It keeps coming back no matter what I do!! Right Media

[Paper Roses]

My combination of MSE anti-virus, Malwarebytes and Spybot S&D seems to keep this machine in order lately. I've manages to keep out of trouble for a while anyway. I do the updates several times a week, running the AV and M/B. On occasion I will run Spybot. Spybot always finds in red, Right Media.
I update, immunize, run the scan and there it is.

I have gone to some of the computer help sites and find that this bugger is a problem for many.
Since you all know my sub-par level of computer expertise, anyone know what I can do to get rid of this spyware and keep it gone?

Maybe it is harmless, I don't know but people on other sites seem to think it is a problem. I just can't understand some of the technical cures given.

Thanks, PR

[CK_John]

1. I assume you are talking about "RightMedia" an advertising firm bought by Yahoo. You gave us good

background but we need OS, broswer, and description of problem. This firm has a shady rep for putting out ads for bogus products but it is no worse than doubleclick used by Google for its ads.

As soon as we findout if its the company or their ads we can work something out. Don't worry about the tech stuff we'll help you with that.

[Paper Roses]

2. Yup, RightMedia. Here's how things seem to go.

My computer gradually slows down after a few days, I do the typical(internet options) housecleaning, delete temp files, cookies,history, etc. I update everything, run malwarebytes and my AV.
If the spirit moves me, I do the Spybot thing. Thats where RightMedia shows up in red. It seems to come back right away because I tried once to see if it was gone the next day and it was back. Why does MSE not catch this? Once I get rid of the RightMedia, things speed up but a day ot two later the whole machine starts its slow down again. I have the distinct feeling that something is going on but can not put words to it. A few strange things have happened as of late. The computer will freeze and I have to use the Task Manager to turn off. A few times the whole Internet screen would move around. I don't mean the monitor just the screen. As I moved the mouse, it would jump all over the place with a little line shadow. When that happened, I just turned the machine off in the normal manner.

My info: Internet Explorer
XP SP3
HP Home Ed 2002
Pavilion 763N 786MB Ram
Intel Pentium (R) 4CPU 2.53 GHZ

MSE AntiV
Malwarebytes.Updates at 10AM daily
Spybot(occasional)
Custom Microsoft updates kept to date.

Windows Firewall
Available:
Ccleaner and Rev Uninstaller.

If there is other info you need, please let me know where it is and I'll send it along.

[Earth Bound Misfit]

3. RightMedia is a tracking cookie, and they've been known to spread malware in their ads.

Here is a topic about Right Media from the Spybot Forum I think will be of interest: http://forums.spybot.info/showthread.php?t=30247

If you don't want cookies, you may want to use any of these methods for blocking:

How to block 3rd party cookies in Internet Explorer, Opera, Safari tutorial: (http://www.safer-networking.org/flash/howto/overview.html)

Install SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.

IE-Spyad (http://www.spywarewarrior.com/uiuc/resource.htm#IESPYAD)
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites

Consider Firefox (http://www.mozilla.org/products/firefox/) It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

Install MVPS Hosts file (http://www.mvps.org/winhelp2002/hosts.htm) This prevents your computer from connecting to harmful sites.

Spybot is not what is used to be, according to many experts in the field. Consider using SUPERAntiSpyware: http://www.superantispyware.com/

You might want to consider using a 3rd party firewall, the WinDOZE FW doesn't monitor outgoing traffic. I use Online Armor (Free):
http://www.tallemu.com/products-online-armor-free.php

As for your other issues, CK_John is far more knowledgeable than I, I am SURE he will help you.

[CK_John]

4. Thanks for info. I'd like to tackle problem 2 it may be more serious than cookie problem.

Prob 2 (screen and mouse movement) could be someone actually viewing and controlling your computer. This a valid builtin XP function and is used by support tech to provide online assistance. Microsoft has turned this on by default. Thus bad guys try to use this to get in without your knowing.

Users need to turn this off and only use it when working with a call center that you trust. To turn off: right click My Computer and regular click on properities. Then click on the "remote" tab and uncheck the remote assistance box. This should close this door.

Now prob 2 could just be a power fluction on your electric company line or the power transformer in your PC starting to show its age.

Prob 1: EBMisfit has done a great job. The problem seems to be a cookie named (adyieldmanager.com or yieldmanage) still trying to pin this down.

The first tutorial shows how to block 3rd party cookies in IE8(not sure of your ver) . The lesson shows to block the cookies but... there is another option to "prompt". This is the one I would recommend, but... it will ask everytime a 3rd party wants to set a cookie. This may become counter productive and can be changed back to "block".

In Firefox they have an option to keep cookies until you close Firefox. This is another reason I use it as my browser.

Currently working on a practical way to ban this single cookie without reinventing the wheel. Running CCleaner with cookies checked in IE after an online session will delete all cookies and is a temp solution. (Uncheck form data to prevent password cookies from being deleted).

[Paper Roses]

5. Situation 1, unchecked box. Tomorrow will try EBMisfit's ideas.

I'd rather not have Spybot on here at all but sometimes I get this funny feeling that it would be a good idea to see if The main housecleaner is doing a good job. I'm trying to keep good notes as to what I did just in case.

P.S. I have IE7

Thanks

[CK_John]

6. Work on 1 step at a time so that problem can be gaged and measured.

Pre step 1 I would upgrade to IE8 and also bring windows updates current.

[Paper Roses]

7. RE: Step one. Have to find another way.

Last night I did the dance to stop 3rd party cookies as suggested.

In an attempt to sign out of Hotmail this AM, I got this message:

"Sign out failed because your browser seems to be blocking third party cookies.
Close browser to sign out.

To prevent this error in the future, you must enable third party cookies by changing your browser settings".

Changed back, so much for that one.

Today is another day. I will re-read links and do some more research on how to get rid of RightMedia. Why do the simple routes never work?

[Earth Bound Misfit]

8. I'm not sure your instability problems are due to the presence of tracking cookies like RightMedia

Tracking cookies are used by many types of sites to determine where you may have surfed, which pages you visited, and what ads you may have been shown. Cookies are also used to remember logins on certain webpages such as Google, Yahoo and MSN. Cookies can also be used to save user preferences and options so the site can identify you the next time you visit and customize the site to your personal configuration. You may wish to trust those cookies if they belong to sites you trust. Cookies by themselves are not harmful as they are simple text files or text representations of data.

I run SUPERAntiSpyware scans once a week and the scans ALWAYS include these two "threats" which I remove only to see them in the next scan. :shrug:

C:\DOCUME~1\UserName\Cookies\[e-mail]<2>.txt
C:\DOCUME~1\UserName\Cookies\[e-mail]<2>.txt

I would work with CK_John and see if your problems lie elsewhere, which IMHO is more likely the cause(s) of your instabilities.

[Earth Bound Misfit]

9. Another reason to switch to Firefox/Thunderbird or another browser/e-mail client.

Micro$HAFT STRIKES AGAIN!!!11!11!!!

http://msmvps.com/blogs/donna/archive/2009/11/13/microsoft-defends-hotmail-s-cookie-requirement.aspx

Micro$HIT defends Hotmail's cookie requirement

Micro$LOP has said its new policy of requiring users to accept third party cookies to log out of Hotmail improves security.

We reported the change, which was applied earlier this month, yesterday.

Some readers who contacted El Reg said it raises the risk that accounts will be compromised on public machines, while others who do not allow third party cookies simply found the error message when they tried to log out irritating.

Angus Logan, the product manager for Windows Live ID, told The Register the use of third party cookies has two benefits.

"We write our cookies to multiple domains to give users a good experience with single sign-on, so they can be authenticated to multiple sites (e.g. MSN, Xbox Live, Windows Live, Bing) at once without having to retype their password," he said.

"(It also) helps protect user security, by separating the authentication cookies that are used for different services. If a cookie in one domain is compromised, it means that user assets in another domain won't be compromised."
----------------------------------------


I downloaded the "Windows Live" CRAP/BLOATWARE....and uninstalled it about 6 hours later.

[CK_John]

10. Last night checked out my machine and found that SpywareBlaster blocks

"yieldmanager" aka rightmedia works for both IE and Firefox. Background I replaced S&D with Spyblaster last yr because it uses far less resourses and is low maintance. It is just a list of bad sites and it blocks them them. In Firefox you see the web page plus a 404 page not found where the blocked ad would have been, the page is fully functional.

(Background) S&D problems began when a spammer who cut a plea deal with authories and pleged to reform. They then sued S%D to have their site unblocked and the court ruled for the spammer and S&D was forced to issue a public apology and put a notation on their site also. Now all spammer on S&D list are threating to sue and the courts are siding with the spammers and asking who appointed S%D or Microsoft or Google the internet police. One persons spam is anothers way of surfing the net. Touchy problem and will do in the spam blocker(no one wants to be sued all the time). That is why S&D list is getting smaller and less effective.

[Paper Roses]

11. Think I should uninstall S&D via Revo and then install

SpywareBlaster? I can install through MajorGeeks. No problem. I have used Revo before and it is easy to use for a dummy like me.

Anything I should do first if this is what you think I should do?

[CK_John]

12. SpywareBlaster can exist with S&D install it and after a period of time

of use and update cycle (besure you update it and enable all protections), then you can remove S&D or update it and run it less frequently.

Note SpywareBlaster updates about bi weekly, not very often.

Or do this. Start CCleaner and select tools on the left. Then click on startup. It will show a table of things that start at bootup. Look down the table for a line reference to S&D, when found click on line to highlight and then click on disable down on the bottom center. That's it. S&D is still on your system but it will not startup and can be reenabled in the future. Close CCleaner.

[Earth Bound Misfit]

13. GREAT post, GREAT info....

GREAT JOB! :toast: :toast:

Thanks!