Re: Spyware problems

From: Lawrence Abrams (grinler-AT=bleepingcomputer.com)
Date: 08/29/04 

Date: Sat, 28 Aug 2004 18:29:05 -0400

Cwshredder or any other automated tool will properly fix this particular
hijacker. It has morphed recently to use ADS (Active directory streams) and
is becoming more of a nuiscance if thats possible.

Please do the follow and I or someone else will manually walk you through
removing it:

Please follow these steps in order to clean your computer of Malware which
can include Viruses, Trojans, Worms, Spyware, Hijackers and Dialers.

Step 1:
Download Spybot and Adaware from the following locations and install them.
You should run both programs and clean up what it finds. This is to
gaurantee that you find the most malware you can installed on your computer.

Before running the scans on both programs, it is mandatory that you update
the programs. There are update options in each program when you run them.

Spybot
http://www.safer-networking.org/index.php?page=download

Ad-Aware
http://www.lavasoftusa.com/software/adaware/

If you would like to learn more about how to use these two programs with the
proper settings you can read the tutorials below:

AD-AWARE Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=48

SPYBOT SEARCH AND DESTROY Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=43

When you scan with both programs, fix everything that it finds.

When you are done with the scan and fixing the items. Please continue with
the next step.

Step 2:

It is important that you run Spybot and Adaware before you proceed with this
step. Fixing enties with Hijackthis may leave behind unwanted files on your
computer if the previous step was not done first.

Create a directory on your hardrive to save HijackThis.exe. A directory
like c:\hijackthis. If you do not do this, you will not be able to use the
backup/restore features.

Download HijackThis from:

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Save this file into the directory you made previously and then run the
program. Click on the Scan button and when it is finished click on the Save
Log button. A Notepad window will open with the contents of this log. Click
on Edit then click on Select all. Then click on Edit and then Click on
Copy.

Register an account at http://www.bleepingcomputer.com and post this created
log into the Hijackthis Logs forum at that site. To do this, once you are
registered, create a new post, right click in message area and select paste
to paste the log into the post.

An expert will reply to you after reading this post. DO NOT fix any entries
unless you are absolutely sure you know what you are doing as you may cause
more damage to the system

To see a tutorial on using HijackThis you can click on the link below.

http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 

-- 
Lawrence Abrams
http://www.bleepingcomputer.com
Source for Original Content, Tutorials, and Support for the beginning
computer user.
"crono" <crono2468@yahoo.com> wrote in message
news:050501c48cd7$f4a9ea10$a401280a@phx.gbl...
> I think i got an spyware problem in which it keep
> changing my homepage into about:blank. It is out of my
> control and there has been a lot of pop ups about ad-
> aware products. I have tried to use ad-aware SE personal
> and the final that it keeps finding is something called a
> CoolWebSearch which seems to have something to do with a
> file c:\windows\cdplayer:ini:\zqvsx. I don't know if this
> is the file causing the problems but i keep trying to
> delete it with ad-aware but it keeps comming aback
> instantly.
> So if anyone thinks they know how i can fix my computer,
> i would deeply apppriciated if he/she would e-mail me a
> solution. Thank you.
>
> P.S. i tried to do system restore but everytime i tried
> that there is an error and it says the restore is
> incomplete, i have never had a problem like that before.
> If you think you can help me fix that, please send me an
> email.
Quantcast