Grokster

Iexplore.exe has generated errors and must be shut down
-or-
Invalid Page Fault
You may also receive one or more of the following error messages when you try to connect to a Web site:
Could not open the search page
Page could not be displayed
Page can not be displayed
DNS error
http://support.microsoft.com?scid=kb;EN-US;Q826718

Description of the Win32.dlder spyware trojan program:
http://support.microsoft.com?scid=kb;EN-US;Q317013

Grokster.exe has encountered an error and needs to close:
http://support.microsoft.com?scid=kb;EN-US;Q319677

I installed this software on 1 December 2003 on Windows XP using default settings AFTER creating a restore point (just in case). During install a file called sahdownloader.exe crashed. The install would not complete, and had to be shut down using Task Manager. At least half a dozen programmes requested access to the internet during the install (all the various spyware files downloading and installing).

A re-run of the Grokster installed allowed sahdownloader.exe to install successfully but sahdownloader.exe continues to crash after a reboot.

After reboot the following files tried to access the internet:

fsg_4104.exe
bpc.exe
loader.exe
whagent.exe

The following spyware/foistware was also installed according to AdAware:

351 objects made up of 5 processes, 199 registry keys, 37 registry values, 95 files and 13 folders.

Spyware detected included:

Processes:
SahAgent, TopPicks, ClearSearch, BroadCastPC, DownloadWare

Registry keys:
AdRoad, BroadCastPC, Claria (once called Gator), ClearSearch, ClipGenie, Cydoor, DownloadWare, Favoriteman, IGetNet, Lycos Sidesearch, MsView, MySearch, My-Way Speedbar, NetworkEssentials, SahAgent, SCBAR, TopPicks, VX2.BetterInternet, WebHancer

Lots of "browser hijacker attempts", two malware entries identified as "other".

You will find many several of the spyware installs mentioned elsewhere on my web site. Nasty stuff.

After uninstall of Grokster and at least half a dozen bits of spyware that I could identify via Add/Remove Programs (the entries in add/remove programmes were cryptic and did not include any standard information such as date of install, size, or last used) the following remained:

(Note: Sahdownloader.exe would not uninstall using add/remove programs and continues to try to access the internet even after a reboot)

Adaware detects:
210 objects, including 3 processes, 150 registry keys, 9 registry values, 37 files and 9 folders.

SahAgent, ClearSearch, BroadCastPC, Claria, ClipGenie, Cydoor, Downloadware, Favoriteman, IGetNet, My-Way Speedbar, NetworkEssentials, SCBar, StopPop (a new entry added by the uninstall), TopPicks, VX2.BetterInternet, WebHancer.

Some objects could not be removed using AdAware without a reboot - lsp.dll, ie_clrsrch.dll, bi.dll. AdAware set to remove after next reboot. Machine declared clean after reboot and automatic rescan by AdAware.

Cleaned using AdAware then rebooted and checked using Spybot S&D:

(Note: After rebooting and AdAware stated the computer was clean an advertising pop-up window still appeared).. the scan by Spybot S&D detected the following:

sahdownloader.exe not removed (despite using its specific uninstall programme and instructing AdAware to remove it) (detected as SahAgent by AdAware)
Network Essentials.ScBar global settings registry setting (HKEY_Local_Machine\Software\SearchEnhancement)
ToPicks autostart entry
ToPicks IE Toolbar CSLID

After running AdAware and Spybot I STILL got a Grokster Safe P2P popup <<grrrr>> Time to use that restore point!!!!!