Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How 2 Get Rid Of Funwebproducts Adware


  • Please log in to reply
7 replies to this topic

#1 ToborTheGreat

ToborTheGreat

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:31 PM

Posted 06 March 2007 - 12:23 AM

After having had 2 sites inform me that I'm infested with FunWebProducts (IWon) scamware, I'm beginning to suspect there may be some veracity to it. This in spite of the fact that I've used Spy Sweeper, Spybot Search & Destroy, and System Suite Pro 6 regularly. A link to NetWork World from that last site had an informative article about FunWebProducts, saying to check a link beside the article for a solution, but there didn't seem to be one.

Does anyone know how to check for this parasite, and, if infected, how to get rid of it? Remember, the above 3 antispyware programs haven't discovered it...

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,911 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:31 PM

Posted 06 March 2007 - 04:31 AM

Hello ToborTheGreat:

Try this program which is a powerful Anti-spyware product:

Download and install SUPERAntiSpyware free found here: http://www.superantispyware.com/superantis...efreevspro.html

Be sure to click on the download button to the left, not on the free trial download on the right.

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.
To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).

Now you can see what it found or didn't find.

Click close and close again to exit the program.

Let us know if this takes care of the problem for you.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 buddy215

buddy215

  • Moderator
  • 13,091 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:01:31 PM

Posted 06 March 2007 - 08:04 AM

The link below has more info and removal instructions:
http://www.pchell.com/support/mywebsearch.shtml
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#4 ToborTheGreat

ToborTheGreat
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:31 PM

Posted 12 March 2007 - 11:35 PM

Sorry about the delay. I downloaded SUPERAntiSpyware and followed the directions above to the letter. After running the scan (for about 5+ hours!), the software detected 76 items, as follows: 68 Adware tracking cookies, 4 adware MyWebSearch, 3 Malware (VirusBurst), and 1 Trojan (Media-Codec). Those last 4 I thought I was rid of. I assume the 4 MyWebSearch are FunWebProducts entities (nothing specifically titled FunWebProducts or IWon, however). All are now quarantined. SAS seems to be a very effective product, and found infestations that the 3 antis I refered to previous did not. Thanks for the information, Orange Blossom.

Then I performed a test by going to TigerDirect and doing a search, though whenever I entered a product into the search box, however general, all I got was white screen where the product(s) should show up. But I was able to navigate all over the site via links, and did not get any FunWebProducts infestation warnings. Somewhat inconclusive, I guess. Still, I'm not worried.

Also, thanks for the link to PC Hell, buddy215, and the descripts and instructions therein. One thing bothers me: When I allowed my mouse pointer to linger (I didn't click any of them, mind) over certain key word/links in the text, some of them direct references to the very spyware in question, miniscule ad windows (ex: one of the ads is for coolcursors.net) appeared and I received "loading..." notifications on my toolbar. Foremost in my mind is the question: what was downloaded, and where did it go?

#5 buddy215

buddy215

  • Moderator
  • 13,091 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:01:31 PM

Posted 13 March 2007 - 06:18 AM

Rerun Super Antispyware. Run it in Safe Mode. The first link below is for Virusburst removal. Did you check your Add/Remove program for all the products that were mentioned on PCHell site ? Sounds like you haven't removed something that is still downloading adware. Or you are reinfected.
http://www.bleepingcomputer.com/forums/t/63896/how-to-remove-virusburst-removal-instructions/
If you still have a problem or want to be reassured that the infections are gone, follow the directions in the link below for posting a Hijack This log in the appropriate forum
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/


Concerning System Suite Pro 6---From looking for info on this product it appears to be a mishmash of odds and ends of freeware available elsewhere. I hope you are not relying on its antivirus and antispyware scanners. What firewall are you using? It also has a "registry cleaner" that I would avoid like the plague.
As far as mousing over key words and seeing ads, the same would happen on a lot of sites including this one if you visit without logging in or blocking scripts for the Google ads.

Edited by buddy215, 13 March 2007 - 07:33 AM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#6 ToborTheGreat

ToborTheGreat
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:31 PM

Posted 18 March 2007 - 01:18 PM

Nope, no FunWebProducts from the list in my Add/Remove Programs list. Additionally, I ran SUPERAntiSpyware again before returning to bleepingcomputer. It only detected 2 adware cookies this time, one from TigerDirect, quarantined them. Next, I ran SUPERAntiSpyware in safe mode a few days later. Detected total of 12 adware cookies, none of which appear to be related to anything on said list, quarantined them.

After your entry, I did a cursory Google search of System Suite Pro 6. Checked 2 pages, but they only contained various links to the product. I would be interested in seeing the source for your information. I'd been putting off renewing my subscription for about a month, as it was.

So, what does it do to the registry, since I've already run it a couple times or more? No, I've never relied totally upon the program for firewall, antivirus or antispyware. I don't really trust any product out there completely.

Funny thing is, I'd never experienced the weblink minipopups before, after 6+ years of websurfing. Then, just as you said, I found them here when I reconnected without logging in. Must be something new, or I'd have seen them before.

Thanks for the bc links above.

#7 buddy215

buddy215

  • Moderator
  • 13,091 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:01:31 PM

Posted 18 March 2007 - 02:25 PM

The link below has comments about registry cleaners.
http://www.windowsbbs.com/showthread.php?t...egistry+cleaner

The comments about System Suite Pro 6 I believe were from Amazon and CastleCops. You will find several programs across the net that entice users with the same type product that they claim will do everything/fix everything.
The link below is to a list of free products put together by the members here.
http://www.bleepingcomputer.com/forums/topic3616.html

The third party cookies that your security programs keep finding can be kept from every getting on your computer in the first place. Here is a link to explain what those cookies are and how to block them if you choose to do so. You don't need third party cookies to view or use web pages.
http://www.mvps.org/winhelp2002/cookies.htm
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#8 ToborTheGreat

ToborTheGreat
  • Topic Starter

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:31 PM

Posted 25 March 2007 - 11:24 PM

Thanks for the links. Worst thing I did was run a freeware registry cleaner, whose name I forget, about a year ago. It was highly regarded, judging from the attendant quotes, so I plunged on in. I learned my lesson well. But that's another topic.

IE now set to block third party cookies, prompt for the others. The freeware links look good. I'll check them more in depth later.

Cheers.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users