Friday, April 20, 2007

clean32.com spyware

I've just fixed a malware infection. The computer had started randomly communucating with:

www.registrycleanerxp.com
www.clean32.com
www.fix64.com
(Don't open those sites!!!)

I discovered that the computer was also trying to download
www.clean32.com/setup.exe

I used URL Snooper (donationcoder.com) to find out what was being accessed. URL Snooper is supposed to display URLs but it started to show text like:

you install the cleaner program
slick new cleaner program interface

I fixed the problems by adding clean32.com to my HOSTS file.
From now on, I'm going to be VERY careful about what sites I go to.

No comments: