Spyware Warrior

[alrodri]

Hello everyone,

When Ad-Ware scan my Hard Disk it reports the following:

Vendor:Lop
Category:Data Miner
Object Type:Process
Size:-
Location:C:\...\ONLINE NOUN BEEP LIES\ARMY COMP.EXE
Last Activity:30/08/04 22:00:00
Risk Level:High
TAC index:7
Comment:
Description:Browser Hijacker. No uninstaller. May cause system instability. Auto updates. Operates in stealth.

My questions are:

1- How this spyware or dangerous dataminer could be installed in our home PC?

2- I see in description that it is "No uninstaller", but is it really totally impossible to uninstall it manually or using any other tool?

Thanking you in advance,

Alrodri

[MysteryFCM]

It can be installed by anything from a drive-by download, to a third party program.

As for uninstalling it. You can either do it manually, or using a third party program.

Manually

1. Kill the process in the task manager (CTRL+ALT+DEL)
2. Delete the programs folder
3. Make sure it isn't listed in your startup folder;

Start > Programs > Startup

Windows XP and above

Start > All Programs > Startup

4. Check the following key's in your registry (Start > Run, type: regedit), if you see the program listed, delete it's entry.

WARNING: BACK UP YOUR REGISTRY BEFORE ADDING/EDITING/DELETING ANYTHING!!!!

Windows 9x/ME

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Windows 2000 and above

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\RunServices

HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\RunServices

5. Download and install WinPatrol (freeware) - www.winpatrol.com (this will allow you to check other places it could be hiding, and prevent it getting installed in the future).
_________________
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

[Nick]

Before mucking around in the registry, you should follow the instructions in this post: http://spywarewarrior.com/viewtopic.php?t=10
_________________
Nick's Security Ticker

[alrodri]

Thanks, I really appreciate your attention. If anyone else would like to give me any new advice concerning the present subject I will be glad to hear it.

[3162]

Please post a hijackthis log over in the HijackThisLog forum or SpywareRemoval forum.
Those two forums have restrictions regarding who can post help, you'll get appropriate assistance over there.

Thanks
_________________
Proud member of the Chest Zipper Club!