Let me start by explaining that I am a software developer with a decade of
experience in developing software for Windows. I have Windows Firewall,
Windows Antispyware, Computer Associates Internet Security Suite and
Symtanec Antivirus and a Symtantec router with hardware firewall and the
popup blocker is on.
So, you can imagine how suprised I was to find that I apparently acquired
spyware while browsing using Internet Explorer on Windows XP Home Edition
Service Pack 2. I did visit some sites that had heavy ads. I am at a loss to
explain how I got spyware when I did not consent to downloading or executing
any code. Could there be an undiscovered loophole?
It is impossible to troubleshoot, because I think the first piece of spyware
downloaded many more pieces of spyware before I had a chance to stop it. I
deleted executable files with random or suspicious names from all over the
place. According to Symtanec Antivirus, LavaSoft AdAware and SpyBot, there
were about a dozen different pieces of spyware that had to be removed. And I
still found pieces they all missed.
Right now, I am not sure of the spyware is really gone. When I open most
programs (including Notepad and Internet Explorer), it creates a subfolder
of my Temp folder, then a small file inside of that folder, then deletes it.
The file is NOT an executable. That can't be normal behaviour, can it? What
kind of vulnerability can hook into the starting of most programs? I could
not find any non-standard shell execute hooks or an AppInit_DLLs registry
key.
So, I have two big concerns now:
1. How did I get spyware when I did not consent to downloading or executing
any code in Internet Explorer, and did not install any software of any kind
for weeks?
2. Is the spyware still present?
Can anyone offer any thoughts or advice?
Paul