jeannie
Warlord
A friend of mine called me today because he was getting pop-ups about a spyware tool, so I went over to his place to help him.
The pop-ups seemed to multiply, and eat up more and more of his memory, and he had called Microsoft for advice and they told him to download Adaware. This little 'monster' then also interfered with www.download.com so if you asked to download Adaware or Spybot, it would tell you it was downloading but never ask what you wanted to do with the file (run it, save it, et.) - just tie up further resources in the system. I finally remembered the TUCOWS site and we got ADAWARE there.
Norton Antivirus identified file windows/system32/pplh.dll as a suspicious file and recommended deleting it, and he confirmed he wanted to delete it, but Norton didn't delete it. Nor could we manually delete it - it said it was in use and was a crucial system file
After updating the Adaware files (I guess these are similar to 'virus signature' files) to the ones dated yesterday, Adaware also identified it and DID delete it.
But a couple of hours later, it came back - but under a different file name. I left, since we'd spent close to 12 hours getting the problem 'fixed' before it re-occured.
Questions:
1) How to stop this happening again.
2) Is this a 'virusl' or is it spyware? I'm not sure I understand the distinction in this case.
3) how to fix it.
4) any other advice.
The pop-ups seemed to multiply, and eat up more and more of his memory, and he had called Microsoft for advice and they told him to download Adaware. This little 'monster' then also interfered with www.download.com so if you asked to download Adaware or Spybot, it would tell you it was downloading but never ask what you wanted to do with the file (run it, save it, et.) - just tie up further resources in the system. I finally remembered the TUCOWS site and we got ADAWARE there.
Norton Antivirus identified file windows/system32/pplh.dll as a suspicious file and recommended deleting it, and he confirmed he wanted to delete it, but Norton didn't delete it. Nor could we manually delete it - it said it was in use and was a crucial system file
After updating the Adaware files (I guess these are similar to 'virus signature' files) to the ones dated yesterday, Adaware also identified it and DID delete it.
But a couple of hours later, it came back - but under a different file name. I left, since we'd spent close to 12 hours getting the problem 'fixed' before it re-occured.
Questions:
1) How to stop this happening again.
2) Is this a 'virusl' or is it spyware? I'm not sure I understand the distinction in this case.
3) how to fix it.
4) any other advice.
