Medical Forum / Diseases and Disorders / Prostate Cancer / May 2004
OT... Techie question, please?
|
|
Thread rating:  |
MH - 24 May 2004 03:29 GMT I have Internet Explorer as my browser. I recently noticed a new toolbar has been added... *ISearch*. I've tried to remove it using the add/remove programs feature, but can't do that. It's not listed. I removed the installation program from the temp directory, and can't find any other trace of it. But I can't get rid of the blasted thing, and I'm getting popups. It's aggravating! Anyone familiar with this... and got any suggestions on how to get rid of it?
Thanks! MikeH
Heather - 24 May 2004 03:55 GMT Yep.....Browser Hijacker. I found references to it on Google and Spyware forums.
Here is their website that has the ISearch removal tool ......but it is a *toolbar* that you probably never knew you had.......
http://toolbar.isearch.com/uninstall/
Frankly, I would download AdAware 6 from Lavasoft, update it and then run it......don't be surprised if you have a lot more than that on your computer, grin. I run AdAware or Spybot every day.....but I also have some free special anti-spyware proggies on here that prevent them from downloading.
If you have anymore problems, write me and I will have you download HiJack This (a must on my desktop) and tell you where to send it for analysis. I can read most of the Logs, but prefer an expert to do it.
Cheers.....Auntie Virus ( heatherfig at rogers.com )
> I have Internet Explorer as my browser. I recently noticed a new toolbar > has been added... *ISearch*. I've tried to remove it using the add/remove [quoted text clipped - 6 lines] > Thanks! > MikeH Heather - 24 May 2004 04:00 GMT Did some more research.......use AdAware 6 to get rid of this.....and also keep AA updated.....there have been 4 in 48 hours. Spyware and browser hijackers are the latest malware......sneaky ***tards. (G)
http://lavasoft.element5.com/support/download/
Cheers....Heather
> Yep.....Browser Hijacker. I found references to it on Google and Spyware > forums. [quoted text clipped - 27 lines] > > Thanks! > > MikeH MH - 24 May 2004 04:09 GMT Thank you ALL so much!! I used the link below to uninstall this blasted thing. It worked! Now I'm going to use the AdAware to see what else is lurking about! Geez, can't turn your back for a second!!
Thanks again!
MikeH
> Yep.....Browser Hijacker. I found references to it on Google and Spyware > forums. [quoted text clipped - 27 lines] > > Thanks! > > MikeH Heather - 24 May 2004 04:19 GMT Glad to hear that. Spyware/browser hijackers/CWS and more.....they are the pains in the butt these days. No one should be without AdAware or Spybot Search & Destroy......but Spybot is a bit less user-friendly (I hate buzzwords.....grin).
I must have at least 6 anti-spyware proggies on my desktop as a *just in case*.....have had to take it off my friends' computers. If you are using a firewall, none of it can phone home tho.
Another one to download is SpywareBlaster.....it is not an anti-spyware program as such, but it prevents spyware from downloading. I was amazed at how much it stopped. I usually had 2-4 spyware cookies per day......rarely get them now.
http://www.javacoolsoftware.com/spywareblaster.html
Heather
> Thank you ALL so much!! > I used the link below to uninstall this blasted thing. [quoted text clipped - 41 lines] > > > Thanks! > > > MikeH MH - 25 May 2004 00:05 GMT Thanks, Heather.... Everyone is such a help with these techie questions!!
MikeH
> Another one to download is SpywareBlaster.....it is not an anti-spyware > program as such, but it prevents spyware from downloading. I was amazed at > how much it stopped. I usually had 2-4 spyware cookies per day......rarely > get them now. > > http://www.javacoolsoftware.com/spywareblaster.html ButtercupsDad@dog.net - 24 May 2004 13:29 GMT Before you know it you'll need a 120 gig hard drive to hold all the programs to combat this crap.
Heather: If I can please ask a Zone Alarm Pro questions, is there ever an instance where I want a program to "act as a server"? So far I have answered no, but just wonder about the ramifications?
Thank you. David S.
>Yep.....Browser Hijacker. I found references to it on Google and Spyware >forums. [quoted text clipped - 27 lines] >> Thanks! >> MikeH Heather - 24 May 2004 18:04 GMT Hi David......
ZAPro can be very confusing and there is a forum where you can ask questions, and I have done so at times. I just checked to see which ones I allow to access the internet, because I know there should be two. ICQ and WinMX (music downloading program). Yes, they both have server rights, and I am relatively comfortable with that. However ICQ is rarely used and is as tight (as in security) as I can make it.
I am using ZAPro Version 4.5.538 and was using a Version 2.xxx.....so there are big changes that I see in this version. I never use the latest version of ZAPro because there are always bugs that need to be ironed out with them. I really believe they 'beta test' them on the public, grin.
That said, I was reading the Help Index and am copying over what they say about granting server rights.....
(start of copy) Relatively few programs on your computer will require server permission. Some common types of programs that do are:
Chat Internet Call Waiting Music file sharing (such as Napster) Streaming Media (such as RealPlayer) Voice-over-Internet Web meeting
Exercise caution when granting permission for programs to act as a server, as Trojan horses and other types of malware often need server rights in order to do mischief. Permission to act as a server should be reserved for programs you know and trust, and that need server permission to operate properly. (end of copy)
As you can see, I have one Chat and one Music Sharing, and these two have always had server rights because they won't operate properly without them. I have never (touch wood) had any problems with them in 3 or 4 years.
If you are not using any of the above, then deny rights. However, the mere fact that something (or more than one) is asking for server rights means to me that they might fall into the above categories.
I hope I answered your question......but ZA leans toward paranoia at times and you have to be the best judge of what you allow to access the internet. The 'Purists' would disagree with me, but I have to find that fine line between 'safe computing' and paranoia.....grin. I do that with all of my security programs.....and I have quite a few.
Cheers.....Heather
PS......for anyone using EZ Trust antivirus, there is a new version out and it is excellent. Ditto for Spybot S & D.
> Before you know it you'll need a 120 gig hard drive to hold > all the programs to combat this crap. [quoted text clipped - 5 lines] > Thank you. > David S. David S. - 25 May 2004 01:36 GMT Heather: Thank you for the help! David
> Hi David...... > [quoted text clipped - 59 lines] > > Thank you. > > David S. Alan Meyer - 25 May 2004 04:36 GMT > Before you know it you'll need a 120 gig hard drive to hold > all the programs to combat this crap. > > Heather: If I can please ask a Zone Alarm Pro questions, is there > ever an instance where I want a program to "act as a server"? So far > I have answered no, but just wonder about the ramifications? David,
I recommend that you always say No to that question. Then, if the program doesn't work, try again and say yes.
I think I have only encountered one program that attempted to be a server and the Help file explained why. I have never ever seen a program that attempted to be a server tell the user that it was going to do that.
I have also never seen a case where a program acting as a server on a PC was doing something useful for the user, as opposed to useful to the people that distributed the program.
Alan
ButtercupsDad@dog.net - 25 May 2004 13:09 GMT Alan: Thank you for the response. As I looked at the box that kept coming up asking that question about "acting as a server", I wondered what that really meant. It kind of sounded like I was making my pc available to someone else to use it for their purpose. From what I have read here it sounds like that is more or less on target. I will keep responding "No". One thing I have noticed is that the check box for "remember this answer the next time" is often not active, so it looks like the system will persist asking this each time. I wonder if that is Zone Alarm at work or the underlying program smart enough to disable the check box? Or am I getting paranoid? (or maybe just "more" parnoid?). Thank you again. David
>> Before you know it you'll need a 120 gig hard drive to hold >> all the programs to combat this crap. [quoted text clipped - 21 lines] > > Alan Alan Meyer - 27 May 2004 05:20 GMT > Alan: > Thank you for the response. As I looked at the box that kept [quoted text clipped - 3 lines] > have read here it sounds like that is more or less on target. I will > keep responding "No". "Acting as a server" means that the program accepts requests to connect by other computers. As examples, a web server mail server, or news server open the door as it were and invite requests from other computers to connect.
Normally, none of the software on your computer should act as a server. Your web browser or email program will connect to the outside world, but only when you tell them to. They won't allow the outside world to connect to you - except to reply to requests that they sent out.
Programs that try to act as servers are typically doing one of two things: They are accepting connections from other computers on your internal network - if you have one, or they are accepting connections from the whole world, the Internet. The former _may_ be legitimate if the program provides service to your home network, though often it's not legitimate. The latter is never legitimate unless you are intending to run a public service.
One nefarious use of acting as a server is to allow someone to send advertisements to you which pop up unexpectedly. Another is to accept hacking requests.
> One thing I have noticed is that the check box for "remember > this answer the next time" is often not active, so it looks like the > system will persist asking this each time. I wonder if that is Zone > Alarm at work or the underlying program smart enough to disable the > check box? Or am I getting paranoid? (or maybe just "more" > parnoid?). I haven't seen that happen. But if you click on "ZA" in the system tray (the little row of icons next to the clock) you should see a list of all the programs ZoneAlarm has seen. You should be able to put an X next to any one that you want permanently disabled from using the Internet.
Alan
jimhoney - 24 May 2004 03:56 GMT Mike,
You have to restart your computer in "Safe Mode" to find and delete spyware. The bastards design it to burrow down below the Windows operating system.
Please check your Help file or a computer help group for instructions on working in Safe Mode. It's tricky and a little dangerous.
jimhoney
> I have Internet Explorer as my browser. I recently noticed a new toolbar > has been added... *ISearch*. I've tried to remove it using the add/remove [quoted text clipped - 6 lines] > Thanks! > MikeH philski - 24 May 2004 04:00 GMT > I have Internet Explorer as my browser. I recently noticed a new toolbar > has been added... *ISearch*. I've tried to remove it using the add/remove [quoted text clipped - 6 lines] > Thanks! > MikeH MH: Go to this site to remove:
> http://toolbar.isearch.com/uninstall/ Hope this helps...
Philski
Rgr - 25 May 2004 02:00 GMT Mike
I ran into the same problem last week with ISearch. I clicked on some link, and the next thing I heard was my harddrive busy doing something. I knew right away it had to be spyware.
Awhile back when I was fighting other spyware problems, so I downloaded a freeware program called HijackThis (version 1.97) (per Heather). You can download this at download.com (do a google search).
Run it, and then click the scan button in the lower left corner. The program comes up with list of items to check off to remove (make sure you click the proper items).
Some spyware programs like ISearch attach themselves to IE. They can be found under the BHO (Browser Helper Objects) items. Click on the item you want to delete. Then click on the Fix checked box. It cleanly removed iSearch from the toolbar area.
Hope this helps someone.
Rgr
Heather - 25 May 2004 02:33 GMT See inline.....
> Mike > > I ran into the same problem last week with ISearch. I clicked on some link, and the next thing I heard was my harddrive busy doing something. I knew right away it had to be spyware.
> Awhile back when I was fighting other spyware problems, so I downloaded a freeware program called
> HijackThis (version 1.97) (per Heather). You can download this at > download.com (do a google search). Hi Roger.....I would have given this to him but it is not a program that most people can safely use by themselves. That is why I always tell people to post the HiJack Log on one of the SpyForums......
Hell....I have trouble ID'ing some of the bad guys......so a newbie would wreck their computer trying to figure out what is a good BHO and a bad one. I have also used it to remove extra buttons and the like in IE.
But thanks for the *testimonial* (G)......and the program can be downloaded from the author's site (Merijn) as well, and then the results posted on SpyForum or Net Integrator or whoever is up and running at the time.....I kid you not on this. They are bombarded with DOS attacks by the bad guys constantly. We can do a pretty good job of reading the logs on the antivirus n.g as well.....but I just wanted to caution anyone on here that it is not something to fool with......let an expert tell you what to remove.
This is one I usually use for the Hijack Logs...... http://forums.spywareinfo.com/
To download Hijack This and I also recommend using CWShredder as well......for all the Cool Web Search crap!! Merijn has both of them half way down the page. http://www.spywareinfo.com/~merijn/downloads.html
Glad it worked for you, but like they say on TV.....don't try this at home, kiddies, grin.......(unless you know darn well what is good and what is bad). If anyone has any questions, you know my home address..... (heatherfig at rogers dot com)
Heather
> Run it, and then click the scan button in the lower left corner. The program > comes up with list of items to check off to remove (make sure you click the [quoted text clipped - 8 lines] > > Rgr Rgr - 25 May 2004 05:38 GMT > Hi Roger.....I would have given this to him but it is not a program that > most people can safely use by themselves. That is why I always tell people [quoted text clipped - 24 lines] > bad). If anyone has any questions, you know my home address..... > (heatherfig at rogers dot com) Heather,
You make a good point. You definitely need to be careful what you are trying to remove spyware. Remember, review twice, click once for this program.
Sidebar: I noticed sometimes spyware likes to install in your c:\Program Files directory. Sometimes you can uninstall them, but the more nastier ones don't have this ability. A lot of times you try to delete the directory (+ subdirectory), and you find out you can't delete it. Usually these types are already running in the background. Occasionally you can pull up the Windows Task Manager and click on the Processes tab. There you might find the culprit program running. Thru the Task Manager you can "kill" it (end task). Then try again to delete the directory (make sure you also empty the Recycle Bin too).
In more severe cases I've had to resort to running msconfig command (from the Start | Run menu => type in msconfig ). Then click on the Startup tab. Sometimes the culprit program is getting loaded at Startup. De-select the culprit program(s) and reboot. You will get a warning at the next reboot, since you changed the Startup configuration. Now if needed you can delete the directory.
It's amazing how much time you can spend fighting this problem.
Rgr
ButtercupsDad@dog.net - 25 May 2004 13:12 GMT AMEN TO THAT!
>It's amazing how much time you can spend fighting this problem. > >Rgr ButtercupsDad@dog.net - 25 May 2004 13:20 GMT Heather: Last night I installed Ad Aware and a couple of their "free" add-in programs, Registry Mechanic and File Specs. I think it was the Registry Mechanic that found over 125 different problems on my computer, but it would not remove all of them with the free version. I had to buy the package in order to enable it and get it to clean everything off that it found. Is it worth it do you think? Is there a different program that I can run free to clean this stuff off my computer? Thank you. David S.
Heather - 25 May 2004 18:18 GMT Just a quick answer till I check out a couple of things......DO NOT pay for Registry Mechanic!! I remember someone complaining about this so-called free trial that found a ton of stuff, but you had to pay to get rid of it.
There are free Registry Cleaners out there that I use.....lots of them. The safest in my book is no longer available to the public, but it is Microsoft's Regclean, which was really only for MS techs. My best advice for you is to leave the Registry alone......it is the heart of your computer.
Till later.....Heather
> Heather: > Last night I installed Ad Aware and a couple of their "free" [quoted text clipped - 7 lines] > Thank you. > David S. olfart - 25 May 2004 18:48 GMT > Just a quick answer till I check out a couple of things......DO NOT pay for > Registry Mechanic!! I remember someone complaining about this so-called [quoted text clipped - 7 lines] > > Till later.....Heather You can still get RegClean. Go to http://download.com.com/3000-2094-881470.html?tag=list or if you Google it there are plenty of other download sites. Good little progam
olfart - 25 May 2004 18:58 GMT > > Just a quick answer till I check out a couple of things......DO NOT pay > for [quoted text clipped - 14 lines] > or if you Google it there are plenty of other download sites. Good little > progam It says for use with Win95/98/NT Not sure if it's good for any other version of Windows though.
ButtercupsDad@dog.net - 25 May 2004 20:29 GMT I have XP on the computer at home, so between what Heather said and the spec's not mentioning Windows XP I think I will leave it alone for now.
Thank you for the referal to the web site though. Folks with Win95/98/NT can use it.
David S.
>> You can still get RegClean. Go to >> http://download.com.com/3000-2094-881470.html?tag=list [quoted text clipped - 3 lines] >It says for use with Win95/98/NT >Not sure if it's good for any other version of Windows though. Heather - 25 May 2004 20:46 GMT Thanks 'olfart'.......I am rushing to change bookings in England and haven't had time to blow my nose, let alone look these up......but that rings a bell.....about not being good for XP. Perhaps that is why they removed it. It originally was only for MS techs...but a lot of us downloaded it because it is a safe one to use.
Running.......Heather
> > Just a quick answer till I check out a couple of things......DO NOT pay > for [quoted text clipped - 14 lines] > or if you Google it there are plenty of other download sites. Good little > progam Steve Kramer - 26 May 2004 12:22 GMT I concur. When I was doing my MCSE training, duirng every course practically, we had to go into REGEDIT. And, every time, regardless of the instructor, he/she said, "no don't try this at home." Of course, as promising Microsoft Certified Engineers, we all got pretty good at editting the registery, but I still cringe whenever tech support tells me or a friend of mine to do it.
 Signature Prostate Cancer Survivor (so far), not a doctor PSA 16 10/17/2000 @ 46 Biopsy 11/01/2000 G7 (3+4), T2c RRP 12/15/2000 PSA .1 .1 .1 .27 .37 .75 EBRT 05-07/2002 @ 47 PSA .34 .22 .15 .21 .32 Erection 05/12/2003 @ 48 HTbegins 07/21/2003 @ 48 PSA .07 .05 Lupron 7/03, 8/03, 12/03, 4/04
> Just a quick answer till I check out a couple of things......DO NOT pay for > Registry Mechanic!! I remember someone complaining about this so-called [quoted text clipped - 19 lines] > > Thank you. > > David S. Heather - 26 May 2004 18:49 GMT Isn't is just amazing what the so-called "tech support" (oxymoron) will tell you to do? Joe Newbie phones them and first they automatically tell him he has a virus......then they suggest reinstalling either IE and OE or the whole operating system. IDIOTS!!
That is why we are there on the MS news groups.....to keep people from following horrible tech advice and ruining their computers. Or to tell people that reformatting is absolutely a last resort.
How do I know this? (G) Rogers Tech Support tried all of the above on me before I blew up and told them a thing or three. Apparently, my account is now marked "she may be older, but watch it.....she knows her stuff"........ROFL!! The tech who told me was in stitches.
Heather
> I concur. When I was doing my MCSE training, duirng every course > practically, we had to go into REGEDIT. And, every time, regardless of the [quoted text clipped - 28 lines] > > > Thank you. > > > David S. MH - 25 May 2004 03:22 GMT Thanks for the tip, Rgr.... Your post and those of others have been very helpful!! I got rid of the ISearch!! Yeah!
MikeH :-)
> Mike > [quoted text clipped - 19 lines] > > Rgr
|
|
|