Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Adware! gah!

  • Please log in to reply



    Malware Expert

  • Retired Staff
  • 9,798 posts
Well either somethings interfering with the fix or those bad files are really hiding from us

Lets do this

Print these directions out

Update Ewido

Now disconnect from the internet

Right click the Spybot icon in the system tray and then click exit
Right click the Spywaredoctor icon in the system tray and then click exit
Right click the Microsoft antispyware in the system tray and click shutdown
Right click the Norton icon in the system tray and then click Disable Antivirus auto protect

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft Updates] Botnet.exe
O4 - HKLM\..\Run: [u3rg3pU] setsam.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\RunServices: [Microsoft Windows W32 Services] mssw32.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] Botnet.exe
O4 - HKLM\..\RunServices: [start uploading] smsss.exe
O4 - HKCU\..\RunServices: [start uploading] smsss.exe
O16 - DPF: ppctlcab -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} -
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -

Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode

Now open Ewido
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • You will be prompted to clean the first infection.
  • Select "Perform action on all infections", then proceed.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop or a location where you can find it easily.
Close ewido security suite.

After all that, please post back with how things went as well as a new Hijack log and the Ewido log
  • 0




    Malware Expert

  • Retired Staff
  • 9,798 posts
Double post

Edited by loophole, 25 October 2005 - 09:19 PM.

  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP