Comments on: Drivecleaner virus and firefox. Why is drivecleaner stalking me?

Question: Drivecleaner virus and firefox. Why is drivecleaner stalking me?

fox_terrier_guy — Sun, 24 Jun 2007 17:42:30 -0800

Firefox and disk cleaner virus - not sure if I have the virus or not....

I have firefox 2.0.0.4, avisoft antivirus, and zonealarm on my work and home PCs and all software is up to date. Regardless, I seem to have contracted the diskcleaner virus. On both computers, it behaves exactly the same way; that is, the disk cleaner pop up comes up in the lower right hand corner of my screen, and when I close it via the "X", firefox closes. I don't want to click anywhere else on the window for obvious reasons.

When Firefox is restarted, it has a new window size. I got it thru Stumbleupon. (www.stumbleupon.com)

I've googlefu'd the groups and can't find any reason why it is happening. Symantec among others says to reboot in to safe mode, do a regedit, etc., etc., and I have done that, but I don't have the same reg keys that the article says, and I don't have a Diskcleaner directory on my drive. In other words, I seem to have the symptoms, but not the disease.

At work, I am behind a firewall, and at home my wireless router connected by cable.

My Mac laptop doesn't have this problem.

So, do I have the virus or not? Is there a definitive source of info on this? This is starting to piss me off.

Thanks in advance.

By: fox_terrier_guy

fox_terrier_guy — Sun, 24 Jun 2007 17:48:24 -0800

Re-reading, it should say "I got the virus thru Stumbleupon". Y'know someone should invent a button that says "Preview" so you can see this stuff before you hit "Post".....

By: rancidchickn

rancidchickn — Sun, 24 Jun 2007 19:52:23 -0800

I seem to have contracted the diskcleaner virus.
What do you mean diskcleaner virus? Could you give us the name of the process?

By: flabdablet

flabdablet — Sun, 24 Jun 2007 20:03:29 -0800

Install Spybot Search & Destroy, bring it up to date, and run a scan.

By: dhartung

dhartung — Mon, 25 Jun 2007 00:00:11 -0800

Drivecleaner (not "disk cleaner") is a malware, not really a virus. The Firefox version appears to be a type of trojan add-on (extension).

What you should do is disable all your add-ons and then re-enable them one by one (or only have one working at a time) until you determine which one is the BHO at fault. Then completely remove that one, see if re-installing it from the original site brings the pop-ups back, or not.

More. The add-ons at fault are mainly commercial toolbars such as Google or Yahoo!.

By: adamt

adamt — Mon, 25 Jun 2007 04:10:43 -0800

I recently went through about of infection with this nasty piece of malware. I heartily second "Spybot Search & Destroy". I also found HiJackThis very useful to go with it. HiJackThis doens't actually detect malware but it looks in all the places malware hides and tells you what's there. It was the only thing that told me about some of the dll's drivecleaner was using to survive being deleted.

By: fox_terrier_guy

fox_terrier_guy — Mon, 25 Jun 2007 06:10:27 -0800

I have gone the Spybot and Adaware route, along with WIndows Defender (no better than the others it seems), and none of them have detected the swine-ware. The only other thing I have found to apparently work or at least keep it at bay is CCleaner.

I also have run a HiJack scan, and can't find it the DLL's there. Its a little bit frustrating....

I installed Google Desktop, and I note that Stumbleupon also has a search bar. Lesson learned!