My wife recently encountered what appears to be a new piece of adware.
She got a message via her Facebook account from someone among her friends saying she needed to update her Adobe Flash player to view certain content, and not expecting anything bad she clicked. Thing is, the update wasn't Flash but turned out to be related to a family of malware dubbed "Adware-Memwatcher".
This appears to hang out in memory (both IE 8 and the latest Firefox are affected), and when you query a search engine (Google, Ask, etc), clicking any of the returned links will cause it to hijack the session and divert you first to the domain "wa-search.com", and then to various advertising links which may also include popups.
The latest Trend Micro appeared to recognize parts of it but wasn't able to remove it, and the "fix" clobbered winsock, requiring me to run a fix from Microsoft to be able to browse again (that fix described at this link: http://support.microsoft.c
Assuming this is a brand new variant which these scanners can't recognize, I'm hoping someone can help me determine how to remove this adware's hooks into the system, so that I can track it down manually and remove it. Running Windows XP with service pack 2 installed, IE8 and Firefox 3.0.9 browsers.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Get a free PC safety scan - Windows Live OneCare safety scanner is a free service designed to help ensure the health of your PC. Check for and remove viruses Get rid of junk on your hard disk Improve your PC's performance - link: http://onecare.live.com/si
Finally, this sounds quite a bit like your intrusion ... http://onecare.live.com/si
Br
Could be a new variant of the "aux" and midi hijacker.
Open the registry and check this subkey if the value of aux has been hijacked. Look for any random filenames data of the "aux" value.
[HKEY_LOCAL_MACHINE\
Also run Combofix and show us the logfile.
Please download ComboFix by sUBs:
http://download.bleep
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepin
Hi,
1) Download & Run CCleaner to wipe any related temp/junk files:
http://www.ccleaner.com/do
2) Download & run (http://www.cexx.org/LSPFi
3) Download and run ToolBarCop (http://windowsxp.mvps.org
4) Reset Internet Explorer 8 settings following this article:
http://support.microsoft.c
Symantec Certified Specialist
Business Accounts
Answer for Membership
by: astaecPosted on 2009-06-04 at 07:43:59ID: 24547497
Did you turn off system restore prior to fixing this? Here are some tools... Microsoft® Windows® Malicious Software Removal Tool (KB890830) - http://www.microsoft.com/d
Windows Defender detects and removes spyware - http://www.microsoft.com/w
Man