Re: Getting rid of residual adware/spyware elements
From: Mike Burgess (winhelp2002_at_spamthis.com)
Date: 02/02/04
- Next message: taff: "Re: Backdoor.Sdbot"
- Previous message: taff: "Re: Trojan horse Downloader.Rvp.D in system info folder"
- In reply to: Jeff Conrad: "Re: Getting rid of residual adware/spyware elements"
- Next in thread: Jeff Conrad: "Re: Getting rid of residual adware/spyware elements"
- Reply: Jeff Conrad: "Re: Getting rid of residual adware/spyware elements"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 1 Feb 2004 21:12:53 -0500
Jeff,
> The link you pointed me to discusses emptying the Temporary Internet File
Folder"
If you look again ........ it does include the "Temp" folder.
http://mvps.org/winhelp2002/delcache.htm#Win98
-- Restart in Ms-Dos Mode >From C:\> (type and press Enter after each command) cd\windows smartdrv deltree tempor~1 deltree history deltree temp Restart (Ctrl-Alt-Del) ____________________________________________________________ Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/ Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file http://www.mvps.org/winhelp2002/hosts.htm [updated 01-31-04] Please post replies to this Newsgroup, email address is invalid -- "Jeff Conrad" <jeffc@ernstbrothers.com> wrote in message news:uS7xtCP6DHA.3548@TK2MSFTNGP11.phx.gbl... > Hi Mike, > > Your expertise is most welcome. > I'm a little confused by your response though. > The link you pointed me to discusses emptying the Temporary Internet File > Folder. > I have used the deltree thing before on computers in the past so I do have > experience with that. > > However, this folder is appearing in the Windows Temp folder, not the TIF > folder. > If I delete the folder in Explorer it comes back after the next restart. > I have already cleared EVERYTHING out of the TIF and Cookies folders. > Are you saying I should still do the deltree option on this 98 machine? > > I do appreciate the links. > I won't be able to run the test and post the results until later in the > week. > > Thanks again for the help and support, > Jeff > > > "Mike Burgess" <winhelp2002@spamthis.com> wrote in message > news:OoZyROE6DHA.3548@TK2MSFTNGP11.phx.gbl... > > Jeff, > > >"Or do I even need to worry at all about them?" > > Yes you need to worry about them! > > > > >"C:\Windows\Temp\vupd" > > That's the first clue ..... empty the "Temp" folder > > http://mvps.org/winhelp2002/delcache.htm#Win98 > > > > As Russell suggested, run HijackThis and post your log here: > > [SpyBot Support Forum] > > http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi > > ____________________________________________________________ > > Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/ > > Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file > > http://www.mvps.org/winhelp2002/hosts.htm [updated 01-25-04] > > Please post replies to this Newsgroup, email address is invalid > > -- > > > > "Jeff Conrad" <jeffc@ernstbrothers.com> wrote in message > > news:OjTfNc15DHA.360@TK2MSFTNGP12.phx.gbl... > > > Hi, > > > > > > I hope this is an appropriate place to post this question. > > > I've spent MANY hours cleaning up a computer in the office here that was > > > proliferated with adware/spyware and a couple of viruses. And yes, I > > slapped > > > the person silly! > > > It is Windows 98 SE. > > > > > > I updated their McAfee virus DAT files and cleaned the viruses. > > > I installed Spybot Search And Destroy, updated the program, and then > > > scanned. > > > Good golly they had a ton of stuff! > > > The scanner even said, "Whew, hang on a minute I need a breather.." <g> > > > > > > Their home page was always being hijacked which was obviously a > tell-tale > > > sign of adware/spyware. They had several kinds. Symantec's removal > > > instructions for one of them was pretty poor. It listed all the registry > > > entries, but it gave no clue as to what they should be changed back to. > So > > I > > > took some screen shots of my registry and manually made the changes > back. > > > All seems to be OK now. > > > > > > Several passes of the virus scanner all come clean now. > > > Several passes of Spybot come clean EXCEPT for 2 things every time. > > > > > > 1. First Issue: > > > It says "NewtonKnows" and lists a folder called: > > > C:\Windows\Temp\vupd > > > I check to fix the problem and it goes away. > > > But, when I restart the machine it is back! > > > If I manually delete it in Explorer it returns again on the next > restart! > > > What's going on?! > > > > > > 2. Second Issue: > > > They had the Look2Me spyware. > > > The removal instructions say to delete a few registry entries, but they > > > return! > > > Specifically: > > > HKEY_CLASSES_ROOT\CLSID\{DDFFA75A-E81D-4454-89FC-B9FDO631E726} > > > If I delete the key it goes away. > > > Then I close the registry. > > > Open registry back up and IT'S THERE AGAIN! > > > Also sometimes, one of the other registry entries comes back as well! > > > HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell > > > Extensions{same number above} > > > I delete it and it comes back! > > > > > > Why do these keep re-appearing?!! > > > And how do I get rid of them? > > > Or do I even need to worry at all about them? > > > > > > Any help would be most appreciated. > > > Jeff > > > > > > > > > > > >
- Next message: taff: "Re: Backdoor.Sdbot"
- Previous message: taff: "Re: Trojan horse Downloader.Rvp.D in system info folder"
- In reply to: Jeff Conrad: "Re: Getting rid of residual adware/spyware elements"
- Next in thread: Jeff Conrad: "Re: Getting rid of residual adware/spyware elements"
- Reply: Jeff Conrad: "Re: Getting rid of residual adware/spyware elements"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
