Ditto on the earlier comments about going with Spy Sweeper.

http://www.webroot.com/

I too got hit with some kind of spyware and it kept coming back. I tried AdAware, some other free-bes, and a free version of Spy Sweeper (I think it was old) and it would remove things. I'd then get Norton System works to clean up the registry and it would get rid of things that was referencing the spyware I had removed. You'd think it would be gone, but it'd come back in no time. It was not coming back because of anything I was doing.

I bought a boxed version of Spy Sweeper and the problem was fixed and has stayed fixed. Learning about spyware might be interesting, but not nearly as efficient as letting Spy Sweeper do all the work for $30.


>Hi David,
>
>All this stuff sounds good, but it's over my head. I don't know what HOSTS entries are. I don't know how to use Regit. I don't know how to get into my browser cache (I'm using FoxFire).
>
>I'm a fast learner, but can you point me to places where I can learn this stuff?
>
>
>>Bill,
>>
>>Are you sure you are really getting rid of it? If it's coming from a specific website the first thing to do is put in a HOSTS entry that will stop your computer from even seeing that website anymore. For example gator was one of the first things I stopped:
>>
>>

>>127.0.0.1 www.gator.com
>>

>>
>>This basically tells the computer that www.gator.com resolves to your own machine and thus won't try to get it from the internet.
>>
>>You can look through your browser cache and sort by LastAccessed and/or URL to find the sites you want to block entirely.
>>
>>In IE use Tools/Manage Add-Ons and disable anything you don't explicitly want.
>>
>>Look in your StartUp to make sure nothing is set to run there you don't want.
>>
>>Use RegEdit to make sure crud isn't attached to:
>>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
>>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
>>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
>>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
>>
>>Look for newly created folders in your Program Files and Windows Directories. If you find a bad EXE in there delete it, if you can't delete it rename the directory so that the launching code can't find itself the next time you boot.
>>
>>As you prune the folders and registry keys do a FIND in regedit for unique parts of the name to make sure you get it every place.
>>
>>Use taskman to terminate the executeables. A lot of them have started relaunching themselves on shutdown so you may not be able to kill them completely. The above renames help in tis regard.
>>
>>>In the last few weeks my spyware finders (spybot, ad-aware, and Earthlink's spyware blocker) keep finding the same spyware on my computer every day. I keep removing them, but the next day they're back.
>>>
>>>Can someone point me to a place where I can learn about how spyware is getting onto my computer, so maybe I can catch it, or at least learn what I'm doing that's bringing it back so I can quit doing it.