Help! My computer has been invaded!

[Jon]

Somehow this evening my computer has been invaded by software I did not
deliberately install. When I rebooted my computer (something I must do
every 3 hours or so, because my OS is ME), there was a splash screen
informing me that the machine was installing new software - among the
names were Gameport Joystick and some others. The reboot stalled and I
had
to use the 3 finger salute. When it had successfully rebooted, I ran
two anit-virus scans (Norton and PCillin), as well as SpybotSD. According
to them, no problems! I did System Restore to the previous day (when
there
were no problems). Upon rebooting, the splash screen announced they were
being installed, again. I looked in the device manager, found Joystick
and
removed it, but I am certain that when I reboot, it will reinstall. Using
jv16 PowerTools, I also found some other questionable programs, whose
purpose I cannot identify - namely, Humaniz, Oak Technology's Omsg,
RichFX's Player, and a few other things I don't recognize.

What can I do to permanently get rid of these, and which of them should I
get rid of?

Many thanks for helpful suggestions,
Jon

[entity]

Jon <nospam@all> wrote in message news:<7fefe387cc5842354f2ce437991e36ad@news.megane tnews.com>...
> Somehow this evening my computer has been invaded by software I did not
> deliberately install. When I rebooted my computer (something I must do
> every 3 hours or so, because my OS is ME), there was a splash screen
> informing me that the machine was installing new software - among the
> names were Gameport Joystick and some others. The reboot stalled and I
> had
> to use the 3 finger salute. When it had successfully rebooted, I ran
> two anit-virus scans (Norton and PCillin), as well as SpybotSD. According
> to them, no problems! I did System Restore to the previous day (when
> there
> were no problems). Upon rebooting, the splash screen announced they were
> being installed, again. I looked in the device manager, found Joystick
> and
> removed it, but I am certain that when I reboot, it will reinstall. Using
> jv16 PowerTools, I also found some other questionable programs, whose
> purpose I cannot identify - namely, Humaniz, Oak Technology's Omsg,
> RichFX's Player, and a few other things I don't recognize.
>
> What can I do to permanently get rid of these, and which of them should I
> get rid of?
>
> Many thanks for helpful suggestions,
> Jon
..

[Chuck]

On Tue, 11 Nov 2003 03:33:52 GMT, Jon <nospam@all> wrote:

>Somehow this evening my computer has been invaded by software I did not
>deliberately install. When I rebooted my computer (something I must do
>every 3 hours or so, because my OS is ME), there was a splash screen
>informing me that the machine was installing new software - among the
>names were Gameport Joystick and some others. The reboot stalled and I
>had
>to use the 3 finger salute. When it had successfully rebooted, I ran
>two anit-virus scans (Norton and PCillin), as well as SpybotSD. According
>to them, no problems! I did System Restore to the previous day (when
>there
>were no problems). Upon rebooting, the splash screen announced they were
>being installed, again. I looked in the device manager, found Joystick
>and
>removed it, but I am certain that when I reboot, it will reinstall. Using
>jv16 PowerTools, I also found some other questionable programs, whose
>purpose I cannot identify - namely, Humaniz, Oak Technology's Omsg,
>RichFX's Player, and a few other things I don't recognize.
>
>What can I do to permanently get rid of these, and which of them should I
>get rid of?
>
> Many thanks for helpful suggestions,
> Jon

Jon,

Start with spyware analysis. You need to run Spybot S&D and
HijackThis. Go to SWI Forums for advice. Start here:
http://forums.spywareinfo.com/index.php?showtopic=5187

You might want to harden your browser security settings. These are
helpful websites:
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/sid-5...31e3/index.php
https://testzone.secunia.com/browser_checker/

Is your Windows ME patched up to date? Make sure.
http://windowsupdate.microsoft.com/

Cheers,

Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.

[George Pontis]

In article <7fefe387cc5842354f2ce437991e36ad@news.meganetnews .com>, nospam@all
says...
> Somehow this evening my computer has been invaded by software I did not
> deliberately install. When I rebooted my computer (something I must do
> every 3 hours or so, because my OS is ME), there was a splash screen
> informing me that the machine was installing new software - among the
> names were Gameport Joystick and some others.

Gameport Joystick is a hardware resource on your computer - the chip resources
connected to the DB-15 on the back panel. All recent versions of Windows
automatically detect new hardware and install the drivers for it. Have you made a
change in your system configuration lately, such as updating the BIOS ? If you
never use the gameport you can disable it in the BIOS. That's the best choice to
stop this. Next best would be to allow it to install as it wants, then check the
box to disable the device. That way the OS knows about the hardware and has a
driver for it, but will not initialize or support it for any application.

The RichFX player and some other applications that you mention are installed
applications that you can deal with through "uninstall" or spyware tools.

[Jon]

George Pontis <gpontis@spamcop.net> wrote in
news:MPG.1a1c1358c5b3d28398968e@news.supernews.com :

> In article <7fefe387cc5842354f2ce437991e36ad@news.meganetnews .com>,
> nospam@all says...
>> Somehow this evening my computer has been invaded by software I did
>> not deliberately install. When I rebooted my computer (something I
>> must do every 3 hours or so, because my OS is ME), there was a splash
>> screen informing me that the machine was installing new software -
>> among the names were Gameport Joystick and some others.
>
> Gameport Joystick is a hardware resource on your computer - the chip
> resources connected to the DB-15 on the back panel. All recent
> versions of Windows automatically detect new hardware and install the
> drivers for it. Have you made a change in your system configuration
> lately, such as updating the BIOS ? If you never use the gameport you
> can disable it in the BIOS. That's the best choice to stop this. Next
> best would be to allow it to install as it wants, then check the box
> to disable the device. That way the OS knows about the hardware and
> has a driver for it, but will not initialize or support it for any
> application.
>
> The RichFX player and some other applications that you mention are
> installed applications that you can deal with through "uninstall" or
> spyware tools.
>

Thank you for your response. No, I have not added any hardware nor
changed the BIOS since I reformatted last June. I already disabled
the Joystick in the Device Manager, and it did not return. I also used
jv16 PowerTools to remove the Humaniz at the registry. It also has not
returned. What I am not certain about now is:

(1) Are RichFX player, Vdo Multimedia, Envivio TV, Intervideo Common, L&h
TrueVoice, and Oak Technology Omsg, all of which I did not specifically
install and all of which are multimedia programs, part of some necessary
program I do want to use or are they part of the invasion?
How do I determine that? Neither SpybotSD nor Ad-Aware are disturbed by
their presence.

(2) How did it happen in the first place? I have ActiveX disabled on my
browser, I have ZoneAlarm and WinPatrol watching what is coming in and
being installed. I do not click on attachments in emails coming from
people I do not know.

Jon