Printable View
I think I have some spyware on my computer. Every time I open IE and load up a page, any page, another IE window pops up and quickly closes. What causes this to happen? Is there a relevant part of the registry I can look at to get rid of this problem?
Have you tried ad-aware benny?
Run both Ad-Aware and Spybot S&D. Chances are you have an unwanted BHO loaded into IE.
Yes I know I could do that but naturally as a programmer I would like to know what's going on underneath the hood. Of course, Windows and IE are so stupidly complex that something simple like this isn't obvious. I'll bet Mozilla and Firefox don't have these problems.
"I would like to know what's going on underneath the hood"
Do a search for BHO (Browser Helper Objects). That should give you an idea of what is going on.
or you could find out what spyware it is and then do a search on google..that could maybe give you some info.
i believe hijackthis is suppose to be a good spyware remover for browsers.
Yes, HijackThis is a good tool for detecting malware.
Basically it works by scanning certain areas of your system Registry and other area where bad things are known to lurk.
But there's a warning - much of what it lists is either harmless or essential to the running of your system, so you really have to know what you're doing in order to know what to remove!
Some of the latest variants of a particular parasite known as CoolWebSearch (CWS) are especially difficult to remove, and cannot be removed using HijackThis alone.
They work by installing a "super-hidden" DLL file, which is loaded on WinXP systems with very strange permissions. This causes it to become invisible within Windows. But it can still be executed, and it will create a randomly-named BHO along with all the usual search / home page hijackings. Fix these and the randomly-named BHO only gives a few hours relief at best because the "super-hidden" DLL, the primary infection if you like, is still at large.
Another trick it uses is to add a new 'service' - visible in the services.msc functionality. Look for one called Network Security Services or one with a random, non-English characters in its name, and if present, disable it.
But before getting this agressive, try this. Download a little utility called CWShredder from my mirror here: www.angmail.fsnet.co.uk/angoid/CWShredder.exe. Save it to your Desktop. It was written by Merijn, the same Merijn of HijackThis fame.
Close ALL applications down, including and especially browser windows and Explorer windows, then run CWShredder. Let it run its course. When it has finished, you must reboot your system.
As an aside, make sure you're using Ad-Aware SE (6.181 is now out-of-date) and Spybot S&D version 1.3 (1.2 is no longer being maintained).
Here are some good forums where HijackThis logs are routinely analysed: Go here if you are still having problems or if you disabled the service mentioned previously.
www.spywareinfo.com (may be inaccessible due to an ongoing DDoS attack)
www.tomcoyote.org
www.suggestafix.com - under Viruses and Malicious Code
plus others.
As I often do, and in particular when dealing with threads on a subject like this, I would advise caution downloading and running an unknown .exe.
A sentiment with which I wholehertedly agree.Quote:
As I often do, and in particular when dealing with threads on a subject like this, I would advise caution downloading and running an unknown .exe.
However, I've recommended the use of CWShredder on other boards (such as the ones I referred to) and I'm not like that - to recommend 'fixes' that I know do more damage.
I read HJT logs over there, but need to keep a lid on the forums I do so otherwise you get overloaded with forums and never get to do anything else.
I've mirrored the program on my site simply because SpywareInfo, which usually hosts it, is under a persistent DDoS attack. Many others who have helped with spyware problems have done the same.
Clearly advice given here can be followed or left - but please be aware that not all spyware cleaners do what they say they will do.
CWShredder was written by Merijn, the author of HijackThis, and run the program from time to time on my own machine 'just in case'.
Again, if you don't believe me, just do a Google search for CWShredder and follow a few of the links you get.