More cases of adware running amok  | By Fred Langa Don’t you hate it when software refuses to uninstall? I sure do. So, today’s issue begins with help in rooting out recalcitrant software. I then cover a free utility, an IE 7 speed-up, and lots more! |
Did you catch ‘AntiVermins’? How to uninstall it
There’s nothing more frustrating than software that keeps coming back after you uninstall it. Even worse is software you never wanted in the first place that keeps coming back. Reader Gene Axtell discovered a virulent case:
- “I recently committed an error in browsing and was hit by a Trojan virus. The virus was Trojan-spy.win32@mx. It took over some of my browser (IE 6) and started showing a virus-removal tool called ‘AntiVermins.’ The software was loaded and launched without my knowledge.
“I tried to uninstall the software via Control Panel. The uninstall appeared to have worked, upon initial results [but AntiVermins returned]. I use Norton Antivirus, but I was quite surprised and disappointed to hear that Norton has no fix for the issue!
“I did a search on the Web and found much information about the Trojan. I was very careful not to use just any suggested fix. I finally decided on SpyBot, ran it, and it found a great deal of ‘infections’ on my desktop, including the AntiVermins program that I thought was removed earlier.
“Since I am a fairly cautious administrator, I also purchased [PC Tools'] SpyWare Doctor. I know that any single program will not see all infections. This was proven yet again. SpyWare Doctor found an additional 250 infections on its first thorough scan and 6 more on its follow up… including the AntiVermins… again!
“So, Fred, how does one permanently eliminate the AntiVermins program and whatever the Trojan-spy.win32@mx does to a desktop? I’m certain your readers have experienced this and are at least as frustrated as I am!”
For example, if System Restore previously backed up a virus or other malware (by itself or as part of a corrupted system file), the malware or infected file may get restored when System Restore detects that the original copy has been cleaned or deleted from the system. This is why many antimalware tools recommend at least temporarily disabling System Restore and similar tools prior to cleaning a system. (Need help disabling or otherwise managing System Restore? See Microsoft Knowledge Base article 310405, or this article I wrote for InformationWeek on optimizing System Restore.)
Second, you may have run afoul of a semantic issue with Symantec. AntiVermins is not a virus, so an antivirus tool, per se, won’t be able to help you. AntiVermins is also not a Trojan horse, because it doesn’t enter your system by pretending to be something other than what it is. That means that narrowly-focused anti-Trojan tools also may not help.
So what is AntiVermins? It’s adware. For example, McAfee defines AntiVermins this way:
- “This is not a virus or a trojan. It is detected as a ‘potentially unwanted program.’ This is an anti-spyware application claiming to remove unwanted malicious spyware programs in an attempt to get you to purchase the full version of the product…”
- “AntiVermins is an adware program that may display advertisements on your system… It may also cause slowing of your Web browser and system performance issues.”
Finally, as for the “hundreds of infections” you found, please note that some antimalware tools try to impress you with how hard they’re working. They do this by playing up even the most minor potential threats (such as routine and harmless cookies) as if they were imminent catastrophes.
Spyware Doctor probably didn’t really find “an additional 250 infections,” but rather a large number of minor or potential threats. It’s fine to remove these minor threats. But just remember that not all threats are equally dangerous, even though an antimalware tool may report them that way.
So, what’s the takeaway from all this?
1. System Restore. Make sure that System Restore (or any similar automatic rollback tool) doesn’t simply restore any malware you’re trying to remove.
2. Flavors of malware. Be aware of the differences between viruses, adware, Trojans, and other forms of malware. Tools that specialize in one form of malware may miss others. Often, running two or more different antimalware tools will catch and cure far more ills than any one tool alone can do.
3. Don’t panic. When you do use anti-malware tools, take the threat counts reported by such tools with a grain of salt: Things are rarely as dire as these tools can make it seem!
Trogladite Software simplifies ‘Send To’
Raphael Altman took the time to remind us of a very handy, free utility:
- “Re: Restore a missing ‘Send To’ shortcut in Explorer in the paid section of the Jan. 4, 2006, issue: The freeware “SendTo 1.6” allows you to send more or less anything from anywhere to anywhere on your computer. I love it!”
Is IE 7 too slow opening new sites?
Reader John McLaughlin is frustrated with the performance of the new Internet Explorer:
- “Do you know of any problems that may cause IE 7 to respond slowly when opening and closing tabs, windows, or download pages?
Microsoft has recognized the slowdowns that the Phishing Filter is causing. The company released on Dec. 12 a fix for Windows XP SP2, Windows XP x64 Edition, and Windows Server 2003. You can download the patch for free by visiting Knowledge Base article 928089.
Figure 1. IE 7′s Advanced settings let you rein in or disable the speed-robbing Phishing Filter’s settings.
If that fix doesn’t work for you, you can disable the Phishing Filter by clicking IE 7′s Tools button, clicking Phishing Filter, and then clicking Phishing Filter Settings. Scroll down to the Phishing Filter section under Security in the list of options, as shown in Figure 1. To completely turn off the Phishing Filter, click Disable Phishing Filter. To leave the filter available but inactive, click Turn off automatic Web site checking. (That’s the setting I use.) When you’re done, click OK. That’s all it takes!
Alternatively, if the filter is currently active in IE 7, you can right-click on the filter’s icon to disable it. The icon looks like a little window with an exclamation point and is displayed in the browser’s status bar only when you’re loading a new page. When you right-click, a context menu will appear. Select Phishing Filter Settings, then follow the steps in the above paragraph.
Disabling IE 7′s Phishing Filter causes you to lose real-time protection against sites that look legitimate but are actually hacker tricks. If you suspect that a Web page you’re visiting might not be what it seems, click IE 7′s Tools button, then click Phishing Filter, Check This Website. You’ll receive instant feedback on whether or not the site has been reported as a phishing scam.
You can re-enable IE 7′s filter using the same dialog box as described above. There’s lots more info at Microsoft’s antiphishing home page.
When hardware subverts your software…
Reader Chuck Deich found a hardware solution to what appeared to be a software problem:
- “In reference to ‘What to do when missing NTLDR and Hal.dll‘ in the Dec. 7, 2006, newsletter: I recently experienced the ‘missing NTLDR’ error message. After a number of failed attempts to correct the problem using most of the methods discussed in the article, I finally found the solution. Somehow the CMOS setup setting that specifies which hard drive is the boot drive changed. All I had to do was change the setting back to the C: or boot drive. Problem solved!”
It’s somewhat rare for the BIOS data to go bad spontaneously, but as Chuck found, it happens: Power spikes, errant software, and (believe it or not) even cosmic rays can corrupt the data stored in the BIOS or in any other solid-state memory, for that matter.
For example, NASA (says): “If a cosmic ray passes though a sensitive part of a semiconductor chip, the logical state of the bit (‘on’ or ‘off’) can be flipped…”
So, while this isn’t the first thing you’d suspect when your PC misbehaves, it’s worth remembering to check the BIOS when more traditional problem-solving approaches have failed.
You usually can access the BIOS by pressing a key during system power-up, just after the first wake-up beep. The key varies from brand to brand, but it’s usually the F1, F2, Esc or Del key. (Many sites, including Computer Hope, provide more detailed instructions on various startup sequences.)
How do you know the correct BIOS settings for your PC? Many vendors include a way to return the BIOS to its factory settings, and that can be a good place to start. I use another way: When I get a new PC and I’m sure everything is working the way I want, I access the BIOS and take a photo of each setup screen with a digital camera. That way, I have a permanent record of the known-good settings for that PC. Simple!
Fred Langa is editor of the Windows Secrets Newsletter. He was editor of Byte Magazine and editorial director of CMP Media, overseeing Windows Magazine and others. Subsequently, he edited the LangaList e-mail newsletter from 1997 to 2006, when it merged with Windows Secrets.
