# how do i get rid of scumware? (yuck)

**URL:** <https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604>\
**Category:** Factual Questions\
**Created:** [April 20, 2002, 12:12am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604 "2002-04-20T00:12:38Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![biker](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@biker](https://boards.straightdope.com/u/biker)\
**Post date:** [April 20, 2002, 12:12am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/1 "2002-04-20T00:12:38Z")

</div>

this morning i had scumware invade my computer through email. the invading program is: [duolaimi.net/d.asp](http://duolaimi.net/d.asp)? i did a google search and downloaded ad-aware which was suppose to get rid of the scumware, it did not.

the scumware has taken over my homepage and disabled the tools ability to change the homepage and who knows what else. before today i had never ever heard of scumware, now yuck!

---

<div class="post-metadata">

**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\
**Post date:** [April 20, 2002, 12:21am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/2 "2002-04-20T00:21:48Z")

</div>

What is ‘scumware’? A virus? AdAware isn’t an antiviral program. It only gets rid of commerical spyware. Get Norton Antivirus. That should work. Or do a google search for antivirus programs.

---

<div class="post-metadata">

**Author:** ![biker](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@biker](https://boards.straightdope.com/u/biker)\
**Post date:** [April 20, 2002, 12:48am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/3 "2002-04-20T00:48:01Z")

</div>

scumware is not a virus, it is an ugly form of spam.

here is a seached definition:

scumware refers to programs that overlay text links from advertisers on your web site without your permission.

---

<div class="post-metadata">

**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\
**Post date:** [April 20, 2002, 12:53am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/4 "2002-04-20T00:53:18Z")

</div>

Never heard of it. Don’t any of the sites your search found have any info on removing it?

I still think Norton Antivirus would be a good thing to try.

---

<div class="post-metadata">

**Author:** ![yabob](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/yabob/32/2821_2.png) [@yabob](https://boards.straightdope.com/u/yabob)\
**Post date:** [April 20, 2002, 12:55am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/5 "2002-04-20T00:55:37Z")

</div>

Scumware is the name emerging for the class of unwanted junk which typically operates as a “companion” to your browser, adding links to your web pages not placed there by the website, typically pointing back to the sites of paid advertisers. Stuff like the “TopText” program now being installed by KaZaa. AdAware is the right class of application for what the OP wants, but there is currently an “arms race” going on between the scumware producers and people like them.

---

<div class="post-metadata">

**Author:** ![yabob](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/yabob/32/2821_2.png) [@yabob](https://boards.straightdope.com/u/yabob)\
**Post date:** [April 20, 2002, 1:17am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/6 "2002-04-20T01:17:39Z")

</div>

And as far as I know, the major antivirus makers aren’t touching things like this because they are an intended part of the install of programs like KaZaa, so Norton isn’t going to consider it a “virus” and update their DB to include it in the stuff they look for. By installing the (probably) useful application whose authors probably got a kickback from the scumware vendor, you “voluntarily” added it to your system.

---

<div class="post-metadata">

**Author:** ![Urban\_Ranger](https://avatars.discourse-cdn.com/v4/letter/u/e9c0ed/32.png) [@Urban\_Ranger](https://boards.straightdope.com/u/Urban_Ranger)\
**Post date:** [April 20, 2002, 7:50am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/7 "2002-04-20T07:50:28Z")

</div>

Kill the browser, then reinstall it again.

---

<div class="post-metadata">

**Author:** ![Racer1](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@Racer1](https://boards.straightdope.com/u/Racer1)\
**Post date:** [April 20, 2002, 9:24am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/8 "2002-04-20T09:24:39Z")

</div>

Hmm, I’ve always found Ad-aware pretty good it removing it all, perhaps it’s worth emailing them to ask if an update is coming?

If not, try [http://www.scumware.com/](http://www.scumware.com/). This place has a lot of information on scumware. They might be able to point you in the right direction.

---

<div class="post-metadata">

**Author:** ![Fern\_Forest](https://avatars.discourse-cdn.com/v4/letter/f/71c47a/32.png) [@Fern\_Forest](https://boards.straightdope.com/u/Fern_Forest)\
**Post date:** [April 20, 2002, 10:49am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/9 "2002-04-20T10:49:35Z")

</div>

Thank you biker for starting this thread. You’ve motivated me to get that software and rid myself of some annoying add-ons to IE.

While I was downloading ad-aware from cNet I saw that they had [RefUpdate](http://download.com.com/3000-2094-8655909.html) which “Makes sure you always have the most recent reference file for Ad-aware installed on your system.”

Perhaps that’s why?

---

<div class="post-metadata">

**Author:** ![pmh](https://avatars.discourse-cdn.com/v4/letter/p/df705f/32.png) [@pmh](https://boards.straightdope.com/u/pmh)\
**Post date:** [April 20, 2002, 10:56am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/10 "2002-04-20T10:56:31Z")

</div>

Windows allows for other applications to “attach” themselves to IE (and therefore avoid most firewalls) by way of the registry key:

HKEY\_LOCAL\_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects

I can think of no legitimate reason for any entries under this key.

Maybe that’s where it’s hiding. If so, deleting the key should disable it.

[sub]Remember, editing the registry will immediately cause the end of the universe as we know it.[/sub]

---

<div class="post-metadata">

**Author:** ![biker](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@biker](https://boards.straightdope.com/u/biker)\
**Post date:** [April 20, 2002, 11:48am UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/11 "2002-04-20T11:48:38Z")

</div>

not only do i have this insane scumware problem but i had also downloaded ie6 onto Me, which turned my computer into a doorstop. on top of that ie6 can not be uninstalled, it changes your registry.

i found [scumware.com](http://scumware.com) and it was very informative but they only cure two forms of scumware and neither one is the one i have. apparently i have a brand new version, i feel so special.

at the moment i am of the opinion with all these situations, reformatting is my only solution. will i have to partition the hard drive to get rid of the scumware?

---

<div class="post-metadata">

**Author:** ![Racer1](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@Racer1](https://boards.straightdope.com/u/Racer1)\
**Post date:** [April 20, 2002, 12:12pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/12 "2002-04-20T12:12:10Z")

</div>

Hang on, don’t format yet.

It has disabled your tool’s ability to change the homepage? Which tools do you use? What has it changed your homepage too? Have you tried contacting your ISP or whoever hosts your webspace?

The trick is to find out what the hell they’ve changed and who the best people are to talk to about sorting it out.

Failing that, you could bombard that [duolaimi.net](http://duolaimi.net) place with emails demanding they tell you how to remove it… or if it is adding advertising to your page, contact the companies it is advertising for and threaten to cause a fuss.

Finally, you could always send a friendly mail to [scumware.com](http://scumware.com) or ad-aware, explain the problem, and ask for advice. The worst they can do is ignore you, and the best they can do is get rid of it for you.

---

<div class="post-metadata">

**Author:** ![biker](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@biker](https://boards.straightdope.com/u/biker)\
**Post date:** [April 20, 2002, 12:23pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/13 "2002-04-20T12:23:11Z")

</div>

first thing i did was call my isp, they were the ones that informed me it was scumware. they are working on the problem but now closed for the weekend.

on ie6 you go to tools/options and you can select the homepage you desire. the scumware has disabled that selection process.

i have also sent emails concerning the problem to [scumware.com](http://scumware.com) and ad-aware. waiting on a response.

i just tried re-downloading ie6 and that did not help.

---

<div class="post-metadata">

**Author:** ![Racer1](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@Racer1](https://boards.straightdope.com/u/Racer1)\
**Post date:** [April 20, 2002, 12:42pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/14 "2002-04-20T12:42:47Z")

</div>

Ahhh, I see what you’re saying now. I thought it had changed a webpage you ran yourself.

Ok, well your ISP should be able to help, but if you’re passed hope you could try changing your start page in the registry.

Go to start/run, then type in “regedit” and return.

Scroll down to HKEY\_CURRENT\_USER/Software/Microsoft/Internet Explorer/Main

The start page setting can be defined under there. (This is for Win98, by the way, but ME should be similar)

I warn you, be very careful when changing the registry etc. etc.

Anyway, hope it helps!

---

<div class="post-metadata">

**Author:** ![biker](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@biker](https://boards.straightdope.com/u/biker)\
**Post date:** [April 20, 2002, 1:07pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/15 "2002-04-20T13:07:19Z")

</div>

it worked, it worked, it worked, thank you , thank you , thank you.  
i was able to eliminate the scumware from the url line and return the home page to my original selection, [cnn.com](http://cnn.com). however, the ability to change it under tools/options is still disabled. any suggestions there?

---

<div class="post-metadata">

**Author:** ![Racer1](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@Racer1](https://boards.straightdope.com/u/Racer1)\
**Post date:** [April 20, 2002, 1:35pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/16 "2002-04-20T13:35:35Z")

</div>

It’s worrying me a bit that you say you got this though email. This could be a symptom of a virus infection, so I strongly suggest you scan your computer at this stage. I believe there used to be a free online virus checker at [http://www.mcafee.com](http://www.mcafee.com/).

If it is a virus, they should be able to offer a fix program or instructions on how to manually get things back to normal.

---

<div class="post-metadata">

**Author:** ![biker](https://avatars.discourse-cdn.com/v4/letter/b/ce7236/32.png) [@biker](https://boards.straightdope.com/u/biker)\
**Post date:** [April 20, 2002, 1:46pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/17 "2002-04-20T13:46:40Z")

</div>

do not believe this is a virus. i have norton anti-virus on my email. it did not come up in a virus check.

what the scumware does is it makes their web page my home page. then it disabled my ability to change that under tools/options.

all the scumware listed on [scumwear.com](http://scumwear.com) are legitimate businesses using spy systems they install on your computer. this version i received, must be something new. sort of a cross between a virus and scumware.

---

<div class="post-metadata">

**Author:** ![Racer1](https://avatars.discourse-cdn.com/v4/letter/r/ee59a6/32.png) [@Racer1](https://boards.straightdope.com/u/Racer1)\
**Post date:** [April 20, 2002, 2:27pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/18 "2002-04-20T14:27:43Z")

</div>

Ok, well I’ve never disabled this feature myself, but I figure it’s probably something to do with policies.

[This](http://www.winguides.com/registry/display.php/537/) link will hopefully help you sort it out. Notice that the restriction could have been made in either HKEY\_CURRENY\_USER or HKEY\_LOCAL\_MACHINE.

Again, remember to be very careful whenever changing the registry.

Also, do make sure your Norton AV version is up to date.

Good luck!

---

<div class="post-metadata">

**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\
**Post date:** [April 20, 2002, 3:29pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/19 "2002-04-20T15:29:19Z")

</div>

scumware is not a virus in that it does not replicate and infect other machines.

\>\> I can think of no legitimate reason for any entries under this key

I checked my registry and there’s a couple of keys there which seem to belong to Acrobat and do not seem too suspicious.

---

<div class="post-metadata">

**Author:** ![NutWrench](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/nutwrench/32/20193_2.png) [@NutWrench](https://boards.straightdope.com/u/NutWrench)\
**Post date:** [April 20, 2002, 4:51pm UTC](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604/20 "2002-04-20T16:51:28Z")

</div>

It’s also possible to get this junk by accidentally downloading an ActiveX component that claimed it was a “download helper” or some other nonsense. These things can blow right past your firewalls and spam you to death if you grant them permission to install.

[Quixotix Control Manager](http://www.programmersheaven.com/zone16/cat143/18655.htm) (freeware) will let you manage all your ActiveX controls and add/remove them.

[Next page](https://boards.straightdope.com/t/how-do-i-get-rid-of-scumware-yuck/104604.md?page=2)
