Drivecleaner virus and firefox. Why is drivecleaner stalking me?

June 24, 2007 5:42 PM

Firefox and disk cleaner virus - not sure if I have the virus or not....

I have firefox 2.0.0.4, avisoft antivirus, and zonealarm on my work and home PCs and all software is up to date. Regardless, I seem to have contracted the diskcleaner virus. On both computers, it behaves exactly the same way; that is, the disk cleaner pop up comes up in the lower right hand corner of my screen, and when I close it via the "X", firefox closes. I don't want to click anywhere else on the window for obvious reasons.

When Firefox is restarted, it has a new window size. I got it thru Stumbleupon. (www.stumbleupon.com)

I've googlefu'd the groups and can't find any reason why it is happening. Symantec among others says to reboot in to safe mode, do a regedit, etc., etc., and I have done that, but I don't have the same reg keys that the article says, and I don't have a Diskcleaner directory on my drive. In other words, I seem to have the symptoms, but not the disease.

At work, I am behind a firewall, and at home my wireless router connected by cable.

My Mac laptop doesn't have this problem.

So, do I have the virus or not? Is there a definitive source of info on this? This is starting to piss me off.

Thanks in advance.

posted by fox_terrier_guy to computers & internet (6 comments total)

Re-reading, it should say "I got the virus thru Stumbleupon". Y'know someone should invent a button that says "Preview" so you can see this stuff before you hit "Post".....
posted by fox_terrier_guy at 5:48 PM on June 24, 2007

I seem to have contracted the diskcleaner virus.
What do you mean diskcleaner virus? Could you give us the name of the process?
posted by rancidchickn at 7:52 PM on June 24, 2007

Install Spybot Search & Destroy, bring it up to date, and run a scan.
posted by flabdablet at 8:03 PM on June 24, 2007

Drivecleaner (not "disk cleaner") is a malware, not really a virus. The Firefox version appears to be a type of trojan add-on (extension).

What you should do is disable all your add-ons and then re-enable them one by one (or only have one working at a time) until you determine which one is the BHO at fault. Then completely remove that one, see if re-installing it from the original site brings the pop-ups back, or not.

More. The add-ons at fault are mainly commercial toolbars such as Google or Yahoo!.
posted by dhartung at 12:00 AM on June 25, 2007

I recently went through about of infection with this nasty piece of malware. I heartily second "Spybot Search & Destroy". I also found HiJackThis very useful to go with it. HiJackThis doens't actually detect malware but it looks in all the places malware hides and tells you what's there. It was the only thing that told me about some of the dll's drivecleaner was using to survive being deleted.
posted by adamt at 4:10 AM on June 25, 2007

I have gone the Spybot and Adaware route, along with WIndows Defender (no better than the others it seems), and none of them have detected the swine-ware. The only other thing I have found to apparently work or at least keep it at bay is CCleaner.

I also have run a HiJack scan, and can't find it the DLL's there. Its a little bit frustrating....

I installed Google Desktop, and I note that Stumbleupon also has a search bar. Lesson learned!
posted by fox_terrier_guy at 6:10 AM on June 25, 2007