SOLVED Can't get rid of "Anchor.Hss"

Discussion in 'Security' started by Murf, Jun 21, 2013.

  1. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Hello Windows Experts!
    Spybot will remove 'Anchor.Hss', but it reappears pretty much instantly. How do I get rid of it permanently, pls?

    Murf
     
    Murf, Jun 21, 2013
    #1
    1. Advertising

  2. Murf

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    8,454
    Location:
    PA, USA
    anchor.hss is considered a PUP (Possible Unwanted Program) by SpybotS&D. It likely is part of something you installed such as a toolbar etc and may not even be harmful.

    I recommend you run a virus scan in safe mode as described at the start of my post in this BSOD thread HERE.

    If you do not have a virus then I suggest you look at recent installations and try uninstalling them to see if it goes away.

    As I mentioned it might not be anything "bad" at all, SpybotS&D merely says it is possible.
     
    TrainableMan, Jun 22, 2013
    #2
    1. Advertising

  3. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Hi Trainable,
    Thanks for the reply. I opened in safe mode & ran my antivirus progs, but Anchor is still coming back. I am now deleting recently loaded or updated programs & checking after each deletion.
    So, what does Anchor.Hss do? I have searched & only come up with that it might be an encryption program?

    Murf
     
    Murf, Jun 22, 2013
    #3
  4. Murf

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    8,454
    Location:
    PA, USA
    I don't know. All I really found was the Spybot S&D log which listed it as a "Possibly Unwanted Program" so there is not much info on it. Which probably either makes it pretty new or something more likely harmless.
     
    TrainableMan, Jun 22, 2013
    #4
  5. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Well, from my deletions it seems Anchor.Hss appears after opening Foxfire. They had an update on 6/19, which is right about the time I noticed the program.
    Do you think it is possible that they are encrypting to protect us given the recent news?

    RE: your above 'note', yes, it's hard to escape advertizing....

    Murf
     
    Last edited: Jun 22, 2013
    Murf, Jun 22, 2013
    #5
  6. Murf

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    8,454
    Location:
    PA, USA
    I did a check to see what the HSS filetype is and it is related to Adobe photoshop.

    I'm guessing you mean Firefox (the browser) rather than "foxfire" and as I suggested it is very possible it has something to do with a toolbar ... or it could also be part of an add-in. But I don't believe it is from Mozilla itself.

    Could just be a coincidence but i searched "Adobe Anchor" and did find some freeware called "Adobe Anchor Service CS4." By any chance did you install that?
     
    TrainableMan, Jun 23, 2013
    #6
  7. Murf

    davehc Microsoft MVP

    Joined:
    Jul 20, 2009
    Messages:
    1,957
    Location:
    Denmark
    Your instinct could possibly put you on the right track.

    As trouble suggests, Anchor, or anchor free, is an addon in Firefox.. It is able to eliminate mandatory adverts and popups, whilst you are surfing. It is unlikely that it got into Firefox as an automatic installation, but, one never knows.

    Have a look at your addons and see.

    But. It is easily duplicated as a virus - certainly a possibility. Addons remain one of the easiest ways to plant a virus on a computer.
     
    Last edited: Jun 23, 2013
    davehc, Jun 23, 2013
    #7
  8. Murf

    salenai

    Joined:
    Jun 23, 2013
    Messages:
    4
    Hi guys, I have exactly same problem, Spybot has detected spyware Anchor.HSS every time I used it. It belongs to: PUPSC - it stands for potentionally unwanted program.
    I use other programs to detect malware/virus/spyware/adaware as well. Programs are Spybot SD2, Malwarebytes, Advanced SystemCare 6, IOBit MalwareFighter, AVG, Super AntiSpyware. Only Spybot SD (1 - the old one) has detected the same problem again and again.
    Every time I decide to scan my computer, I go to safe mod, since it is able to catch more unwanted stuff in my PC. Only spyware I have ever had problem removing was this one.

    I looked at malware removal guide - Anchor.Hss thread here:
    http://forums.spybot.info/showthread.php?68808-Manual-Removal-Guide-for-Anchor-Hss
    but none of what was mentioned there I found anywhere on my PC. I checked regedit, I checked appdata,etc.
    Not sure where can I located sysdir though, is it basically system32 folder? I checked that one, nothing there either.
    Spyware still keeps coming back :/.
    Any suggestions please? Is Anchor.Hss harmless or harmful?
    I read what you wrote here, and I too have noticed Adobe Acrobat among addons in Firefox, I think it asked me for update few days ago, I declined it, and I can still see it asking for update among Firefox Addons.
    Thanks.
     
    Last edited: Jun 23, 2013
    salenai, Jun 23, 2013
    #8
  9. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Hello Windows Experts!,
    Yes, I do mean Firefox!
    I had deleted Adobe Flash, but not reader since that had an earlier download date on it, before I had the problem. I don't have Photoshop, and don't see "Adobe Anchor Service CS4" in my list of installed programs. But I do now have something called, "Mozilla Maintenance Service" put on with the last update.
    I'll keep looking & posting what I find....

    Murf
     
    Last edited: Jun 23, 2013
    Murf, Jun 23, 2013
    #9
  10. Murf

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    8,454
    Location:
    PA, USA
    Well I don't know if anchor.hss is part of Mozilla Maintenance Service but from reading what that service is I know I don't like it. I'm not a fan of automatic updates in the first place (except for my anti-virus) so I don't like that Firefox installs that so it can override UAC to install updates.
     
    TrainableMan, Jun 23, 2013
    #10
  11. Murf

    salenai

    Joined:
    Jun 23, 2013
    Messages:
    4
    I have Mozilla maintenance Service as well, but it shows 23.5 as installation date.
    Where can I check most recent updates to my computer? At the recovery part of the control panel?
     
    salenai, Jun 23, 2013
    #11
  12. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Well, I removed "Mozilla Maint. Serv" and I still get Anchor.Hss as soon as I open Firefox, and not before.
    Maybe it's time to take this to the Mozilla forum?

    Murf
     
    Murf, Jun 23, 2013
    #12
  13. Murf

    salenai

    Joined:
    Jun 23, 2013
    Messages:
    4
    lol dude, I tried not opening mozilla firefox after restart, and I still got it (I removed it with spybot before restart, so it should not appear again, and yet it did).
    Problem does not seem to be in firefox, OR if it is, one does not need to open mozilla itself to make anchor.hss present.
    I wrote to Adobe forum:
    http://forums.adobe.com/thread/1239873?tstart=0

    But still, you can try asking in mozilla firefox, it is not excluded that problem may actually be in mozilla.
     
    Last edited: Jun 23, 2013
    salenai, Jun 23, 2013
    #13
  14. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Hi Salenai,
    That isn't how my machine is working. I don't get Anchor until I open Firefox, and I don't get it when I use IE for internet. But as soon as I open Firefox, I have Anchor.

    Murf
     
    Murf, Jun 24, 2013
    #14
  15. Murf

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    8,454
    Location:
    PA, USA
    Murf, could you delete the file again then try Firefox again but instead of clicking the Firefox icon go to the start orb and choose run (bottom right of the start box menu unless you altered your explorer settings) and type:
    Firefox –safe-mode

    If it does not reappear this time it will prove whether or not it is part of native Firefox or just part of an addon that you added to Firefox.
     
    TrainableMan, Jun 24, 2013
    #15
  16. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Hi Trainable,
    I started it in safe mode as you said; yes, anchor does appear.

    Murf
     
    Murf, Jun 24, 2013
    #16
  17. Murf

    Murf

    Joined:
    Jun 21, 2013
    Messages:
    8
    Hello Windows Experts!
    Today I removed all traces of Firefox from my computer & then reinstalled the latest version. I have had it open for a few hours, visiting some regular sites, and I think Anchor.Hss is gone.
    I still have no idea where it came from, what it was really attached to, or what it did. But I think it is gone.

    Murf
     
    Murf, Jun 24, 2013
    #17
  18. Murf

    salenai

    Joined:
    Jun 23, 2013
    Messages:
    4
    Hi guys, I am back, the problem kept coming back, so I reinstalled windows.
    I let it update and download all the service packs, I downloaded all the previously mentioned antivirus/antispyware/antimalware software, scanned my computer with everything, everything was clear. Then day or so later I found 2! anchor.hss entries! I deleted both through spybot, and I also managed to delete the register folders anchor.hss appeared in.
    There was nothing to be found for a day or so. Then next day, I found another location, and at different place again, Hkeyusers, etc., not sure where exactly. But it was a different location than the previous ones.
    ALSO I think I know what anchor.hss does. Before reinstallation, my system restored itself to previous point, like, it deleted my keyboard language change option, wallpaper, removed icons from my task bar and set them to default, also I had mozilla firefox set as default browsret, it removed that option, removed my set screen resolution.
    This is why I decided to reinstall windows. It formatted C. Now, after reinstallation, and these found entries (that I mentioned in the first section of this post), it AGAIN restored system to previous state. Also, when it restored back to previous state this time, I received a message saying that vprotect application has stopped working.

    Does anyone have any clue how to get rid of it or how am I getting it?
    Thanks!
     
    Last edited: Jul 2, 2013
    salenai, Jul 2, 2013
    #18
  19. Murf

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    8,454
    Location:
    PA, USA
    >>Here<< is what Spybot recommends for manual removal. I don't know what else to suggest beyond that.
     
    TrainableMan, Jul 3, 2013
    #19
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. occam
    Replies:
    4
    Views:
    2,492
    occam
    Sep 9, 2011
Loading...

Share This Page