I am protective when it comes to my computer: I do not open email attachments unless I am expecting them, I do not use file-sharing programs, and I do not download software unless I trust the source. As a result, I thought I was safe from spyware and viruses. However, a few weeks ago I had an experience with my home computer that changed my view of computer security.
I was surfing the web and visited a trusted site. When the site opened, a dialogue box popped up. The dialogue box had an unreadable mix of characters that extended on top of its response buttons! I have never seen that before and realized something was wrong, so I closed the box immediately. However, it was already too late!
The trouble started with a change of my desktop's background. The new background had a text message "SPYWARE INFECTION! Your system is infected with spyware." This was followed by various pop ups that prompted me to buy a "system cleaner" called "Spysheriff". Of course this seemed too strange as the pop ups were caused by a virus, and the virus was prompting me to clean itself with this 'Spysheriff" program!
After Googling the term 'spysheriff', I found out that this 'cleaner' is actually made by the same people who made the virus. Hmm, so they infected my PC with a virus and want me to pay a fee to get it cleaned. Sounds like blackmail, doesn't it? Of course since the 'cleaner' is written by the same people who wrote the virus, I would not trust the cleaner.
The effects of this virus were severe. Every minute or so an ad will pop up in an Internet Explorer Window. I could close the ad window but a few seconds later another one would pop up. This was very annoying because it interrupted my work: I would be typing an email message for example and suddenly I'd find an ad in front of me and my keystrokes would be diverted to the ad's window! In addition, I now had this sinking feeling that everything I do on that computer might be monitored by some hacker lurking somewhere on the Internet.
The first thing I tried to solve this problem was to remove 'spysheriff' from my computer by deleting its files. However, it somehow kept coming back! Next I tried Windows "System Restore". This is a wonderful feature that allows you to restore your computer a previously saved state. Unfortunately it turned out that 'spysheriff' purposely deletes the Windows restore points to circumvent this feature!
The next step was to try a reputable antivirus program. I started by downloading the 15-day evaluation version of Norton AntiVirus 2006. It was a good thing I could try the product without having to buy it first as it did not solve this problem. After a scan that lasted a couple of hours, Norton displayed a message like: "2 threats identified. 0 threats cleared. 2 threats remaining"! The software had a link that opened a web page with instructions for 'manual removal' of the identified threats. I tried following these instructions but the problem remained.
Next I tried Spybot - Search & Destroy, a free anti-spy software. The software identified several spy programs on my computer and cleaned them. However, the problem I had with the ad pop-ups problem remained.
For the next few days I tried other commercial programs. These include AVG Anti-Virus, X-Cleaner, XoftSpy, and Ad-Aware. The interesting this is that each one of those programs found threats that others missed and cleaned them. Unfortunately, none of them fixed the ad pop-up problem.
There was only one solution left: to reformat the hard drive, reinstall Windows, and start over. This was an extreme measure as it meant having to backup all documents, photos, email files, data, and anything else I created on that computer over the years and copy everything back after reinstalling Windows. If I forget any file it would be lost forever. Not to mention that this process consumes a lot of time.
I located my Windows installation CD and researched the Windows reinstallation process. However, I decided to try one more thing before proceeding with the formatting of the hard drive. This time it was Spyware Doctor by PC Tools Software. I used PC Tools products a long time ago and liked them. So I downloaded and ran Spyware Doctor.
The software did its scan like all the others did before it, but then it did something different. The software popped up a message saying that a threat was detected and it will now perform an "emergency reboot of the system". It went ahead and restarted Windows. However, when Windows booted up Spyware Doctor was the only thing that came up and it ran its scan again. It then cleaned up the threats it found and continued with the boot up process. Voila! This time the annoying pop-ups were gone!
So to summarize, this is what I learned from this experience:
Finally, here is a list of the tools I mentioned above with information on how to get them:
AVG Anti-Virus plus Firewall by GRiSoft $48.95 with free 30 day trial http://www.grisoft.com
X-Cleaner by XBlock. Freeware that includes cookie cleaning, Internet
cache cleaning, and scans for many popular spy software packages. The Pro Version
which has a larger anti-spyware database and costs $29.95.
http://www.xblock.com
Norton AntiVirus 2006 $39.99
http://www.symantec.com
Spybot - Search & Destroy. Written by Patrick Kolla from Ireland. Free software. http://www.spybot.info/en/index.html
XoftSpy by ParetoLogic. Spyware Detection and Removal $39.95
http://paretologic.com/products.aspx
Ad-Aware SE Professional by Lavasoft $39.95
http://www.lavasoftusa.com/software/adaware/
Spyware Doctor by PC Tools Software. PC Magazine Editors' Choice, June
19, 2005
$29.95
http://www.pctools.com/spyware-doctor/
Questions or comments? Contact the author at mon@accutrack.org.