My Week Long Struggle with Sandboxer.exe

Words cannott describe the amount of hatred I feel for the people that write spyware. I'd rather these people receive 4 welfare checks directly out of my pocket than let them continue writing this crap. I am not sure whether fighting these people through legal means is feasible, but I am definitely questioning my normal "let a capitalistic solution develop" opinion when it comes to controlling or eliminating under-handed marketing practices such as spam and adware/spyware.

I am used to receiving spam, and I think the problem is actually under control. Handling spam may be a perennial chore, but spam detection and blocking has improved and there are a lot of different companies working on it. Plus, I can easily deal with it, by deleting them when they come. It only takes a second.

However, adware and malware are totally different.

There is no possible way that the average computer user can fight or prevent adware or malware.

I went up against sandboxer today. How did I know it was sandboxer? The same pop-up came up from them frequently. Now, that is usually just a clue that the adware or malware is delivering pop-ups from a "letigimate" 3rd party advertising network. So, it usually isn't much of a clue. Since I have a general awareness of the names of most ad networks, I had a feeling this wasn't the case.

Now, most adware/malware removal experts, start by telling you to download the free version of ad-aware and spybot search and destroy and if you have browser hijackers, hijackthis. These programs are fairly easy to use for an average computer expert. (Ad-Aware is easiest.) I am an expert now.

However, after running both of those and getting a clean slate, I was still being attacked by pop-ups.

So, I also ran PestPatrol and SpyHunter (both of these products were purchased). They detected some threats that the others hadn't, but I still got the pop-ups.

So, I did a search for sandboxer.exe and came upon this page on pestpatrol's website for MANUALLY deleting sandboxer.

This pest is amazing. It runs two concurrent processes and each monitor the other. As soon as you delete one, the other one notices and re-installs one of his other buddies. They also have 4 other buddies that are waiting in the wings to be activated. And they also create another buddy when you delete the other buddies' files.

So, in order to defeat this bastard, you need to be comfortable with deleting registry entries using regedit, finding and deleting normally hidden system files, as well as ending running tasks using task manager. Not to mention finding files by their disk size, registry entries based on their string size, and matching running processes tasks with their executable files. (Hint: If you are fighting this using pestpatrol's instruction, when deleting the process tasks in task manager, end the "process tree", not just the process)

There is no way the average computer user could ever pull this off. I am certainly not an expert, but have done enough coding/software to be comfy following the complex instructions. This was my first time doing all those things to fight spyware, though. And I wouldn't have attempted it, unless it was absolutey necessary, because of the risk involved with deleting registry entries and system files. (Your computer might not reboot if you delete the wrong things.) It was my last ditch attempt before reinstalling the operating system. So, it was worth a shot.

And it worked!

So, I finally beat those bastards after more than a week of struggling. (knock on wood) I felt like Chevy Chase in CaddyShack trying to defeat the groundhog that just keeps popping his head up. Sandboxer must have definitely been inspired by that seemingly self-replicating nuisance.

Unfortunately, for my fiance, the fun is over. She was enjoying the comedy of my frustration and use of profanity.

In the words of Dick Cheney, these people can "go F%^& themselves!".

And somebody has to figure out how to deliver that message. The current tools available just don't cut it, especially for an average computer user.

Comments

[Martin Little]

It definitely sounds like you need to become a friend of Firefox (http://www.mozilla.org/products/firefox/)!

[Peter Caputa]

ironically, the thing that is keeping me from switching browser are the toolbars I use (google, yahoo and stumbleupon)

[Justin Walters]

Actually, those toolbars needn't keep you from Firefox.

- StumbleUpon has a Firefox version available.
- Firefox has a search field built into it's toolbar, which defaults to Google but can be customized to use any search engine.
- Firefox has built-in popup blocking.

These features plus the ability to put JavaScript in a toolbar bookmark link allows you to do pretty much anything that these 3rd-party toolbars can do. Oh and tabbed browsing enhances your surfing to the point of being able to say "I know Kung Fu." with more confidence than Neo, after an intense surfing session.

[Hebbo]

Help! I have a sandboxer problem and I am no where near confident enough to try what the guy did with his 'week long struggle'. I'm just an average Joe user, is there any other way I can stop this thing and these soul destroying nuisance pop-ups????

[Martin Johnson]

Just a detail, but the Spyaudit website/scanner lists StumbleUpon as adware to be removed. I wouldn't mind, but this is happening after I "uninstalled" the StumbleUpon toolbar.

I also found that, once I had used StumbleUpon to visit a few websites that its users had recommended, my system was choking up with other adware.

[Brady]

Does anyone else feel that these programs should be illegal? I think very stiff penalties should be used to the company that has the content in the pop up. They are easier to track and since they are the ones paying for the service, they should pay the price.
I have contacted my congressmen with this concern and I urge all who read this and hate spyware and pop ups to do the same. Lets his theses jerks in the part that they hold dearest, thier pocketbooks!

[peter]

it isn't that simple. the person that bought the ad doesn't often know that it is being served through these means. They simply buy ads from wholesalers, and the wholesalers buy the inventory. There could actually be 4 layers of brokers involved in these sales.