Warning: iconv_mime_decode() [function.iconv-mime-decode]: Malformed string in /home/secureg/public_html/lib/standard.lib.php on line 2257
Adware, Spyware, rootkit????
Adware, Spyware, rootkit????

Adware, Spyware, rootkit????
Secure Home | Search | About
Login Password
Register Now! Lost Password?

Microsoft Applications Security - Microsoft's general security discussions and announcements 

Bookmark this page:  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Adware, Spyware, rootkit???? Max 03-09-2006
Posted by =?Utf-8?B?TWF4?= on March 9, 2006, 6:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Where is a good place to get information on how to remove Adware-NaviPromo,
msclock32.dll, and other spyware? What is "rootkit"???

Posted by David H. Lipman on March 9, 2006, 7:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Where is a good place to get information on how to remove Adware-NaviPromo,
| msclock32.dll, and other spyware? What is "rootkit"???



For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser
Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://harrisonrj.home.comcast.net/step_by_step_pc_cleaning_process.htm#Step_3_%96_Getting_Help


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by =?Utf-8?B?TWF4?= on March 9, 2006, 9:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks Dave,

I have already used Ad-Aware, AVG, Microsoft's MalwareRemove, Microsoft's
Defender, Hijackthis, BFU, and I may have tried some other tools.

Adware NaviPromo keeps comming up, with popups and is apparently a
datalogger of some sort. msclock32.dll in %sysroot%/system32 can be deleted
from safemode but keeps comming back. Hijackthis shows msclock32.dll even
after deleted, so there is another copy somewhere. Where?? I don't know yet.
Also in surfing the net I found some information about something called a
"rootkit" which hackers can use to hide files. msclock32.dll seems to be
only visible from safemode command prompt. I deleted it, and created a text
file with 0 length, and renamed it to msclock32.dll and the msclock32.dll
came back.

Thanks for the lead on Multi_Av and the Step by Step site. I'll check it out.

Know what the "rootkit" is and does??? I would be interested.

Thanks,
--max


"David H. Lipman" wrote:

>
> | Where is a good place to get information on how to remove Adware-NaviPromo,
> | msclock32.dll, and other spyware? What is "rootkit"???
>
>
>
> For non-viral malware...
>
> Please download, install and update the following software...
>
> * Ad-aware SE v1.06
> http://www.lavasoft.de/
> http://www.lavasoftusa.com/
> http://www.lavasoft.de/ms/index.htm
>
> * SpyBot Search and Destroy v1.4
> http://security.kolla.de/
> http://www.safer-networking.org/microsoft.en.html
>
> After the software is updated, I suggest scanning the system in Safe Mode.
>
> I also suggest downloading, installing and updating BHODemon for any Browser
Helper Objects
> that may be on the PC.
>
> * BHODemon
>
>
http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d
>
> For viral malware...
>
> * Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
> FireWall to allow it to download the needed AV vendor related files.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in
Normal Mode.
> This way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot
the PC.
>
> You can choose to go to each menu item and just download the needed files or
you can
> download the files and perform a scan in Normal Mode. Once you have downloaded
the files
> needed for each scanner you want to use, you should reboot the PC into Safe
Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want to
run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
> file. http://www.ik-cs.com/multi-av.htm
>
> Additional Instructions:
>
http://harrisonrj.home.comcast.net/step_by_step_pc_cleaning_process.htm#Step_3_%96_Getting_Help
>
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

Posted by David H. Lipman on March 10, 2006, 1:15 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Thanks Dave,
|
| I have already used Ad-Aware, AVG, Microsoft's MalwareRemove, Microsoft's
| Defender, Hijackthis, BFU, and I may have tried some other tools.
|
| Adware NaviPromo keeps comming up, with popups and is apparently a
| datalogger of some sort. msclock32.dll in %sysroot%/system32 can be deleted
| from safemode but keeps comming back. Hijackthis shows msclock32.dll even
| after deleted, so there is another copy somewhere. Where?? I don't know yet.
| Also in surfing the net I found some information about something called a
| "rootkit" which hackers can use to hide files. msclock32.dll seems to be
| only visible from safemode command prompt. I deleted it, and created a text
| file with 0 length, and renamed it to msclock32.dll and the msclock32.dll
| came back.
|
| Thanks for the lead on Multi_Av and the Step by Step site. I'll check it out.
|
| Know what the "rootkit" is and does??? I would be interested.
|
| Thanks,
| --max

Max:

AVG is an OK anti virus but is not comprehensive. Microsoft's Malware Removal
Tool (MRT)
is a limited "On Demand" AV scanner not unlike McAfee/AVERT Stinger and uses a
subset
signature base that AVG uses. Microsoft is NOT good at detecting viruses -- yet.

RootKits are stealthy infectors that strongly embed themselves into a NT based
OS and are
difficult to fi9nd and remove.
http://searchsecurity.techtarget.com/gDefinition/0,294236,sid14_gci547279,00.html
http://www.timeatlas.com/mos/Term_to_Learn/General/Rootkits_and_the_Hidden_Menace/

I suggest using the Multi AV Scanning Tool tool. It is very possible that one
of the AV
scanners in the Multi AV Scanning Tool may find what AVG missed and it wouln't
be the first
time.

I also suggest the following...

Please submit a sample of "msclock32.dll" to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition,
unless told
otherwise, Virus Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email URL...
mailto:scan@virustotal.com?subject=SCAN

When you get the report, please post back the exact results.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Byron Hynes [MS] on March 11, 2006, 2:45 am
If you were  Registered and logged in, you could reply and use other advanced thread options
If you've tried all that and your system is still unstable or compromised,
then, I'd say it's time to "flatten" the system disk and rebuild it by
reinstalling
the OS from scratch. Don't restore anything from backup except data/documents
and only AFTER you've scanned those files using a new clean system.

What I have done on occassion for clients is to put in a new hard drive,
and put the current hard drive in a USB enclosure, so that the files could
be accessed... but be very careful not to re-infect.

Byron Hynes
Windows Server
Microsoft Corporation

http://spaces.msn.com/members/byronphynes

> Thanks Dave,
>
> I have already used Ad-Aware, AVG, Microsoft's MalwareRemove,
> Microsoft's Defender, Hijackthis, BFU, and I may have tried some other
> tools.
>
> Adware NaviPromo keeps comming up, with popups and is apparently a
> datalogger of some sort. msclock32.dll in %sysroot%/system32 can be
> deleted
> from safemode but keeps comming back. Hijackthis shows msclock32.dll
> even
> after deleted, so there is another copy somewhere. Where?? I don't
> know yet.
> Also in surfing the net I found some information about something
> called a
> "rootkit" which hackers can use to hide files. msclock32.dll seems to
> be
> only visible from safemode command prompt. I deleted it, and created
> a text file with 0 length, and renamed it to msclock32.dll and the
> msclock32.dll came back.
>
> Thanks for the lead on Multi_Av and the Step by Step site. I'll check
> it out.
>
> Know what the "rootkit" is and does??? I would be interested.
>
> Thanks,
> --max
> "David H. Lipman" wrote:
>
>>
>> | Where is a good place to get information on how to remove
>> Adware-NaviPromo, | msclock32.dll, and other spyware? What is
>> "rootkit"???
>>
>> For non-viral malware...
>>
>> Please download, install and update the following software...
>>
>> * Ad-aware SE v1.06
>> http://www.lavasoft.de/
>> http://www.lavasoftusa.com/
>> http://www.lavasoft.de/ms/index.htm
>> * SpyBot Search and Destroy v1.4
>> http://security.kolla.de/
>> http://www.safer-networking.org/microsoft.en.html
>> After the software is updated, I suggest scanning the system in Safe
>> Mode.
>>
>> I also suggest downloading, installing and updating BHODemon for any
>> Browser Helper Objects that may be on the PC.
>>
>> * BHODemon
>>
>> http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a875
>> 39eea8ed6904332b4b8b8442d
>>
>> For viral malware...
>>
>> * Download MULTI_AV.EXE from the URL --
>> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>> To use this utility, perform the following...
>> Execute; Multi_AV.exe { Note: You must use the default folder
>> C:\AV-CLS }
>> Choose; Unzip
>> Choose; Close
>> Execute; C:\AV-CLS\StartMenu.BAT
>> { or Double-click on 'Start Menu' in C:\AV-CLS }
>> NOTE: You may have to disable your software FireWall or allow
>> WGET.EXE to go through your FireWall to allow it to download the
>> needed AV vendor related files.
>>
>> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in
>> C:\AV-CLS}
>> This will bring up the initial menu of choices and should be executed
>> in Normal Mode.
>> This way all the components can be downloaded from each AV vendor's
>> web site.
>> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
>> Reboot the PC.
>> You can choose to go to each menu item and just download the needed
>> files or you can download the files and perform a scan in Normal
>> Mode. Once you have downloaded the files needed for each scanner you
>> want to use, you should reboot the PC into Safe Mode [F8 key during
>> boot] and re-run the menu again and choose which scanner you want to
>> run in Safe Mode. It is suggested to run the scanners in both Safe
>> Mode and Normal Mode.
>>
>> When the menu is displayed hitting 'H' or 'h' will bring up a more
>> comprehensive PDF help file. http://www.ik-cs.com/multi-av.htm
>>
>> Additional Instructions:
>> http://harrisonrj.home.comcast.net/step_by_step_pc_cleaning_process.h
>> tm#Step_3_%96_Getting_Help
>> * * * Please report back your results * * *
>>
>> --
>> Dave
>> http://www.claymania.com/removal-trojan-adware.html
>> http://www.ik-cs.com/got-a-virus.htm



Similar ThreadsPosted
The Difference Between Adware, Spyware and Anti-virus.(spyware blockers) April 4, 2008, 5:54 am
Spyware & Adware January 26, 2006, 10:37 am
Spyware & Adware January 26, 2006, 1:01 pm
Is it adware, spyware or ???? March 12, 2007, 2:43 pm
Spyware/Adware Infection January 2, 2006, 1:19 am
spyware, adware, cookies December 12, 2006, 5:13 am
Re: Virus/adware/spyware -- is there all-in-one protection in one August 21, 2005, 3:40 am
adware or spyware called virtual bouncer? January 3, 2006, 11:23 pm
Why buy Virus/Adware/Spyware when free stuff is better? August 18, 2006, 2:02 am
adware-spyware computer behaves erratic May 14, 2008, 1:53 pm

The site map in XML format XML site map

Contact Us | Privacy Policy