Adware.CDT

  • Thread starter Thread starter Bill & Debbie
  • Start date Start date
B

Bill & Debbie

I just ran Norton anti-virus and it found Adware.CDT as an "at risk" file.
How should I handle this?

Thanks in advance for your help.
Bill
 
From: "Bill & Debbie" <[email protected]>

| I just ran Norton anti-virus and it found Adware.CDT as an "at risk" file.
| How should I handle this?
|
| Thanks in advance for your help.
| Bill
|

Remove it.
 
David H. Lipman said:
From: "Bill & Debbie" <[email protected]>

| I just ran Norton anti-virus and it found Adware.CDT as an "at risk"
file.
| How should I handle this?
|
| Thanks in advance for your help.
| Bill
|

Remove it.
Click to expand...
I tried to delete it. Norton said that "deleting the file failed". I went
to their website and they tell me how to remove it manually. It is VERY
involved with many register entries that must be changed. I have never
changed anything in registers and would be very uncomfortable doing it.

Why doesn't "Ad-Aware SE personal", "Spybot-Search and Destroy" or
SpywareBlaster detect it? I run them regularly and keep them updated. If
they were to find it, hopefully, they would be able to remove it for me.

Is there any other way to delete Adware.CDT automatically? I think it got
on my system when I installed Windows Media Player.

Thanks in advance for any help or advice.
Bill
 
From: "Bill & Debbie" <[email protected]>

|>> How should I handle this?
|>>
|>> Thanks in advance for your help.
|>> Bill
|>>| I tried to delete it. Norton said that "deleting the file failed". I went
| to their website and they tell me how to remove it manually. It is VERY
| involved with many register entries that must be changed. I have never
| changed anything in registers and would be very uncomfortable doing it.
|
| Why doesn't "Ad-Aware SE personal", "Spybot-Search and Destroy" or
| SpywareBlaster detect it? I run them regularly and keep them updated. If
| they were to find it, hopefully, they would be able to remove it for me.
|
| Is there any other way to delete Adware.CDT automatically? I think it got
| on my system when I installed Windows Media Player.
|
| Thanks in advance for any help or advice.
| Bill
|

Did you try having Norton remove it in Safe Mode ?

Also try after following the information in the following Microsft URL on "How to perform a
clean boot in Windows XP" -- http://support.microsoft.com/kb/310353
 
Is there any other way to delete Adware.CDT automatically?
Click to expand...

Make a note of where the executable file is located. *Restore your
registry to a state previous to the muckup. Then navigate to the file
you noted and delete it.

* scanreg /restore from DOS - not too sure about gow to do this on NT
based OSes.
 
David H. Lipman said:
From: "Bill & Debbie" <[email protected]>


|>> How should I handle this?
|>>
|>> Thanks in advance for your help.
|>> Bill
|>>
| I tried to delete it. Norton said that "deleting the file failed". I
went
| to their website and they tell me how to remove it manually. It is VERY
| involved with many register entries that must be changed. I have never
| changed anything in registers and would be very uncomfortable doing it.
|
| Why doesn't "Ad-Aware SE personal", "Spybot-Search and Destroy" or
| SpywareBlaster detect it? I run them regularly and keep them updated.
If
| they were to find it, hopefully, they would be able to remove it for me.
|
| Is there any other way to delete Adware.CDT automatically? I think it
got
| on my system when I installed Windows Media Player.
|
| Thanks in advance for any help or advice.
| Bill
|

Did you try having Norton remove it in Safe Mode ?

Also try after following the information in the following Microsft URL on
"How to perform a
clean boot in Windows XP" -- http://support.microsoft.com/kb/310353
Click to expand...
I did run Norton and try to remove it after starting up in "Safe Mode" and
Norton had the same delete problem. I'll try doing a "Clean Boot" in the
morning and running Norton again.
Thanks for your help.
Bill
 
From: "Roger Wilco" <[email protected]>

|
| ||
| Make a note of where the executable file is located. *Restore your
| registry to a state previous to the muckup. Then navigate to the file
| you noted and delete it.
|
| * scanreg /restore from DOS - not too sure about gow to do this on NT
| based OSes.
|

Roger:

There is no cability under NT Bases OS' except by exporting the information using Regedit
into a .REG file and then if needed, merge it back in.
 
David H. Lipman said:
From: "Bill & Debbie" <[email protected]>


|>> How should I handle this?
|>>
|>> Thanks in advance for your help.
|>> Bill
|>>
| I tried to delete it. Norton said that "deleting the file failed". I
went
| to their website and they tell me how to remove it manually. It is VERY
| involved with many register entries that must be changed. I have never
| changed anything in registers and would be very uncomfortable doing it.
|
| Why doesn't "Ad-Aware SE personal", "Spybot-Search and Destroy" or
| SpywareBlaster detect it? I run them regularly and keep them updated.
If
| they were to find it, hopefully, they would be able to remove it for me.
|
| Is there any other way to delete Adware.CDT automatically? I think it
got
| on my system when I installed Windows Media Player.
|
| Thanks in advance for any help or advice.
| Bill
|

Did you try having Norton remove it in Safe Mode ?

Also try after following the information in the following Microsft URL on
"How to perform a
clean boot in Windows XP" -- http://support.microsoft.com/kb/310353
Click to expand...
Runing Norton in Safe Mode produced the same results. When I did a Clean
Boot, Norton will not run. I suspect it disables something that Norton
needs.

I'm running Win XP SP2. Any other ideas will be greatly appreciated.
Bill
 
Roger Wilco said:
Make a note of where the executable file is located. *Restore your
registry to a state previous to the muckup. Then navigate to the file
you noted and delete it.

* scanreg /restore from DOS - not too sure about gow to do this on NT
based OSes.
Click to expand...
Sounds like a good idea. I'm running Win XP w/SP2. The name and location
of the file returned by Norton is:

C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.

Thanks in advance for any ideas or suggestions. I suspect this happened a
couple of days ago when I installed Windows Media Player.

Bill
 
Roger Wilco said:
Make a note of where the executable file is located. *Restore your
registry to a state previous to the muckup. Then navigate to the file
you noted and delete it.

* scanreg /restore from DOS - not too sure about gow to do this on NT
based OSes.
Click to expand...
Sounds like a good idea. I'm running Win XP w/SP2. The name and location
of the file returned by Norton is:

C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.

Thanks in advance for any ideas or suggestions. I suspect this happened a
couple of days ago when I installed Windows Media Player.

Bill
Click to expand...

This website..

http://www.musicsonglyrics.com/L/lsglyrics/lsgyougotmelyrics.htm

attempts to download an activex control. This is most likely the
adware in question. It creates the directory c:/program files/media
access and drops the files 'mediaaccess.exe' into this folder. This
file downloads other stuff too. Haven't found what it downloads yet
though...
--

Regards,
Ian Kenefick
Got a virus?
Go to www.ik-cs.com > 'Got a virus?'
 
Roger Wilco said:
Is there any other way to delete Adware.CDT automatically?

Make a note of where the executable file is located. *Restore your
registry to a state previous to the muckup. Then navigate to the file
you noted and delete it.

* scanreg /restore from DOS - not too sure about gow to do this on NT
based OSes.
Click to expand...
Sounds like a good idea. I'm running Win XP w/SP2. The name and location
of the file returned by Norton is:

C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.

Thanks in advance for any ideas or suggestions. I suspect this happened a
couple of days ago when I installed Windows Media Player.

Bill
Click to expand...

This website..

http://www.musicsonglyrics.com/L/lsglyrics/lsgyougotmelyrics.htm

attempts to download an activex control. This is most likely the
adware in question. It creates the directory c:/program files/media
access and drops the files 'mediaaccess.exe' into this folder. This
file downloads other stuff too. Haven't found what it downloads yet
though...
Click to expand...

Installs WindUpdates Spyware also...
--

Regards,
Ian Kenefick
Got a virus?
Go to www.ik-cs.com > 'Got a virus?'
 
Ian JP Kenefick said:
Is there any other way to delete Adware.CDT automatically?

Make a note of where the executable file is located. *Restore your
registry to a state previous to the muckup. Then navigate to the file
you noted and delete it.

* scanreg /restore from DOS - not too sure about gow to do this on NT
based OSes.


Sounds like a good idea. I'm running Win XP w/SP2. The name and
location
of the file returned by Norton is:

C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.

Thanks in advance for any ideas or suggestions. I suspect this happened
a
couple of days ago when I installed Windows Media Player.

Bill
Click to expand...

This website..

http://www.musicsonglyrics.com/L/lsglyrics/lsgyougotmelyrics.htm

attempts to download an activex control. This is most likely the
adware in question. It creates the directory c:/program files/media
access and drops the files 'mediaaccess.exe' into this folder. This
file downloads other stuff too. Haven't found what it downloads yet
though...
Click to expand...

Installs WindUpdates Spyware also...
--

Regards,
Ian Kenefick
Got a virus?
Go to www.ik-cs.com > 'Got a virus?'
Click to expand...

Ian,
Thanks for the information. Do you have a suggestion for how to get rid of
it?

Thanks in advance for any help,
Bill
 
Ian,
Thanks for the information. Do you have a suggestion for how to get rid of
it?

Thanks in advance for any help,
Bill
Click to expand...

This is detected and removed by Microsoft Antispyware if it has been
installed into your system. I do not know if Adaware or Spybot detect
these but I guess it is worth a try. Well since the file is located in
temporary internet files - in Internet Explorer go to 'tools' >
'internet options' > under the heading ' temporary internet files'
click 'delete' then follow this....

1) download and install MS Antispyware from www.microsoft.com/protect
- this is free. I think MS Antispyware is a great tool despite what
others say. Afterall it is a rebadged version of Giant Antispyware.

2) Run 'procedure e' on my website in the 'Got a virus' section.

You should be successful in removing this threat from your computer.

TIP: Use an alternative browser to Internet Explorer. ActiveX controls
are dangerous and Mozilla & Firefox don't use these. Read up in my 'A
Safe PC' section.

Please give feedback via this thread *and* via the website feedback
page :)

--

Regards,
Ian Kenefick
Got a virus?
Go to www.ik-cs.com > 'Got a virus?'
 
C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.
Click to expand...

First, log on as Debbie (or an administrator other than Bill). Then in
windows explorer

Tools -> folder options -> view

Uncheck the hide protected operating system files box

Then look again.


Jim.
 
C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.
Click to expand...

First, log on as Debbie (or an administrator other than Bill). Then in
windows explorer

Tools -> folder options -> view

Uncheck the hide protected operating system files box

Then look again.


Jim.
Click to expand...

But why bother - it exists in Temp Internet files. Why not purge them
altogether as previously mentioned?
--

Regards,
Ian Kenefick
Got a virus?
Go to www.ik-cs.com > 'Got a virus?'
 
But why bother - it exists in Temp Internet files. Why not purge them
altogether as previously mentioned?
Click to expand...

So that one can see (for future reference) what is going on and how
windows handles the hiding of these files.


Jim.
 
Ian JP Kenefick said:
This is detected and removed by Microsoft Antispyware if it has been
installed into your system. I do not know if Adaware or Spybot detect
these but I guess it is worth a try. Well since the file is located in
temporary internet files - in Internet Explorer go to 'tools' >
'internet options' > under the heading ' temporary internet files'
click 'delete' then follow this....

1) download and install MS Antispyware from www.microsoft.com/protect
- this is free. I think MS Antispyware is a great tool despite what
others say. Afterall it is a rebadged version of Giant Antispyware.

2) Run 'procedure e' on my website in the 'Got a virus' section.

You should be successful in removing this threat from your computer.

TIP: Use an alternative browser to Internet Explorer. ActiveX controls
are dangerous and Mozilla & Firefox don't use these. Read up in my 'A
Safe PC' section.

Please give feedback via this thread *and* via the website feedback
page :)

--

Regards,
Ian Kenefick
Got a virus?
Go to www.ik-cs.com > 'Got a virus?'
Click to expand...

Ian,
THANKS A MILLION! I followed your instructions and it's gone.
* Deleted temporary internet files
* Installed MS Antispyware
* Ran MS Antispyware and it did not find Adware.CDT
* Ran Norton and it did not find Adware.CDT.

Thanks again for your help,
Bill
 
James Egan said:
C:\Documents and Settings\Bill\Local Settings\Temporary Internet
Files\Content.IE5\YDNXU75Y\lsgyougotmelyrics[1].htm

I cannot find this file on my system.
Click to expand...

First, log on as Debbie (or an administrator other than Bill). Then in
windows explorer

Tools -> folder options -> view

Uncheck the hide protected operating system files box

Then look again.


Jim.
Click to expand...

Jim,
When I used Search to try and find the file, I did uncheck the hide
protected operating system box. I could not find the file. I found two
paths to the \Content.IE5\ folder. Only one of them had a path to the
\YDNXU75Y\ folder. When I looked in that folder, there were several files.
None had the name "lsgyougotmelyrics[1].htm".

Thanks again for your help,
Bil
 
David H. Lipman said:
From: "Roger Wilco" <[email protected]>

|
| |
|
| Make a note of where the executable file is located. *Restore your
| registry to a state previous to the muckup. Then navigate to the file
| you noted and delete it.
|
| * scanreg /restore from DOS - not too sure about gow to do this on NT
| based OSes.
|

Roger:

There is no cability under NT Bases OS' except by exporting the information using Regedit
into a .REG file and then if needed, merge it back in.
Click to expand...

Thanks David. I wonder why not, considering how easy it would be to do.
 
Back
Top