Nella
Topic Starter
Hi,
Believe it or not, I have four (4) anti-spyware programs plus Trojan Hunter, and NOD32, and use all religiously on my PC which OS is Windows XP Home SP2. I have a Linksys WRT54GL router (with SPI protection) and use Zone Alarm (free version) configured for maximum protection.
Two weeks ago, Spysweeper 4.5.9 found "IEHELPER" after a scam; there were five (5) instances under that name, all for the same entry in the registry, which is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2B7A0F0-B697-4A71-8D91-43443F57D7BB}
Approximately 4-5 times I used Spysweeper to quarantine this item, and each time it did, and I rebooted and then conducted a scan, Spysweeper found it again. After 4 or 5 scans, and quarantine actions, Spysweeper no longer found IEHELPER.
FWIW, during this time frame, the latest versions of Spyware Doctor, NOD32, TrojanHunter and AdAware SE Professional found nothing when I conducted scans with them, lulling me into complacency.
After Spysweeper stopped finding IEHELPER during its scans, just to be 100% sure, I updated my CounterSpy (Version 1.5.82) definitions (hadn't done a CounterSpy scan for a long time), and ran a scan and lo and behold it found:
adware.iehlpr
and identified it as a BHO.
The results screen shows two slightly different registry entries (Spysweeper showed five identical entries, all for the same registry address) as follows:
Adware.IEhlpr Browser Plug-in
Status: Quarantined
Infected registry entries detected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2B7A0F0-B697-4A71-8D91-43443F57D7BB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2B7A0F0-B697-4A71-8D91-43443F57D7BB} Compatibility Flags 102
When CounterSpy first ID'd adware.iehlpr, and before I elected to quarantine it, I verified it existed, by running regedit. I then rebooted and ran CounterSpy again.
To my dismay, several times, on successive CounterSpy scans, I have encountered and have had to quarantine adware.iehlpr after verifying that it exists in the registry (deja vu all over again, so to speak, i.e., similar to my Spysweeper experience). After each CounterSpy scan, after CounterSpy has quarantined adware.iehlpr, I have verified the aforementioned registry entry is removed, but then when I reboot, the registry entry returns and indeed on the next CounterSpy scan, CounterSpy finds this item again. I have removed adware.iehlpr several times using CounterSpy, but Counterspy cannot permanently remove it. I've even gone so far as to conduct a CounterSpy scan in Safe Mode, hoping the quarantining process in Safe Mode will prevent the item from returning on rebooting; unfortunately that didn't work; it always comes back. Counterspy hasn't ceased alerting on adware.iehlpr, despite numerous attempts to remove it, unlike Spysweeper which no longer finds IEHELPR, after the fifth SpySweeper scan, although it is there when I run the scan (i.e., I see it when I run regedit, just before the Spysweeper scan).
Although Spysweeper alerted on IEHELPR and CounterSpy alerts on adware.iehlpr, I believe they are the same bad actor, becuase the registry entry shown in the results of each program's scan is the same, only the number of instances of the same registry line that each program (Spysweeper and CounterySpy) found during their respective scans, were different.
Throughout the time frame involved, and through the present time, Spyware Doctor and Adaware SE Pro and Trojan Hunter and NOD32, have never alerted on anything whatsoever; go figure.
I was thinking of deleting the apparently guilty registry entry, manually, from the registry (after backuping my registry of course) but then decided seeking the advice of experts on this forum was the way to go.
Any ideas? Should I run HijackThis and reply to this post, attaching the Hijackthis.log? Nella
Edited a few minutes after posting the above, to add:
I forgot to say that I have contacted CounterSpy seeking their advice and help and they promptly replied as follows:
Thank you for contacting Sunbelt Software Technical Support.
I apologize for the inconvenience; unfortunately there is not a 100% solution against spyware/adware. Due to the nature of the spyware/adware that is out there, it is always being update/modified, and there are new variants of it released everyday. At one point an anti-spyware program might be able to completely detect and remove a threat, but in a week that could change. The anti-spyware companies always have to research these new versions and variants, and then update the definitions.
If you have any information about a new threat/variant that CounterSpy is not detecting you can submit it at the following link.
http://research.sunbelt-software.com/software_submission.cfm
Until we get this in our definitions, the best thing that you can do is go to http://tomcoyote.com/hjt/ and run the HijackThis program. This will create logs for you. You can then go to their forum: http://forums.tomcoyote.org/index.php?showforum=27 and post your logs. They can give you step by step removal.
Regards,
Consumer Support
Believe it or not, I have four (4) anti-spyware programs plus Trojan Hunter, and NOD32, and use all religiously on my PC which OS is Windows XP Home SP2. I have a Linksys WRT54GL router (with SPI protection) and use Zone Alarm (free version) configured for maximum protection.
Two weeks ago, Spysweeper 4.5.9 found "IEHELPER" after a scam; there were five (5) instances under that name, all for the same entry in the registry, which is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2B7A0F0-B697-4A71-8D91-43443F57D7BB}
Approximately 4-5 times I used Spysweeper to quarantine this item, and each time it did, and I rebooted and then conducted a scan, Spysweeper found it again. After 4 or 5 scans, and quarantine actions, Spysweeper no longer found IEHELPER.
FWIW, during this time frame, the latest versions of Spyware Doctor, NOD32, TrojanHunter and AdAware SE Professional found nothing when I conducted scans with them, lulling me into complacency.
After Spysweeper stopped finding IEHELPER during its scans, just to be 100% sure, I updated my CounterSpy (Version 1.5.82) definitions (hadn't done a CounterSpy scan for a long time), and ran a scan and lo and behold it found:
adware.iehlpr
and identified it as a BHO.
The results screen shows two slightly different registry entries (Spysweeper showed five identical entries, all for the same registry address) as follows:
Adware.IEhlpr Browser Plug-in
Status: Quarantined
Infected registry entries detected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2B7A0F0-B697-4A71-8D91-43443F57D7BB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A2B7A0F0-B697-4A71-8D91-43443F57D7BB} Compatibility Flags 102
When CounterSpy first ID'd adware.iehlpr, and before I elected to quarantine it, I verified it existed, by running regedit. I then rebooted and ran CounterSpy again.
To my dismay, several times, on successive CounterSpy scans, I have encountered and have had to quarantine adware.iehlpr after verifying that it exists in the registry (deja vu all over again, so to speak, i.e., similar to my Spysweeper experience). After each CounterSpy scan, after CounterSpy has quarantined adware.iehlpr, I have verified the aforementioned registry entry is removed, but then when I reboot, the registry entry returns and indeed on the next CounterSpy scan, CounterSpy finds this item again. I have removed adware.iehlpr several times using CounterSpy, but Counterspy cannot permanently remove it. I've even gone so far as to conduct a CounterSpy scan in Safe Mode, hoping the quarantining process in Safe Mode will prevent the item from returning on rebooting; unfortunately that didn't work; it always comes back. Counterspy hasn't ceased alerting on adware.iehlpr, despite numerous attempts to remove it, unlike Spysweeper which no longer finds IEHELPR, after the fifth SpySweeper scan, although it is there when I run the scan (i.e., I see it when I run regedit, just before the Spysweeper scan).
Although Spysweeper alerted on IEHELPR and CounterSpy alerts on adware.iehlpr, I believe they are the same bad actor, becuase the registry entry shown in the results of each program's scan is the same, only the number of instances of the same registry line that each program (Spysweeper and CounterySpy) found during their respective scans, were different.
Throughout the time frame involved, and through the present time, Spyware Doctor and Adaware SE Pro and Trojan Hunter and NOD32, have never alerted on anything whatsoever; go figure.
I was thinking of deleting the apparently guilty registry entry, manually, from the registry (after backuping my registry of course) but then decided seeking the advice of experts on this forum was the way to go.
Any ideas? Should I run HijackThis and reply to this post, attaching the Hijackthis.log? Nella
Edited a few minutes after posting the above, to add:
I forgot to say that I have contacted CounterSpy seeking their advice and help and they promptly replied as follows:
Thank you for contacting Sunbelt Software Technical Support.
I apologize for the inconvenience; unfortunately there is not a 100% solution against spyware/adware. Due to the nature of the spyware/adware that is out there, it is always being update/modified, and there are new variants of it released everyday. At one point an anti-spyware program might be able to completely detect and remove a threat, but in a week that could change. The anti-spyware companies always have to research these new versions and variants, and then update the definitions.
If you have any information about a new threat/variant that CounterSpy is not detecting you can submit it at the following link.
http://research.sunbelt-software.com/software_submission.cfm
Until we get this in our definitions, the best thing that you can do is go to http://tomcoyote.com/hjt/ and run the HijackThis program. This will create logs for you. You can then go to their forum: http://forums.tomcoyote.org/index.php?showforum=27 and post your logs. They can give you step by step removal.
Regards,
Consumer Support
