Windows XP: Virus, adware pop up problem

[TeCk_N]

Hi people. I'v got to say that this is a great forum. I finally managed to get internet at home acouple of months ago, I installed a copy of Norton Anti-Virus and I was using Spybot Search & Destroy regularly.

I'v got to admit I was downloading alot of stuff from Kazaa and then switched to Kazaa Lite++ and Suprnova (bit-torrent). About a month my Norton Anti-Virus stopped updating, around this time I also started to get alot of Pop ups and noticed that my computer would slow down alot and sometimes crash. I also noticed that if I was using Google, the first page of results would be crap.

I did download a copy of AVG free Anti-virus Software but I was still having the same problems. I finally managed to 'fix' my Norton Anti-Virus by looking at some threads on this forum, I then checked for updates and also ran Spybot and also Ad-aware by Lavasoft , after this my computer seemed to be working fine, it was faster I wasn't getting any pop ups and my Google was working fine.

That was until I switched users ( I have a copy of Windows XP professional ) and realised that I was still getting Pop ups and I realised that I had to run Ad-Aware again to remove ad-ware that I thought that I had alrady removed on the the user name. I have about 5 users on my PC and it would be a alot of hassel to run Spybot and Ad- Aware on each different user. Can anybody help please

 

[Dave]

Sorry that I missed this question!

I didn't realize that different users would make a difference on a virus scan or a spyware scan. I have two users on this computer using XP Pro and I haven't had the same problem.

Hopefully, someone else may be able to help.

Dave

 

[Targon]

My guess on this is that while most spyware removal tools are designed to search through the HKEY Local Machine and other sections, they don't go through the Users section of the registry.

HKEY_USERS may seem on first glance not to have anything in there to be worried about, but there ARE sections of software\Microsoft\Windows\CurrentVersion\Run RunOnce, and so on.

If the installer of spyware puts itself into these sections, you will need to check these by hand to make sure they wern't missed. Unfortunately, going through these sections by hand is a painful task, and almost impossible to catch everything. I suspect it's why I missed how soundman.exe keeps comming back on that one computer.

Hopefully, merijn will update CW Shredder and HijackThis to handle this(if it's not already in these utilities to do so).

I hope the folks at Lavasoft and the people behind Spybot S&D also verify that this stuff is checked, not just the installed versions.