Replies

A good place to check for those unwanted installs is the Hall of Shame List over on Calendar of Updates.
http://www.calendarofupdates.com/updates/index.php?app=calendar&module=calendar&cal_id=&do=showevent&event_id=44514

I have moved away from foxit and have been using for a couple of years now the PDF xchange viewer which also has a free version and I much prefer it. You do have to watch out for unwanteds of course (ask toolbar and it is an opt out so must de-select the button) but it is a very nice product.
http://www.tracker-software.com/product/pdf-xchange-viewer
http://download.cnet.com/PDF-XChange-Viewer/3000-10743_4-10598377.html

options to consider
In Firefox, click on the Tools Tab > Options… > Privacy Tab.
Then, in the Cookies Pane, ensure the Accept Cookies box is checked. Click on the Exceptions Button and type in the URL of the website you want to block, and click close, close and done.

use an add on for firefox
https://addons.mozilla.org/en-US/firefox/addon/3145/

add the url to your HOST file or add a good well known HOST file
http://www.mvps.org/winhelp2002/hosts.htm
http://www.bleepingcomputer.com/tutorials/tutorial51.html

a little tutorial I found on how to use the Windows HOST file and add the url to it
“1.Go to your HOSTS file which is located at:
C:WINDOWSSYSTEM32DRIVERSETC for windows Vista and XP
C:WINNTSYSTEM32DRIVERSETC for Windows 2k
C:WINDOWS for Windows 98 and ME

2. Open HOSTS with Notepad.

The default Windows HOSTS looks like this:
______________________

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a “#” symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
#
127.0.0.1 localhost
_____________________________

3. Directly under the line that says 127.0.0.1 Localhost, you will want to type:

127.0.0.1 name of the URL you want to block

For example to block the MySpace.com homepage (highly recommended!), simply type:

127.0.0.1 myspace.com
127.0.0.1 http://www.myspace.com

Other parts of MySpace could be blocked in a similar way:

127.0.0.1 search.myspace.com
127.0.0.1 profile.myspace.com
etc etc etc…

You may need to add sites with both with and without the “www.”. Test after blocking to make sure you got it right.

You can add as many sites as you wish to block in this fashion.

4. Close Notepad and answer “Yes” when prompted.

5. Reboot your computer and attempt to access your now blocked website. You should see a Cannot find server or DNS Error saying: “The page cannot be displayed”.

edit to add I would also install the free spywareblaster which you update weekly and then enable all protection so the shield is green, no scans to run it just helps protect you from certain known bad sites.
http://www.javacoolsoftware.com/spywareblaster.html

Totally agree with Corrine, her vast experience in cleaning infections on the many help forums she volunteers on is amazing. It is now being recommended in many places to not remove restore points until it is positive that the clean up is done, then you can go to system restore and clear the restore points if you choose to. It is always better to have any restore point to go to rather than none at all if something should go terribly wrong during a clean up. This article does a very good job in explanation.
http://msmvps.com/blogs/spywaresucks/archive/2005/09/17/66724.aspx

from it a quote by Jim Eshelman, MVP of aumha.net
“..it is also true that, in cleaning highly infected systems, sometimes you make mistakes that cripple Windows and it is better to be able to take a step back to a working version of Windows – even an infected one! – rather than have Windows trashed completely. To quote Mow Green, “a leaky lifeboat is better than no lifeboat in a storm.”

wow I am so sorry you had to go through that! I have heard so many horror stories from people trying to install sp3. Those that had an easy go of it just do not understand what a mess it can be for some people. Excellent thinking on creating the restore point and trying to do an image. What a bad time for an image to fail. I hope you find everything is ok with the pc now.
Happy 4th of July weekend!

I am with you it would definitely bother me also if I saw it doing any type of activity and I had not initiated it myself.
Have you visited the flash player settings panel? there are settings there for webcams and privacy, you may want to go through those various panels and settings and make sure you have it set to not allow contact with your webcam.
http://www.macromedia.com/support/documentation/en/flashplayer/help/help05.html
on the left on that page are the various settings panels. Those settings when adjusted or changed are applied to your computer.

here are the steps should you need them for that error
http://support.microsoft.com/default.aspx?scid=kb;en-us;315311

http://support.microsoft.com/kb/950717

http://support.microsoft.com/kb/822798

http://www.theitdoc.com/2008/05/12/trouble-with-service-pack-3-heres-some-tips-that-might-help/

http://aumha.net/viewtopic.php?f=83&t=33295

those should help you with that problem.

one question I always ask when I hear that one Antivirus was change to some other antivirus. This is did you run the dedicated removal tool for the antivirus program you had on the pc before you installed the new antivirus program? If NOT then you should consider doing that before anything else because that can cause problems in itself. Parts remain behind and can cause conflicts.

You mention you had AVG, there is a dedicated AVG removal tool you use. I will provide a link to Corrine’s excellent blog where she has instructions for how to use these tools and also a list of the various removal tools, you will want to go down the list to the AVG removal tool.
http://securitygarden.blogspot.com/2008/09/antivirus-product-removal-tools.html

there are some great malware removal forums out there that help guide through infection removal however some of the steps can be intimidating. It does take persistence, patience and understanding.
http://asap.maddoktor2.com/

These are often difficult or impossible to do with out help, you can get help at one of the excellent malware removal support forums. They will guide you through a clean up specific for your infection. You can find many listed here on the ASAP website.
http://asap.maddoktor2.com/

Bleeping computer has some excellent guides on how to remove some of these rogue infections also
http://www.bleepingcomputer.com/forums/

some links with info about that sneaky install
the register article

removing it info at lifehacker
http://lifehacker.com/5560116/remove-microsofts-search-helper-add+on-from-firefoxremoval link

http://arstechnica.com/microsoft/news/2010/06/microsoft-slips-ie-firefox-add-on-into-toolbar-update.arsMore info

Also by Susan Bradley in the windows secrets newsletter:
“2237744
MS update installs unwanted add-on in Firefox

If you bought an HP computer with the Microsoft Bing toolbar preinstalled, you might be wondering how Microsoft’s Search Helper Extension 1.0 got installed on your copy of Firefox. Thank a recently released Search Enhancement Pack for that.

The bad news is, you can’t remove it from Firefox without breaking the Bing Bar or the MSN Toolbar 4.X — both require the add-on to work properly.

► What to do: For those running Windows Live Toolbar or MSN Toolbar 3.X, you can uninstall the Helper Extension by following the instructions in Microsoft support article 2237744

. Better yet, get rid of Bing Bar and/or the MSN Toolbar altogether.”

you do not mention your firefox version, have you updated to the latest version? If not try that, you can also try a re-install of firefox.
I assume you have tried clearing the cache and cookies and stuff in firefox already?

I too use a multi platform approach, image drives, external hard drive storage, flash drives, etc but I do also have the online storage which also takes care of having an off site storage. I use ADRIVE which gives a very generous 50Gig of free space(not a trial actually free) and is easy to use. You have the option to purchase extra space of course.
http://www.adrive.com/Adrive

I have used open office for several years now on all my linux boxes and really liked it, I now use it on the windows boxes too. No longer have MS Office. OO does everything I need and Free is always good.

I agree with Corrine, I do not like or recommend the use of registry cleaners. I like to point to the excellent discussion on the topic at AumHa forums which was compiled by Bill Castner. Lots of great info there by extremely knowledgeable folks.
should I use a registry cleaner

If your sticker has faded or can no longer be read and you need to know your key there are some programs that you can run on the pc that will show you your key codes. One I have used in the past is Magical jellybean
Magic Jellybean
more can be found here
Retrieve your XP Product Key
another useful tool is the free belarc advisor.
belarc