Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Adware/Spyware Won't Go Away


  • Please log in to reply

#1
spynomore

spynomore

    New Member

  • Member
  • Pip
  • 3 posts
My PC has serious spyware/adware problems. I've used AdAware, Spybot, HiJackThis, and the CoolWWWSearch.SmartKiller several times. When I run HJT, and press "Fix Checked," it terminates the program. On the occasion that it fixed the problems, I ran it again to double-check--only to find that they showed up in the log again. AdAware also freezes while quarantining/deleting the items. Spybot has done the same while fixing the problems.

The main pop-ups I get are loadingwebsite, urllogic, and countit.exchange. Here's my log file:

Logfile of HijackThis v1.97.7
Scan saved at 3:49:56 PM, on 2/9/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\FARONICS\DEEP FREEZE\FRZSTATE9X.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\N20050308.EXE
C:\PROGRAM FILES\EZULA\MMOD.EXE
C:\PROGRAM FILES\WEB OFFER\WO.EXE
C:\HIJACKTHIS.EXE
C:\PROGRAM FILES\SED\SED.EXE

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - HKLM\..\Run: [ntechin] C:\WINDOWS\N20050308.EXE
O4 - HKLM\..\Run: [SESync] "C:\PROGRAM FILES\SED\SED.EXE"
O4 - HKLM\..\RunServices: [DepFrz] C:\Program Files\Faronics\Deep
Freeze\FrzState9x.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
  • 0

Advertisements


#2
dmohnen

dmohnen

    Member

  • Member
  • PipPip
  • 14 posts
well you have ezula.exe running as a process. This is definately spyware. Web offer is spyware too. I am puzzled as to why spybot and adaware do not clean them but you can try removing them. If you are familiar with dos, you can boot to a command prompt and navigate to the c:\program files\ezula and delete the folder and its contents.
  • 0

#3
spynomore

spynomore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
I'm not familiar enough with dos to do that. I am aware that ezula and web offer need to be removed. I've even gone to the control panel and uninstalled each of them. It always tells me that Web Offer is uninstalled and that I have to reboot for the changes to take effect--needless to say, the changes don't take effect. I've done the same with ezula (without the need to reboot). I have managed to "free" three other computers of this spyware, but the PC in question must have some demonic force overtaking it. Any additional suggestions will definitely be appreciated. Thanks
  • 0

#4
admin

admin

    Founder Geek

  • Administrator
  • 24,504 posts
You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  • 0

#5
spynomore

spynomore

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
My computer will not allow me to run it. When I double-click, a black box pops up and says "Syntax error. Bad file command."
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP