- Joined: July 2002
- Post Count: 2,096
I had luck with Spysweeper getting some stuff that Spybot and Adaware missed. If this is one of those toolbar type programs, you might also have luck this way:
Try going to Tools, Internet Options, under Temporary files go to Settings, View Objects. You'll see stuff like Quicktime, Shockwave, etc. Delete whatever you don't recognize. Some of the crappy searchbar programs install here as plug-ins. I've had luck getting rid of some plugins that way (although the files are still lurking on the PC somewhere, but at least the plugin isn't active!).
Matheson- "There are probably some who'll say that by doing this, we are interfering with their culture."
Gideon - "Probably. Screw them."
-Crusade, Visitors from Down the Street
- Joined: June 2002
- Post Count: 934
Have you tried using cwshredder? If this huntbar takes over your homepage, that niffty little program should do the job. Luckily, I've never experienced this huntbar, so I have no idea what it is. The most updated version I see is
here at majorgeeks.com
I certainly don't expect anyone to remember me 65 years after I die, but you wouldn't know that from the way I act.
- Joined: December 1969
- Post Count: 7,219
I run Ad Aware, Spybot AND Microsoft's anti-spyware beta (which has a nifty feature that automatically prevents most home page hijack attempts and restores the home page to a URL you pre-set if a hijack attempt succeeds.) I find that each of them will find things the others won't.
Probably also a good idea to boot to safe mode with no networking, then stop any processes you don't recognize and finally run several anti-spyware and anit-virus scans. Also go to add remove programs and delete anything you don't want that's foolish enough to make itself accessible there.
Regards,
Joe
- Joined: March 1999
- Location: NJ
- Post Count: 5,237
RUN AD-Aware, Spybot S&D, and Hijackthis IN SAFE MODE
I suspect that some spyware that is loaded in Normal mode can unload itself and modify the registry, etc. etc. than then simply run itself in memory until shutdown. Therefore the next time you start up, it'll repeat the process such that Hijackthis would be able to see it and remove it but next time it would return. Ad-aware/Spybot would do the same thing, it may remove the registry entry but because it was resident in memory and the actual file itself wasn't detected or couldn't be removed cause it was running, it would simply load itself again the next time you turned your PC on. I had to help a friend get something off called Neededware that was like that. I would have her remove the registry stuff (O15 trusted zone as well as a XP Service (under name NDWSERV). However, it would come back the next time. No trace that I could see in the processes (easily hidden anyway) or file that was obvious.
I had her boot up in safe mode, ran all the above and it removed it. Then I had a program called CleanUp or something like that remove every stinkin temp file in %TEMP%, any suspicious file/directory in %APPDATA% and all the LOCAL DATA in her document and settings for all registered users.
Then you can run cleanmgr and delete all your system restore points in XP and also use that to remove all temp and internet cache files...
Jay
P.S. JohanD has the right idea but obviously a little work. The most important thing is to remove the file and remove it from registry second. The registry cannot start a file that doesn't exist so the first target is to kill any processes that you can confirm as being suspicious, Be careful of things in the above directory and %WINDOWS%\system32. I can't tell you how many bad files I found in there, DLLs, EXES, all suspicious!
Jay
You are the crispy noodle in the vegetarian salad of life
- Joined: January 2004
- Post Count: 643
Quote:
| RUN AD-Aware, Spybot S&D, and Hijackthis IN SAFE MODE |
Make sure you know what you're doing when you run Hijackthis!
Your best bet is to send a Hijackthis log to a site like the forums at SpywareInfo.com, and let one of their experts analyze it and show you what to remove!
I've been using the program for months now (spyware removal has developed into a new hobby for me), and I know it's WAY too easy to screw up your PC if you don't know what you're doing!
When she embraces, your heart turns to stone
She comes at night, when you're all alone
And when she whispers, your blood shall run cold
You'd better hide before she finds you...
