• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 308
  • Last Modified:

Trying to remove Spyware/Adware coming from www.ad-a-w-a-r-e.com.


I have a user in our organization that it consistenly getting windows that are popping up that have the above website address in them.  As of right now, I have added the following information to the hosts file that is on the user's XP Pro machine:   www.ad-a-w-a-r-e.com

However, several of these pop-up duing the day on the user's machine.  The user gets the page cannot be displayed message, but that is still somewhat annoying.

I've ran Ad-Aware SE, SpyBot S&D and HijackThis! all the latest editions with the latest definition files, but they do not find anything that seems out of the ordinary.

Can anyone help me figure out where these www.ad-a-w-a-r-e.com messages are coming from?

Thank you,
2 Solutions
try installing panda antivirus - it works good with spybots.

Also you can run "msconfig" -> and check what files are loading at startup.
Locate by the name your spyware - remove it from startup, reboot, then delete manually from hdd.
Check with stinger:

Xp AntiSpy - http://www.xp-antispy.org/  for turning off unneeded Win XP services that only can generat u trafic and can be used as back door

Those programs are very useful for cleaning spywares:
SpySweeper - http://www.spychecker.com/program/spysweeper.html
SpywareBlaster - http://www.spychecker.com/program/spywareblaster.html
CoolWebShredder - http://www.spychecker.com/program/coolwebshredder.html
Stinger - http://vil.nai.com/vil/stinger 
Anti-Trojan 5.5.421 -
a2free  - http://www.emsisoft.com/en/ 
bazookasetup - http://www.kephyr.com/spywarescanner/
BHODemon 2.0
LSPFix  - http://cexx.org/lspfix.htm 
Spyware Doctor
Spy-Ad Exterminator  - http://www.oreware.com 

and use a firewall to stop the unwanted trafic

one of  the problems with that url is you cant look for it in google cos it ignores the '-' ,  which means you need to use a different search engine. I found this page
which contains the following helpful advice:

For those who are suffering like I did with constant pop-up ads from ad-w-a-r-e.com the situation's been resolved.

It turns out I'd been infected by 'Look2Me', the common name for the 'VX2.BetterInternet' trojan. Here are the steps I took (BREAK@MMX YOU ROCK HARDCORE!):

1. Internet Explorer > "Tools" Pulldown > "Internet Options..." > "Advanced" tab > Turn off all the 'Install On Demand' as well as 'Enable third party browser extensions'. That'll keep it from being downloaded in the first place.

2. http://downloads.subratam.org/VX2Finder9x(126).exe > Run From Current Location. This will wipe it out if you do have it.

Featured Post

Managing Security & Risk at the Speed of Business

Gartner Research VP, Neil McDonald & AlgoSec CTO, Prof. Avishai Wool, discuss the business-driven approach to automated security policy management, its benefits and how to align security policy management with business processes to address today's security challenges.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now