShredder (Free!)
http://www.spywareinfo.com/~merijn/downloads.html

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/

IE-SPYAD (Free!)
http://www.staff.uiuc.edu/~ehowes/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

UPDATES and PATCHES
-------------------

Windows Update
http://windowsupdate.microsoft.com/

FIREWALL
--------

http://support.microsoft.com/?kbid=320855

ANTIVIRUS SOFTWARE
------------------

SPAM EMAIL/JUNK MAIL
--------------------

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

Startups
http://www.pacs-portal.co.uk/startup_content.php

Hope it helps.

--

windana1

unread,

Aug 18, 2004, 5:11:02 AM8/18/04

to

Victim #21199374@discussions.microsoft.com Outsource Victim #21199374

unread,

Aug 18, 2004, 3:19:01 PM8/18/04

to

Walter,

I recently found some information regarding how some spyware/adware may use
the AppInit_DLLs registry value to load their DLLs. I checked several
non-infected machines and noticed that this particular registry value was
null on all that I checked:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = {blank}

Obviously, Microsoft placed this registry value there for a reason. What
might typically be a legitimate use of this value? I'm just trying to make
sure that I do not take out something that belongs. Just to be safe, I
typically just rename a copy of the registry key with its original value.
But my curiosity compels me about this one.

"Walter Clayton" wrote:

> Generally all I use is AdAware first followed by SpyBot. There's a lot of
> overlap in the two tools, but they also concentrate on non-overlapping
> areas. It's also wise to follow up with installing SpywareBlaster. None of
> these require run time presences although SpyBot will offer to install such.
> No harm in doing so and in some instances, especially with multi-user
> machines, a necessity. The biggest issue is remembering to run them
> periodically after checking for updates. The latter is one of the reasons,
> other than not changing usage habits, that people get reinfected. It's
> easier to avoid being click happy than it is to clean up the mess
> afterwards.
>
> There are instances where AdAware/SpyBot may be neutralized or unable to
> clean something. I handle those on a case by case basis since you're looking
> at going with some highly specialized tools that if misused will leave the
> machine unbootable (note that there is a nasty that the current version of
> AdAware had been cleaning incorrectly that would make it impossible to log
> on to the machine without taking corrective action).
>
> Depending on your level of expertise there are some tools that circumvent
> issues with removing nasties that are resident in memory even in safe mode.
> If an XP machine is being disinfected I use a bootable CD created using
> Bart's tools with fully updated AdAware, Trendmicro, McAfee and Kaspersky
> tools (all free versions) incorporated. This also allows me to correct any
> registry issues on the host machine without any major hassles other than
> knowing what parts of the registry need be hacked. The reason I include and
> run AV scanners is generally if some one has a load of spyware it's not
> unusual they'll have nastier stuff as well.

>
> --
> Walter Clayton - MS MVP(WinXP)
> Associate Expert
> http://www.microsoft.com/windowsxp/expertzone
> Any technology distinguishable from magic is insufficiently advanced.
> http://www.dts-l.org
> http://support.microsoft.com/servicedesks/fileversion/default.asp|
>
>

> "Andrew" <And...@discussions.microsoft.com> wrote in message
> news:97E53975-D207-4D60...@microsoft.com...
> >
>
> >> I already know what Spyware can do and all to your computers but what is
> >> the best Spyware and Ad-aware remover programs out there I'm using Spybot
> >> 1.3 and Ad-aware 6.0 from Lavasoft and I heard having two good Spyware
> >> and Ad-aware remover programs that it will remove about 90% of Spyware
> >> and Ad-aware off your computer and keep it out.
>
>

Ronnie Vernon MVP

unread,

Aug 18, 2004, 8:25:15 PM8/18/04

to

Outsource Victim #21199374 wrote:
> Walter,
>
> I recently found some information regarding how some spyware/adware
> may use the AppInit_DLLs registry value to load their DLLs. I
> checked several non-infected machines and noticed that this
> particular registry value was null on all that I checked:
>
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
> NT\CurrentVersion\Windows AppInit_DLLs = {blank}
>
> Obviously, Microsoft placed this registry value there for a reason.
> What might typically be a legitimate use of this value? I'm just
> trying to make sure that I do not take out something that belongs.
> Just to be safe, I typically just rename a copy of the registry key
> with its original value. But my curiosity compels me about this one.
>

Found this on the MSDN website.

<quote>
Application Global Classes
An application global class is a window class registered by an executable or
dynamic-link library (DLL) that is available to all other modules in the
process. For example, your .dll can call the RegisterClassEx function to
register a window class that defines a custom control as an application
global class so that a process that loads the .dll can create instances of
the custom control.

Windows NT/Windows 2000/Windows XP: To create a class that can be used in
every process, create the window class in a .dll and load the .dll in every
process. To load the .dll in every process, add its name to the AppInit_DLLs
value in following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

Whenever a process starts, the system loads the specified .dll in the
context of the newly started process before calling its entry-point
function. The .dll must register the class during its initialization
procedure and must specify the CS_GLOBALCLASS style. For more information,
see Class Styles.

To remove an application global class and free the storage associated with
it, use the UnregisterClass function.
</quote>

About Window Classes (Windows User Interface):
http://msdn.microsoft.com/library/enus/winui/winui/windowsuserinterface/windowing/windowclasses/aboutwindow.asp?frame=true

Or

http://tinyurl.com/69na8
--
Regards,

Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
http://www.dts-l.org
http://www.mvps.org

Walter Clayton

unread,

Aug 18, 2004, 11:39:43 PM8/18/04

to

What Ronnie said. :-)

Walter Clayton

unread,

Aug 20, 2004, 3:07:29 PM8/20/04

to

A bit vague on the details, but, welcome to the world of serious crapware.
Cleaning these is a PITA at best.

You can go the route that Ronnie suggested or if you want to take a serious
stab at the problem yourself the easiest way is by creating a safe
environment that you can then use to rip the nasty out by the roots. That
requires some hefty technical expertise though.

First shot is to give TrendMicro a shot. Not knowing the exact variety of
the nasty you have I can't say one way or the other if Trend's package
addresses this specific nasty. Get the scanner here
http://www.trendmicro.com/download/dcs.asp and the signature file here
http://www.trendmicro.com/download/pattern-cpr.asp

Also, go here http://www.silentrunners.org/ and grab "silent runners.vbs".
When you run it, NAV will scream bloody murder. Tell NAV to let it run. This
will tell you what's hooked the system that's not part of a clean OS
install. Use *extreme* caution if you decide to address anything that this
tool points out. There are legitimate apps that hook the system in unusual
ways and people have flatlined systems past the point of recovery by doing
the wrong thing. If you need help analyzing the results, just copy and paste
the output file back here.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Zyklon -B" <Zyklon -B...@discussions.microsoft.com> wrote in message
news:F9AFD3A8-031D-4B67...@microsoft.com...

Walter Clayton

unread,

Aug 20, 2004, 3:11:48 PM8/20/04

to

I just went there about 10 minutes ago without any problems.

You may also want to add Autoruns from http://www.sysinternals.com (as well
as other nice tools they have) to your kit. Be careful about using it to
disable startup items though. The way the do it doesn't quite work.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Outsource Victim #21199374"
<OutsourceVi...@discussions.microsoft.com> wrote in message
news:B33CEBFA-3A95-49D7...@microsoft.com...

Walter Clayton

unread,

Aug 20, 2004, 3:13:43 PM8/20/04

to

Oops. I see the mistake. It's http://www.silentrunners.org !!

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Outsource Victim #21199374"

<OutsourceVi...@discussions.microsoft.com> wrote in message
news:B33CEBFA-3A95-49D7...@microsoft.com...

Davidd

unread,

Aug 20, 2004, 5:03:22 PM8/20/04

to

Could you provide more details? Assuming this is not a new configuration
then I would check to see if you have a defective drive cable or maybe a
defective drive.

Thanks,

Davidd
\
"Me" <M...@discussions.microsoft.com> wrote in message
news:7BE81AD4-082B-49A8...@microsoft.com...
> My disc drive dosen't show up, at all, what should I do?
>
> P.S.
> Only 11, need help fast!

Walter Clayton

unread,

Aug 21, 2004, 2:22:02 PM8/21/04

to

"bdhutch" <bdh...@discussions.microsoft.com> wrote in message
news:2BDB5605-C7D1-408A...@microsoft.com...
> Can you tell me whether there is ny protection from spyware when you log
> into
> Windows XP Home Edition without administrative privileges?

Only some protection. The problem is that a lot of the stuff operates within
the context of the user without violating existing security constraints.
Other users may be unaffected but the infected user has a miserable
experience.

>
> Since this type of user is not supposed to be able to install software,
> why
> does spy and ad software get through - if it does?

Several reasons, including the one above. There are escalation exploits that
happen as well, but that's typically a 'true' virus/trojan/worm behaviour
that's going to typically be caught by classic active AV scanning apps. Some
of these nasties exploit published security holes in unpatched systems, so
unpatched systems can be vicitimized easier.

>
> Could this possibly be an update that could be made by Microsoft
> themselves.
> or should there be a third type of user that would allow no changes
> whatsoever?

The latter does in fact exist on HE. It's called the guest account, but the
user experience is pretty dismal. However enabling the guest account opens
up it's own potential set of issues.

D@discussions.microsoft.com Brad D

unread,

Aug 21, 2004, 8:37:01 PM8/21/04

to

Simple question for a novice here. I have some crap default web page called
mypoiskovik pulling up no matter what I do. I can't delete the index that it
comes from and it is loading porn crap into favorites. I have loaded
everything Microsoft recommends and nothing....Can you tell me how to get rid
of this annoying crap.

Shenan Stanley

unread,

Aug 21, 2004, 8:40:28 PM8/21/04

to

Brad D wrote:
> Simple question for a novice here. I have some crap default web page
> called mypoiskovik pulling up no matter what I do. I can't delete
> the index that it comes from and it is loading porn crap into
> favorites. I have loaded everything Microsoft recommends and
> nothing....Can you tell me how to get rid of this annoying crap.

If you don't wish to follow all of the advice immediately, just want to

bert

unread,

Aug 22, 2004, 12:08:30 AM8/22/04

to

Which Drive.. A or C...

Walter Clayton

unread,

Aug 22, 2004, 2:12:42 PM8/22/04

to

Nasty critter:
http://www.google.com/search?hl=en&ie=UTF-8&q=mypoiskovik

Follow some of the links above for running CWShredder in safe mode followed
by HijackThis and if you're still having problems, post back with a HT log.
Note: Do *NOT* launch IE until the the homepage, etc. for IE have been reset
or you'll reinfect your self.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Brad D" <Brad D...@discussions.microsoft.com> wrote in message
news:A4516680-65A9-4598...@microsoft.com...

BABS

unread,

Aug 22, 2004, 2:31:01 PM8/22/04

to

"Michel" wrote:

> > --
> > Walter Clayton - MS MVP(WinXP)
> > Associate Expert
> > http://www.microsoft.com/windowsxp/expertzone
> > Any technology distinguishable from magic is insufficiently advanced.
> > http://www.dts-l.org
> > http://support.microsoft.com/servicedesks/fileversion/default.asp|
> >
> >

Barbara

unread,

Aug 22, 2004, 2:33:02 PM8/22/04

to

I am a complete novice. Sorry to insult you other readers. But, what is
spyware and how do you get it without installing it?

Shenan Stanley

unread,

Aug 22, 2004, 3:45:58 PM8/22/04

to

Barbara wrote:
> I am a complete novice. Sorry to insult you other readers. But,
> what is spyware and how do you get it without installing it?

What is Spyware?
http://webopedia.internet.com/TERM/s/spyware.html

More advice about Spyware and everything else to help protect you from the
evils of the Internet.
(Note that SP2 does have some additional security features for those running
Windows XP Home or Windows XP Professional (or superset of.) You should
install SP2 as soon as you can, but still follow the advice given below.)

SPYWARE/ADWARE/POPUPS
---------------------

CWSShredder (Free!)
http://www.spywareinfo.com/~merijn/downloads.html

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/

IE-SPYAD (Free!)
http://www.staff.uiuc.edu/~ehowes/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

UPDATES and PATCHES
-------------------

Windows Update
http://windowsupdate.microsoft.com/

FIREWALL
--------

http://support.microsoft.com/?kbid=320855

ANTIVIRUS SOFTWARE
------------------

SPAM EMAIL/JUNK MAIL
--------------------

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

Startups
http://www.pacs-portal.co.uk/startup_content.php

Hope it helps.

The information is provided "as is", it is suggested you research for
yourself before you take any advice - you are the one ultimately
responsible for your actions/problems/solutions. Know what you are
getting into before you jump in with both feet.

Walter Clayton

unread,

Aug 22, 2004, 8:46:16 PM8/22/04

to

Officially, spyware is software that installs itself without your explicit
permission that tracks your usage habits, hijacks your web experience and/or
force feeds advertisements. Adware, it's more 'legally acceptable' cousin,
does the same thing, supposedly with your explicit permission if you take
the time to read the fine print way down at the bottom of some massive
disclosure page so full of legalese that you're nodding off..... you get the
point. Unfortunately, contrary to the legalese, there's no telling what kind
of information is being captured and sold to whom ever. To complicate
matters, even for official 'adware', some else then has permission to throw
their crap on your machine with out your explicit permission and so on. It
becomes an avalanche.

In both instances the user experience is typically degraded since you're
being blasted with unwanted pop-ups and web page spawning. For dial-up users
it's really bad. There is also the usual degradation, generally severe, of
machine performance as well since now your entire machine has typically been
hijacked just to shove advertisement at you rather than letting you do what
you want with it.

How you get it is typically through two general methods. One is via using
published and patched security flaws in the system but that's more typical
of the more nasty variations which officially places them in category of
true malware. Most of the crapware comes from clicking seeming innocuous
links that purport to 'tune your system', 'make browsing faster', offer
financial rewards, etc. Typical snake oil stuff. Or in some instances a
pop-up is presented with only one option and that is to accept the install
(most people don't know that at that time the best thing is to simply use
task manager and kill your web browser). The latter tends to be done by
some of the more nasty varieties.

--
Walter Clayton - MS MVP(WinXP)
Associate Expert
http://www.microsoft.com/windowsxp/expertzone
Any technology distinguishable from magic is insufficiently advanced.
http://www.dts-l.org
http://support.microsoft.com/servicedesks/fileversion/default.asp|

"Barbara" <Bar...@discussions.microsoft.com> wrote in message
news:4BBD9926-C9FF-45D1...@microsoft.com...

Michael

unread,

Aug 24, 2004, 6:59:02 AM8/24/04

to

I ran Spybot S&D this evening and found alot of entries that needed
attention. I am experiencing problems now when I am logged on as
administrator, in IE6SP1. I can no longer access the internet options and I
get a restriction message.
("this operation has been cancelled due to restrictions in effect on this
computer. " please contact your system admin. Problem is, I am logged on as
system admin.
I am running XP and have multipul user logons for several family members,
including a user account for myself, so I'm not compromising security surfing
logged on as an administrator. I have seen posts about this problem related
to WIN2000, WIN95, etc..., but nothing for XP. Since alot of the solutions
required registry changes, I wanted advice , If you can help, about what
happened and how to fix it?

Ronnie Vernon MVP

unread,

Aug 24, 2004, 11:01:27 AM8/24/04

to

Michael wrote:
> I ran Spybot S&D this evening and found alot of entries that needed
> attention. I am experiencing problems now when I am logged on as
> administrator, in IE6SP1. I can no longer access the internet options
> and I get a restriction message.
> ("this operation has been cancelled due to restrictions in effect on
> this computer. " please contact your system admin. Problem is, I am
> logged on as system admin.
> I am running XP and have multipul user logons for several family
> members, including a user account for myself, so I'm not compromising
> security surfing logged on as an administrator. I have seen posts
> about this problem related to WIN2000, WIN95, etc..., but nothing for
> XP. Since alot of the solutions required registry changes, I wanted
> advice , If you can help, about what happened and how to fix it?
>

If possible, use Spybot to identify the nasty program associated with this
behavior and let us know. In the mant time, try these fixes.

1. Open Control Panel/Internet Options/Programs tab and click the Reset Web
Settings button. Exit and start IE to check if the problem is fixed.

If no joy, try this.

2. Go to Start / Run and type regedit and click OK. This will open the
registry editor. Navigate to the following key:

HKEY CURRENT USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions

In the right pane, check to see if the Nobrowseroptions entry exists.
If so, right click the Nobrowseroptions entry, then click on delete and
confirm
that you want to delete it. Press the F5 key and close the registry editor.

Chris Norred [MSFT]

unread,

Aug 24, 2004, 6:43:05 PM8/24/04

to

I want to take time to say thank you to Walter Clayton and all of the
experts who've contributed to this thread for sharing their time and
experience over the past couple weeks. Also, thank you to the
less-experienced users who've posted their questions here.

This was a trial effort in linking from the Windows XP Expert Zone Web site
to a thread in the public newsgroups. You all have contributed a wealth of
information about adware and spyware to this thread and we'll do our best to
make it easy for users to find it. There was a lot of useful feedback for us
to consider also.

The discussion thread will continue as long as there is interest, of course,
and we will continue to link to it from the Expert Zone Web site archives on
Microsoft.com.

-

Gsx

unread,

Aug 25, 2004, 3:09:01 AM8/25/04

to

Hi,

we have been dealing with all this malevolent code for years, so I can
understand the scepticism of some people out there saying that the necessary
tools exist and that whoever tries to keep their workstations and servers
acap (as clean as possible) and up'n'running, would already have the skills
to do so in an effective way, or would be able to.
However, we also know that advertising is an evolving and very aggresive
market, a multi-million business.
So although I'm sure there are thousands of similar threads to be found
around the net (threads where actual useful info is exchanged), it does
strike me as odd that M$ would invest time and (H)R at this specific moment
to state the obvious.

I guess it won't be long before M$ incorporates spyware/malware removal
tools in its OS'es, if only to prevent users from using freeware. Pun
intended...

Think of it what you will, I think all this time and effort is more wasted
than anything else if M$ keeps clinging to it's well-known patching strategy.

Windows has become so over-patched that you could put holes in it the size
of Alaska that no-one would know (care?) about until some 15yr-old writes an
exploit for it and some ceo's grandma complains about unwanted porn or spam...

Still, we've ended up with a ring of trusted software and hardware
companies, a kind of guild if you will, making sure that everyone gets paid
at the end of the day, making sure that what is shall always be. The circle
of life is complete.

you spend your breath discussing the beast you have created and cannot kill
because it feeds your kids and pays your wives. It's like mobsters
complaining over a cappucino that they dislike the fraud and the killing...

I think it better that you just mail a bill to all six-and-change billion of
us, just tell us what we owe you and we will pay like the sheep that we are,
but please stop acting like you actually care, because it's getting old.

Louis

unread,

Aug 29, 2004, 4:09:11 PM8/29/04

to

I have a hp / compaq nc6000 loaded with XP Pro. I need a printer driver for
an hp Laser Jet 6P. I tried to load one from HP and was told that the driver
may not be compatible with XP. I could not find a driver with the MS Logo.
Your help is appreciated.

"Chris Norred [MSFT]" wrote:

> Hello and welcome to our first Ask-the-Experts discussion, moderated by the Windows XP Expert Zone Community. This is a new trial effort and our goal is to make it easy for you to ask questions and find answers on a specific topic from a recognized expert in the online community. We’ll continue this discussion in the newsgroups for one week and our volunteer expert will select one or two questions each day and respond. Other experts and users online may also chime in with advice. At the end of the week, we hope to have a single thread filled with good information that can be preserved for the benefit of other users in the future.
>
> This week, our expert host is volunteer MVP Walter Clayton who will be discussing the topic of spyware and adware and his experience helping users in the newsgroups deal with spyware issues. Walter is an IT professional from Frankfort, Kentucky. He is a self-trained computing pro with 20 years of experience, and he has been helping people in the online community for many years. Walter is a recipient of the Microsoft Most Valuable Professional (MVP) award for his volunteer efforts helping Windows users over the past five years.
> A quote from Mr. Clayton:
> “I enjoy working the newsgroups because it forces me to think and learn. Everyday I get a slightly different perspective on something or see a new situation or problem. There is also the challenge of keeping communication skills sharp. Determining the answer to a problem, and communicating it in the newsgroups can present its own set of challenges, especially at times when the wrong answer can leave the user in a no-boot situation.”
>
> Our Ask the Experts discussion is different from the live chats hosted on the Windows XP Expert Zone Community site (http://communities2.microsoft.com/home/chatroom.aspx?siteid=34000077).
>
> In these discussions, you may not get an immediate answer. The hosts will check-in at a time convenient for them and answer questions. You can post a question any time. Then you may want to add the discussion to your Favorites list in Internet Explorer (Click Favorites, and then click Add to Favorites). You should check back later in the day, or the next day, to see if your question has been answered. Click the Refresh button to see if any new posts were added while you have been reading. If you’re more comfortable using Outlook Express or another newsreader, please do.
>
> To post a question or reply in this discussion, using the Web-based newsgroup reader:
> 1. Click Reply.
> 2. If prompted, sign in with your .NET Passport.
> 3. Edit the subject line if you like.
> 4. In the Reply form, type your message or question in the Message box.
> 5. Review the text you typed in the Body box to make sure it says what you want; you cannot revise your message after you click Post.
> 6. To receive e-mail notification when someone posts to this thread, select the Notify me of replies check box.
> 7. Click Send.
>
> This is a new trial effort and your feedback and assistance are appreciated. We’ll keep links to these discussions in the Windows XP Expert Zone Community Columns Archive
> (http://www.microsoft.com/windowsxp/expertzone/columns/archive.mspx).
> Truly

Shenan Stanley

unread,

Aug 29, 2004, 5:01:53 PM8/29/04

to

Louis wrote:
> I have a hp / compaq nc6000 loaded with XP Pro. I need a printer
> driver for an hp Laser Jet 6P. I tried to load one from HP and was
> told that the driver may not be compatible with XP. I could not find
> a driver with the MS Logo. Your help is appreciated.

If it is just a warning when installing, something about signed drivers -
ignore and install *if* you downloaded the XP versioon from HP.

Go4thTW

unread,

Sep 16, 2004, 6:27:02 PM9/16/04

to

Hi There

My name is Georgina, thoroughly frustrated with my XP Home Edition- setup!!
I get the Error message 797- I have restored my computer, time and time
again..To get the silly thing to connect to the Internet.I have run the
Spybot Search and Destroy, it keeps picking up 3 -4 problems, throwing them
out. The Error message, returns now and again. I have investigated phones and
modems, where the modem- reads..Not Functional..after, restoring, its all
operational again..Help!!!!

Shenan Stanley

unread,

Sep 16, 2004, 7:10:48 PM9/16/04

to

Go4thTW wrote:
> My name is Georgina, thoroughly frustrated with my XP Home Edition-
> setup!! I get the Error message 797- I have restored my computer,
> time and time again..To get the silly thing to connect to the
> Internet.I have run the Spybot Search and Destroy, it keeps picking
> up 3 -4 problems, throwing them out. The Error message, returns now
> and again. I have investigated phones and modems, where the modem-
> reads..Not Functional..after, restoring, its all operational
> again..Help!!!! .

If all you used was Spybot Search and Destroy, your are greatly
under-equipped to maintain/optimize your system.

*WARNING* This is a LONG spill, all in plain text and simplified so that
even non-techs should be able to understand it. Hopefully this will
assist some people in not only repairing their systems, but in making
them faster and more stable tools for them to use. It contains advice
on many things, many considered "common knowledge" to 'IT' people
everywhere. It is split into major sections, hopefully this will make
it easier to navigate. *WARNING*

Suggestions on what you can do to secure/clean your PC. Every attempt
has been made to be general and an assumption of a "Windows" operating
system is made here as well - although in some ways, this could be
adapted to any OS.

GENERAL UPKEEP AND CLEANUP
--------------------------

You should periodically defragment your hard drives as well as check them
for errors.

How to Defragment your hard drives
http://support.microsoft.com/?kbid=314848

How to scan your disks for errors
http://support.microsoft.com/?kbid=315265

How to use Disk Cleanup
http://support.microsoft.com/?kbid=310312

You should also empty your Internet Explorer Temporary Internet
Files and make sure the maximum size for this is small enough not to cause
trouble in the future. Empty your Temporary Internet Files and shrink the
size it stores to a size between 120MB and 480MB..

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section, do the
following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the "Amount of disk space to use:" to
something between 120MB and 480MB. (Betting it is MUCH larger right
now.)
- Click OK.
- Click on "Delete Files" and select to "Delete all offline contents"
(the checkbox) and click OK. (If you had a LOT, this could take 2-10
minutes or more.)
- Once it is done, click OK, close Internet Explorer, re-open Internet
Explorer.

Uninstall any software you no longer use or cannot remember installing
(ask if it is a multi-user PC) - but only if you are sure you do not
need it and/or you have the installation media around to reinstall if
you need to. http://snipurl.com/8v6b may help you accomplish this.

If things are running a bit slow or you have an older system
(1.5GHz or less and 256MB RAM or less) then you may want to look into
tweaking the performance a bit by turning off some of the memory
using Windows XP "prettifications". The fastest method is:

Control Panel --> System --> Advanced tab --> Performance section,
Settings button. Then choose "adjust for best performance" and you
now have a Windows 2000/98 look which turned off many of the annoying
"prettifications" in one swift action. You can play with the last
three checkboxes to get more of an XP look without many of the
other annoyances. You could also grab and install/mess with one
(or more) of the Microsoft Powertoys - TweakUI in particular:

http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx

You should also verify that your System Restore feature is enabled and
working properly. Unfortunately, if seems to have issues on occasion,
ones that can easily be avoided by turning off/on the system restore and
make a manual restoration point as one of your periodic maintenance tasks.
This is particularly important right before installing something major
(or even minor if you are unsure what it might do to your system.)
(This, of course, will erase any previous restore point you have.)

Turn off System Restore.
http://support.microsoft.com/?kbid=310405

Reboot.

Turn on System Restore.
http://support.microsoft.com/?kbid=310405

Make a Manual Restoration Point.
http://snipurl.com/68nx

Also, you should look into backing up your valuable files and folders.
http://support.microsoft.com/?kbid=308422

And keep your original installation media (CDs, disks) safe with their
CD keys and such. Make backups of these installation media sets as
well and always use strong passwords. Good passwords are those that
meet these general rules (mileage may vary):

Passwords should contain at least six characters, and the character
string should contain at least three of these four character types:
- uppercase letters
- lowercase letters
- numerals
- nonalphanumeric characters (e.g., *, %, &, !)

Passwords should not contain your name/logon name.

UPDATES and PATCHES
-------------------

** Side Note: *IF* you are about to install Service Pack 2 (SP2) for
Windows XP, I suggest you clean up your system first. Uninstall any
applications you do not use. Update any that you do. Download the
latest drivers for your hardware devices. Defragment and run a full
CHKDSK on your hard drives. Scan your system and clean it of any
Spyware/Adware/Malware and for Viruses and Trojans. Below you will
find advice and links to applications that will help you do all of
this. If this advice helps you, please - pass it on. Print it,
email it, forward it to anyone you think it might help. A little
knowledge might help prevent lots of trouble.

This one is the most obvious. There is no perfect product and any company
worth their salt will try to meet/exceed the needs of their customers and
fix any problems they find along the way. I am not going to say Microsoft
is the best company in the world about this but they do have an option
available for you to use to keep your machine updated and patched from
the problems and vulnerabilities (as well as product improvements in some
cases) - and it's free to you.

Windows Update
http://windowsupdate.microsoft.com/

Go there and scan your machine for updates. Always get the critical ones as
you see them. Write down the KB###### or Q###### you see when
selecting the updates and if you have trouble over the next few days,
go into your control panel (Add/Remove Programs), match up the latest
numbers you downloaded recently (since you started noticing an issue) and
uninstall them. If there was more than one (usually is), install them back
one by one - with a few hours of use in between, to see if the problem
returns. Yes - the process is not perfect (updating) and can cause trouble
like I mentioned - but as you can see, the solution isn't that bad - and is
MUCH better than the alternatives.

Windows is not the only product you likely have on your PC. The

manufacturers of the other products usually have updates as well. New
versions of almost everything come out all the time - some are free, some
are pay - some you can only download if you are registered - but it is best
to check. Just go to their web pages and look under their support and

download sections. For example, for Microsoft Office update, you should
visit:

Microsoft Office Updates
http://office.microsoft.com/
(and select "downloads")

You also have hardware on your machine that requires drivers to interface
with the operating system. You have a video card that allows you to see on
your screen, a sound card that allows you to hear your PCs sound output and
so on. Visit those manufacturer web sites for the latest downloadable
drivers for your hardware/operating system. Always (IMO) get the
manufacturers hardware driver over any Microsoft offers. On the Windows
Update site I mentioned earlier, I suggest NOT getting their hardware

drivers - no matter how tempting. First - how do you know what hardware
you have in your computer? Invoice or if it is up and working now - take
inventory:

Belarc Advisor
http://belarc.com/free_download.html

Once you know what you have, what next? Go get the latest driver for your
hardware/OS from the manufacturer's web page. For example, let's say you
have an NVidia chipset video card or ATI video card, perhaps a Creative
Labs sound card or C-Media chipset sound card...

NVidia Video Card Drivers
http://www.nvidia.com/content/drivers/drivers.asp

ATI Video Card Drivers
http://www.atitech.com/support/driver.html

Creative Labs Sound Device
http://us.creative.com/support/downloads/

C-Media Sound Device
http://www.cmedia.com.tw/e_download_01.htm

As for Service Pack 2 (SP2) for Windows XP, Microsoft has made this
particular patch available in a number of ways. First, there is the
Windows Update web page above. Then there is a direct download site
and finally, you can order the FREE CD from Microsoft.

Direct Download of Service Pack 2 (SP2) for Windows XP
http://snipurl.com/8bqy

Order the Free Windows XP SP2 CD
http://snipurl.com/8umo

Microsoft also have a bunch of suggestions, some similar to these,

on how to better protect your Windows system:

Protect your PC
http://www.microsoft.com/security/protect/

FIREWALL
--------

Let's say you are up-to-date on the OS (operating system) and you have
Windows XP.. You should at least turn on the built in firewall. That will
do a lot to "hide" you from the random bad things flying around the
Internet. Things like Sasser/Blaster enjoy just sitting out there in
Cyberspace looking for an unprotected Windows Operating System and jumping
on it, doing great damage in the process and then using that Unprotected OS
to continue its dirty work of infecting others. If you have the Windows XP

FW turned on - default configuration - then they cannot see you! Think of

it as Internet Stealth Mode at this point. It has other advantages, like
actually locking the doors you didn't even (likely) know you had. Doing

this is simple, some helpful tips for the SP2 enabled firewall can be found
here:

http://www.microsoft.com/technet/community/columns/cableguy/cg0204.mspx

If you read through that and look through the pages that are linked from it

throughout - I think you should have a firm grasp on the basics of the

Windows XP Firewall as it is today. One thing to note RIGHT NOW - if you
have AOL, you cannot use this nice firewall that came with your system.
Thank AOL, not Microsoft. You HAVE to configure another one.. So we
continue with our session on Firewalls...

But let's say you DON'T have Windows XP - you have some other OS like
Windows 95, 98, 98SE, ME, NT, 2000. Well, you don't have the nifty built in
firewall. My suggestion - upgrade. My next suggestion - look through your
options. There are lots of free and pay firewalls out there for home users.
Yes - you will have to decide on your own which to get. Yes, you will have
to learn (oh no!) to use these firewalls and configure them so they don't
interfere with what you want to do while continuing to provide the security
you desire. It's just like anything else you want to protect - you have to
do something to protect it. Here are some suggested applications. A lot of
people tout "ZoneAlarm" as being the best alternative to just using the

Windows XP FW, but truthfully - any of these alternatives are much better
than the Windows XP FW at what they do - because that is ALL they do.

ZoneAlarm (Free and up)
http://snipurl.com/6ohg

Kerio Personal Firewall (KPF) (Free and up)
http://www.kerio.com/kpf_download.html

Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/download/

Sygate Personal Firewall (Free and up)
http://smb.sygate.com/buy/download_buy.htm

Symantec's Norton Personal Firewall (~$25 and up)
http://www.symantec.com/sabu/nis/npf/

BlackICE PC Protection ($39.95 and up)
http://blackice.iss.net/

Tiny Personal Firewall (~$49.00 and up)
http://www.tinysoftware.com/

That list is not complete, but they are good firewall options, every one of
them. Visit the web pages, read up, ask around if you like - make a
decision and go with some firewall, any firewall. Also, maintain it.
Sometimes new holes are discovered in even the best of these products and
patches are released from the company to remedy this problem. However, if
you don't get the patches (check the manufacturer web page on occasion),
then you may never know you have the problem and/or are being used through
this weakness. Also, don't stack these things. Running more than one
firewall will not make you safer - it would likely (in fact) negate some

protection you gleamed from one or the other firewalls you run.

ANTIVIRUS SOFTWARE
------------------

That's not all. That's one facet of a secure PC, but firewalls don't do
everything. I saw one person posting on a newsgroup that "they had
never had a virus and they never run any anti-virus software." Yep - I used
to believe that way too - viruses were something everyone else seemed to

get, were they just careless? And for the average joe-user who is careful,
uses their one to three family computers carefully, never opening unknown
email attachments, always visiting the same family safe web sites, never

installing anything that did not come with their computer - maybe, just
maybe they will never witness a virus. I, however, am a Network Systems
Administrator. I see that AntiVirus software is an absolute necessity given
how most people see their computer as a toy/tool and not something
they should have to maintain and upkeep. After all, they were invented to
make life easier, right - not add another task to your day. You
can be as careful as you want - will the next person be as careful? Will
someone send you unknowingly the email that erases all the pictures of your
child/childhood? Possibly - why take the chance? ALWAYS RUN ANTIVIRUS
SOFTWARE and KEEP IT UP TO DATE! Antivirus software comes in so many
flavors, it's like walking into a Jelly Belly store - which one tastes like
what?! Well, here are a few choices for you. Some of these are free (isn't
that nice?) and some are not. Is one better than the other - MAYBE.

Symantec (Norton) AntiVirus (~$11 and up)

http://www.symantec.com/nav/nav_9xnt/

Kaspersky Anti-Virus (~$49.95 and up)
http://www.kaspersky.com/products.html

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

AVG 6.0 Anti-Virus System (Free and up)
http://www.grisoft.com/

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

AntiVir (Free and up)
http://www.free-av.com/

avast! 4 (Free and up)
http://www.avast.com/

Trend Micro (~$49.95 and up)

http://www.trendmicro.com/en/home/us/personal.htm

(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/

Did I mention you have to not only install this software, but also keep it
updated? You do. Some of them (most) have automatic services to help you
do this - I mean, it's not your job to keep up with the half-dozen or more
new threats that come out daily, is it? Be sure to keep whichever one you
choose up to date!

SPYWARE/ADWARE/POPUPS/HIJACKS
-----------------------------

So you must be thinking that the above two things got your back now - you
are covered, safe and secure in your little fox hole. Wrong! There are
more bad guys out there. There are annoyances out there you can get without

trying. Your normal web surfing, maybe a wrong click on a web page, maybe
just a momentary lack of judgment by installing some software packages
without doing the research.. And all of a sudden your screen starts filling
up with advertisements or your Internet seems much slower or your home page
won't stay what you set it and goes someplace unfamiliar to you. This is
spyware. There are a whole SLEW of software packages out there to get rid
of this crud and help prevent reinfection. Some of the products already
mentioned might even have branched out into this arena. However, there are
a few applications that seem to be the best at what they do, which is
eradicating and immunizing your system from this crap. Strangely, the best
products I have found in this category ARE generally free. That is a trend
I like. I make donations to some of them, they deserve it!

Two side-notes: Never think one of these can do the whole job.
Try the first 5 before coming back and saying "That did not work!"
Also, you can always visit:
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.

Spybot Search and Destroy (Free!)

http://www.safer-networking.net/en/download/index.html

Lavasoft AdAware (Free and up)

http://www.lavasoft.de/support/download/

CWShredder (Free!)
** No longer updated as of July 29, 2004 - however, still a great
product and should still be ran **
http://www.softbasket.com/download/s_8114.shtml

Hijack This! (Free)
http://mjc1.com/mirror/hjt/

( Tutorial: http://hjt.wizardsofwebsites.com/ )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html

IE-SPYAD (Free!)
https://netfiles.uiuc.edu/ehowes/www/resource.htm

ToolbarCop (Free!)
http://www.mvps.org/sramesh2k/toolbarcop.htm

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/

Browser Security Tests
http://www.jasons-toolbox.com/BrowserSecurity/

Popup Tester
http://www.popuptest.com/

The Cleaner (49.95 and up)
http://www.moosoft.com/

That will clean up your machine of the spyware, given that you download and
install several of them, update them regularly and scan with them when you

update. Some (like SpywareBlaster and SpyBot Search and Destroy and
IESPYAD)
have/are immunization utilities that will help you prevent your PC from

being
infected. Use these features!

Unfortunately, although that will lessen your popups on the Internet/while
you are online, it won't eliminate them. I have looked at a lot of options,
seen a lot of them used in production with people who seem to attract popups
like a plague, and I only have one suggestion that end up serving double
duty (search engine and popup stopper in one):

The Google Toolbar (Free!)
http://toolbar.google.com/

Yeah - it adds a bar to your Internet Explorer - but its a useful one. You
can search from there anytime with one of the best search engines on the
planet (IMO.) And the fact it stops most popups - wow - BONUS! If you
don't like that suggestion, then I am just going to say you go to

www.google.com and search for other options. Please notice that Windows XP
SP2 does help stop popups as well. Another option is to use an alternative
Web browser. I suggest "Mozilla Firefox", as it has some great features
and is very easy to use:

Mozilla Firefox
http://www.mozilla.org/products/firefox/

One more suggestion, although I will suggest this in a way later, is to
disable your Windows Messenger service. This service is not used frequently
(if at all) by the normal home user and in cooperation with a good firewall,
is generally unnecessary. Microsoft has instructions on how to do this for
Windows XP here:

http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

SPAM EMAIL/JUNK MAIL
--------------------

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

or anything - especially on today's 2+ GHz machines, however - I look at

Startups
http://www.pacs-portal.co.uk/startup_content.php

Hope it helps.

--

to computers@discussions.microsoft.com newbie to computers

unread,

Oct 12, 2004, 3:53:06 AM10/12/04

to

when I send documents from home to work they appear as what might as well be
heiroglyphics, how do I resolve this?

Malvern

unread,

Oct 12, 2004, 1:09:27 PM10/12/04

to

unread,

Oct 21, 2004, 4:59:04 PM10/21/04

to

Hi! BB

Java Webstart is an application to write java code or program.It only works
when
connected to the Internet.
In your problem,you can't open links using Javascript. I don't catch it.What
do you mean? Do you mean you can't access the links on web pages?

Ken Blake

unread,

Oct 21, 2004, 4:59:55 PM10/21/04

to

In news:8C426BB2-14A7-4073...@microsoft.com,
BB <B...@discussions.microsoft.com> typed:

> Lately I am not able to successfully click on any link that
> uses
> Javascript. I have Java Web Start on my computer (not sure what
> it is
> or how it got there) & from another newsgroup they suggested I
> install Java

If you can't use Javascript, installing Java won't help you. They
are two different things, unfortunately with similar-enough names
that many people get confused.

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup

unread,

Oct 25, 2004, 3:59:21 PM10/25/04

to

"BB" <B...@discussions.microsoft.com> wrote in message
news:8C426BB2-14A7-4073...@microsoft.com

If your problem is with JavaScript rather than Java,

1. You might want to refresh your scripting engine:
http://msdn.microsoft.com/library/default.asp?url=/nhp/default.asp?contentid=28001169
or
http://msdn.microsoft.com/library/default.asp?url=/downloads/list/webdev.asp
Windows Script 5.6 for Windows 2000 and XP
http://www.microsoft.com/downloads/details.aspx?FamilyID=c717d943-7e4b-4622-86eb-95a22b832caa&DisplayLang=en

Sometimes there's a corrupt file in the cache and one must go to Tools |
Internet Options and click Delete Files.

2a. Start>Run>Regsvr32 vbscript.dll

2b. Start>Run>Regsvr32 jscript.dll

(WinXP users who have problems with 2a and 2b, see
http://www.mvps.org/inetexplorer/answers_9.htm)

3. Re-register all DLLs listed in http://support.microsoft.com/?kbid=281679

4. See also
Error Message When You Browse the Web: An Error Has Occurred in the Script
on This Page
http://support.microsoft.com/?kbid=306831
Scripting Errors When You View Web Pages in Internet Explorer after
Installing Office 2003
http://support.microsoft.com/?kbid=822521

5a. IE Tools>Internet Options>Advanced>Browsing>Enable third-party browser
extensions (uncheck & reboot).

5b. Find the hijacker that caused 5a to be checked (or if none were checked,
check for hijackware anyway):

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://aumha.org/a/parasite.htm
http://www.mvps.org/inetexplorer/Darnit.htm

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com

Max

unread,

Dec 26, 2004, 1:49:01 AM12/26/04

to

A number of programs I've downloaded are prevented from
installing. I get the message: "System Administrator
policies do not permit installation."...or something to
that effect.

I am the only one who uses my desktop running under XP Professional.
Thus, I am the "System Administrator" and as such I have
never instituted such a "policy."

What can I do to correct this horrible injustice!

mtir...@msn.com