Pop up Spyware

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

I have Windows XP SP 2. I also have Norton Anit Virus & Security. I
also have Spybot Search and Destroy and AOL spyware.

I did scans with all three last week and lately I have been getting
pop ups from the following attempting to connect to a DNS server.

Wiwlygjvto.exe, thnall.exe, aurareio.exe.

All are stopped by the Norton firewall and recommend blocking all
from these locations which I do. They intermittingly come back.

Are they on the my machine? What can I do to eliminate them from
poppping up at times?

 

[Rock]

Archived from groups: microsoft.public.windowsxp.general (More info?)

blarney@optonline.net wrote:
> I have Windows XP SP 2. I also have Norton Anit Virus & Security. I
> also have Spybot Search and Destroy and AOL spyware.
>
> I did scans with all three last week and lately I have been getting
> pop ups from the following attempting to connect to a DNS server.
>
> Wiwlygjvto.exe, thnall.exe, aurareio.exe.
>
> All are stopped by the Norton firewall and recommend blocking all
> from these locations which I do. They intermittingly come back.
>
> Are they on the my machine? What can I do to eliminate them from
> poppping up at times?

Sure seem like malware. Have you run the scans in safe mode? Also run
Adaware in safe mode:
Ad-aware SE
http://www.lavasoftusa.com

If that doesn't do it then download hijackthis and post the log to one
of the specialty forums, not his one.

HijackThis
http://www.majorgeeks.com/download.php?det=3155

Forums to Interpret HijackThis Logs:

http://www.spywareinfo.com/forums/
http://forum.aumha.org/viewforum.php?f=30
http://forums.tomcoyote.org/
http://www.wilderssecurity.com/

After your system is clean use these programs to help keep it clean:

Spywareblaster
www.javacoolsoftware.com/sbdownload.html

Spywareguard
http://www.javacoolsoftware.com/sgdownload.html

IE-SPYAD
http://www.staff.uiuc.edu/~ehowes/resource.htm

--
Rock
MS MVP Windows - Shell/User

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Check for Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or
http://aumha.net/viewforum.php?f=30 for expert analysis, not here.**

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

blarney@optonline.net wrote:
> I have Windows XP SP 2. I also have Norton Anit Virus & Security. I
> also have Spybot Search and Destroy and AOL spyware.
>
> I did scans with all three last week and lately I have been getting
> pop ups from the following attempting to connect to a DNS server.
>
> Wiwlygjvto.exe, thnall.exe, aurareio.exe.
>
> All are stopped by the Norton firewall and recommend blocking all
> from these locations which I do. They intermittingly come back.
>
> Are they on the my machine? What can I do to eliminate them from
> poppping up at times?