needhelp said:I got this blue tool bar from
http://mysearchnow.com/passthrough/newpass2.html opening at the
botton of my screen whenever I open my browser. I cant uninstall it
or remove it, please help me.
Jim Byrd said:Hi needhelp - This is a version of lop usually installed as a byproduct of
you or someone else on you machine installing MessengerPlus (or possibly
some other such program) and too quickly agreeing to additional program
installs. You need to try a two phase process to get rid of it. First, try
removing the program(s) from Add-Remove Programs. Here's lop's directions
for that. You need to be extremely careful about depending on directions
from the malware provider though:
From: http://www.mysearchnow.com/help.html
"How do I uninstall one of your software products?
There are several methods available to you should you wish to uninstall any
of our software products you had previously chosen to install:
- You can go to your Start Menu--Control Panel, then choose the 'Add /
Remove Programs' option. Depending on which version of the software you have
installed locate 'Lop.com' or 'LOP SEARCH' or 'Window Searching' [or
possibly 'Window Search' - Jim Byrd] or ‘'Window Active' (or "Browser
Enhancer" or "Ultimate Browser Enhancer" from the menu to run the
uninstaller.
- Depending on your version You may also be able to locate a globe type icon
in the bottom right hand corner of your screen (near the clock), right click
on it then click Menu. From the main menu you will see a help button on the
top right hand corner. Click the help button then choose 'uninstall'.
- Additionally a separate universal uninstall program may be downloaded here
http://lop.com/new_uninstall.exe"
An alternative link for that uninstaller is here:
http://members.rogers.com/rjmac/new_uninstall.exe
It's very possible that even if you remove the toolbar using the above
steps, remnants or other malware may remain. I would strongly recommend
that you do the following additional steps even though it's a fair amount of
work. You might want to print this out:
Go to this page at Jim Eshelman's site, here: http://aumha.org/a/noads.htm
or here: http://inetexplorer.mvps.org/parasite.htm and wait a little bit
(be patient), while an analysis of a number of possible parasites on your
machine will be made to help you identify and remove them. NOTE: You will
need to disable Ad Blocking in Zone Alarm 3.x or later, if present or any
other Ad Blocking software which interferes with Java Scripting for this
scan to work. You should get a message between the two lines of **** giving
the results of the scan.
Now do the following, even if nothing shows up on the scan (especially note
the preventive measures at the end):
#########IMPORTANT#########
Before you try to remove spyware using any of the programs below, download
both a copy of LSPFIX here:
http://www.cexx.org/lspfix.htm
AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
or here for Win2k/XP http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm
The process of removing certain malware may kill your internet connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
to regain your connection.
NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs. (You can also
try this if you're on XP SP1. There has also been one, as yet unconfirmed,
report that this also works there.) Also, one MS technician suggested the
following sequence:
netsh int reset all
ipconfig /flushdns
#########IMPORTANT#########
#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is fixed
after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
Clean Boot: 1. Start|Run enter msconfig.
2. In the Startup tab, click the "Disable All" button.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.
#########IMPORTANT#########
Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from the link
on this page: http://vil.nai.com/vil/stinger/
Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, here: http://www.trendmicro.com/download/pattern.asp Be sure to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might also want
to get Art's updater, SYS-UP.Zip, here for future updating of these:
http://home.epix.net/~artnpeg/). (If you download and use the updater from
the beginning, it will automatically handle downloading the other files.)
Place them in a dedicated folder after appropriate unzipping. Show hidden
and system files (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
Disable Restore if you're on XP or ME (directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then boot to
Safe mode (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
Read tscreadme.txt carefully, then do a complete scan of your system
in Safe mode and clean or delete anything it finds. Reboot to normal mode
and re-run the scan again.
This scan may take a long time, as Sysclean is VERY extensive and thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.
Sometimes the tools below will find files which they are unable to delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
"replacing, moving, renaming or deleting one or many files which are
currently in use (e.g. system files like comctl32.dll, or virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem
For the general hijack case, the best way to start is to get Ad-Aware SE
Personal Edition, here: http://www.lavasoftusa.com/support/download/.
UPDATE, set it up in accordance with this:
http://forum.aumha.org/viewtopic.php?t=5877 and run this regularly to get
rid of most "spyware/hijackware" on your machine. If it has to fix things,
be sure to re-boot and rerun AdAware again and repeat this cycle until you
get a clean scan. The reason is that it may have to remove things which
are currently "in use" before it can then clean up others.
Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click the gear
wheel at the top and check these options to configure Ad-aware for a
customized scan:
General> activate these: "Automatically save log-file" and "Automatically
quarantine objects prior to removal"
Scanning > activate these: "Scan within archives", "Scan active processes",
"Scan registry", "Deep scan registry," "Scan my IE Favorites for banned
sites," and "Scan my Hosts file"
Tweaks > Scanning Engine> activate this: "Unload recognized processes during
scanning."
Tweaks > Cleaning Engine: activate these: "Automatically try to unregister
objects prior to deletion" and "Let Windows remove files in use after
reboot."
Click "Proceed" to save your settings, then click "Start." Make sure
"Activate in-depth scan" is ticked green, then scan your system. When the
scan is finished, the screen will tell you if anything has been found, click
"Next." The bad files will be listed. Right click the pane and click "Select
all objects" - This will put a check mark in the box at the side, click
"Next" again and click "OK" at the prompt "# objects will be removed.
Continue?"
Courtesy of http://www.nondisputandum.com/html/anti_spyware.html: HINT: If
Ad Aware is automatically shut-down by a malicious software, first run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe, before
opening Ad Aware. When AAWCloak is open, click “Activate Cloakâ€. Then open
Ad Aware and scan your system.
Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing ONLY RED things with SpyBot
S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle until
you get a clean "no red" scan. The reason is that SpyBot sometimes has to
remove things which are currently "in use" before it can then clean up
others.
Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
A currently common parasite is some malware called CoolWebSearch. Do the
following:
Download, UPDATE before running, and run:
http://www.intermute.com/spysubtract/cwshredder_download.html (The new v.2
which will automatically install in C:\Program
Files\InterMute\SpySubtract\CWShredder.exe and put a shortcut on the
Desktop. Run the program from this install location or the shortcut after
installation. This recommendation for CWShredder is NOT automatically a
recommendation for the other programs adverstised by Intermute in
conjunction with this install.) or
http://209.133.47.200/~merijn/files/CWShredder.exe or here:
http://hem.bredband.net/b157129/f/cwshredder.zip or here:
http://www.softpedia.com/public/scripts/downloadhero/10-17-150/ or here:
http://www.zerosrealm.com/downloads/CWShredder.zip
to remove the parasite. Try to run from Safe mode or a Clean Boot and be
sure to close ALL other programs to the extent possible, expecially ALL
instances of IE and OE.
There's a good tutorial about CWS and using CWShredder here:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47#domain See
also: http://cwshredder.net/cwshredder/cwschronicles.html
BE SURE that you get v.1.59.0.1 or later or the new v.2! Note that
CWShredder may make deletions/changes to your HOSTS file (sometimes as false
positives), and that after cleanup you may need to restore it with a fresh
copy of any local DNS and/or blocking entries or disable it before running
CWShredder.
You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.
The following links give instructions on how to do these various functions:
HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>
HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>
HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)
Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.
Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).
Be sure that you also download and install hotfix Q816093, here:
http://support.microsoft.com/?kbid=816093
which blocks the exploit upon which this parasite family depends.
Another program which performs a similar function to CWShredder is
xcleaner_free (there's a more extensive paid version also) available here
which should also be freshly downloaded and run after you run CWShredder:
http://www.xblock.com/download-freeware.shtml
When done, go to Start|Run and enter one line at a time (or even easier,
open a DOS box and copy the following in its entirety and then paste it into
the box):
regsvr32 /i browseui.dll
regsvr32 /i shdocvw.dll
regsvr32 /i mshtml.dll
regsvr32 mshtmled.dll
regsvr32 actxprxy.dll
regsvr32 /i urlmon.dll
regsvr32 scrrun.dll
regsvr32 comcat.dll
regsvr32 Oleaut32.dll
regsvr32 /i Shell32.dll
regsvr32 Msoeacct.dll
regsvr32 "C:\Program Files\Outlook Express\Msoe.dll"
regsvr32 msjava.dll
regsvr32 jscript.dll
regsvr32 Olepro32.dll
regsvr32 Hlink.dll
regsvr32 Asctrls.ocx
regsvr32 Inetcpl.cpl /i
regsvr32 Dxtrans.dll
regsvr32 Dxtmsft.dll
regsvr32 Imgutil.dll
regsvr32 Msxml.dll
regsvr32 Msjava.dll
regsvr32 Jscript.dll
regsvr32 Softpub.dll
regsvr32 Wintrust.dll
regsvr32 Initpki.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 Gpkcsp.dll
regsvr32 Slbcsp.dll
regsvr32 Cryptdlg.dll
regsvr32 Msjet40.dll
regsvr32 pdm32.dll
regsvr32 Msjtor40.dll
regsvr32 Dao360.dll
regsvr32 Sccbase.dll
with a Return after each .dll. You'll get a message about successful
completion of the re-registration process after each one, then enter the
next (with the DOS box they'll be continuous except for the last one).
If you use Win98x and get an error on Shell32.dll, ignore it. Only the ME,
Win2k and XP versions of windows have shell32 as an object that needs
registering. (For these earlier operating systems, run "regsvr32
shdoc401.dll " instead of "regsvr32 Shell32.dll".) Depending on your
system, you may also get "not found" error messages on some or all of the
last five - if so, ignore them.
Re-start your computer when you've finished.
If they don't fix it then start here:
Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
or here: http://www.bleepingcomputer.com/files/spyware/hijackthis.zip
There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html
In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)
Place HijackThis.exe or unzip HijackThis.zip into its own dedicated folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on your
Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE MUST be
closed) then press Scan. Click on SaveLog when it's finished which will
create hijackthis.log. Now click the Config button, then Misc Tools and
click on Generate StartupList.log which will create Startuplist.txt.
Then go to one of the following forums:
Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/
or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
or Jim Eshelman's site here: http://forum.aumha.org/
or Bleepingcomputer here: http://www.bleepingcomputer.com/
Register if necessary, then sign in and READ THE DIRECTIONS at the beginning
of the particular sites HiJackThis forum, then copy and paste both files
into a message asking for assistance, Someone will answer with detailed
instructions for the removal of your parasite(s). Be sure you include at
the beginning of your post "What problem(s) you're trying to solve" and
"What steps you've already taken."
*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******
Once you get this cleaned up, you might want to consider installing Eric
Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help prevent this
kind of thing from happening in the future:
IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm "IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of Internet
Explorer. Once you merge this list of sites and domains into the Registry,
the web sites for these companies will not be able to use cookies, ActiveX
controls, Java applets, or scripting to compromise your privacy or your PC
while you surf the Net. Nor will they be able to use your browser to push
unwanted pop-ups, cookies, or auto-installing programs on your PC." Read
carefully.
http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
load - but keep it UPDATED) The latest version as of this writing will
prevent installation or prevent the malware from running if it is already
installed, and it provides information and fixit-links for a variety of
parasites.
http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. All three Very Highly Recommended
Next, install and keep updated a good HOSTS file. It can help you avoid
most adware/malware. See here: http://www.mvps.org/winhelp2002/hosts.htm
(Be sure it's named/renamed HOSTS - all caps, no extension) Additional
tutorials here:
http://www.bleepingcomputer.com/forums/index.php?s=14f3f9225081133297a8acdd11137c5b&showtutorial=51 (detailed) and here:
http://www.spywarewarrior.com/viewtopic.php?t=410 (overview)
Finally, be sure that you have a good hardware or software firewall and an
AntiVirus installed, and bring your OS up-to-date with ALL Critical updates
from Windows Update.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
Inneedhelp said:I got this blue tool bar from
http://mysearchnow.com/passthrough/newpass2.html opening at the
botton of my screen whenever I open my browser. I cant uninstall it
or remove it, please help me.
needhelp said:I have tried the way u said in the post, but none of them helped me.
I cant find any titles similar to the few that u suggested in the add
and remove section.
I downloaded the program to uninstall the taskbar, but it cannot
detect anything wrong.
Now i still have the task bar and i cant get rid of it.. help!
:
Go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm
or here: http://inetexplorer.mvps.org/parasite.htm and wait a
little bit (be patient), while an analysis of a number of possible
parasites on your
machine will be made to help you identify and remove them. NOTE:
You will
need to disable Ad Blocking in Zone Alarm 3.x or later, if present
or any
other Ad Blocking software which interferes with Java Scripting for
this
scan to work. You should get a message between the two lines of
**** giving
the results of the scan.
Now do the following, even if nothing shows up on the scan
(especially note
the preventive measures at the end):
#########IMPORTANT#########
Before you try to remove spyware using any of the programs below,
download
both a copy of LSPFIX here:
http://www.cexx.org/lspfix.htm
AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
or here for Win2k/XP
http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm
The process of removing certain malware may kill your internet
connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will
enable you
to regain your connection.
NOTE: It is reported that in XP SP2, the command netsh winsock
reset
will fix this problem without the need for these programs. (You can
also
try this if you're on XP SP1. There has also been one, as yet
unconfirmed,
report that this also works there.) Also, one MS technician
suggested the
following sequence:
netsh int reset all
ipconfig /flushdns
#########IMPORTANT#########
#########IMPORTANT#########
Show hidden files and run all of the following removal tools from
Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is
fixed
after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
Clean Boot: 1. Start|Run enter msconfig.
2. In the Startup tab, click the "Disable All" button.
3. In the Services tab, check the "Hide All Microsoft Services"
checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.
#########IMPORTANT#########
Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from
the link
on this page: http://vil.nai.com/vil/stinger/
Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest
pattern
file, here: http://www.trendmicro.com/download/pattern.asp Be sure
to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might
also want
to get Art's updater, SYS-UP.Zip, here for future updating of these:
http://home.epix.net/~artnpeg/). (If you download and use the
updater from
the beginning, it will automatically handle downloading the other
files.)
Place them in a dedicated folder after appropriate unzipping. Show
hidden
and system files (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
Disable Restore if you're on XP or ME (directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then
boot to
Safe mode (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
Read tscreadme.txt carefully, then do a complete scan of your
system
in Safe mode and clean or delete anything it finds. Reboot to
normal mode
and re-run the scan again.
This scan may take a long time, as Sysclean is VERY extensive and
thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.
Sometimes the tools below will find files which they are unable to
delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the
process of "replacing, moving, renaming or deleting one or many
files which are
currently in use (e.g. system files like comctl32.dll, or
virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid
File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem
For the general hijack case, the best way to start is to get
Ad-Aware SE
Personal Edition, here:
http://www.lavasoftusa.com/support/download/.
UPDATE, set it up in accordance with this:
http://forum.aumha.org/viewtopic.php?t=5877 and run this regularly
to get
rid of most "spyware/hijackware" on your machine. If it has to fix
things,
be sure to re-boot and rerun AdAware again and repeat this cycle
until you
get a clean scan. The reason is that it may have to remove things
which
are currently "in use" before it can then clean up others.
Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click
the gear
wheel at the top and check these options to configure Ad-aware for a
customized scan:
General> activate these: "Automatically save log-file" and
"Automatically
quarantine objects prior to removal"
Scanning > activate these: "Scan within archives", "Scan active
processes", "Scan registry", "Deep scan registry," "Scan my IE
Favorites for banned
sites," and "Scan my Hosts file"
Tweaks > Scanning Engine> activate this: "Unload recognized
processes during
scanning."
Tweaks > Cleaning Engine: activate these: "Automatically try to
unregister
objects prior to deletion" and "Let Windows remove files in use after
reboot."
Click "Proceed" to save your settings, then click "Start." Make sure
"Activate in-depth scan" is ticked green, then scan your system.
When the
scan is finished, the screen will tell you if anything has been
found, click "Next." The bad files will be listed. Right click the
pane and click "Select
all objects" - This will put a check mark in the box at the side,
click "Next" again and click "OK" at the prompt "# objects will be
removed.
Continue?"
Courtesy of http://www.nondisputandum.com/html/anti_spyware.html:
HINT: If
Ad Aware is automatically shut-down by a malicious software, first
run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe,
before
opening Ad Aware. When AAWCloak is open, click “Activate Cloakâ€.
Then open
Ad Aware and scan your system.
Another excellent program for this purpose is SpyBot Search and
Destroy
available here: http://security.kolla.de/ SpyBot Support Forum
here: http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi.
I recommend
using both normally. After UPDATING and fixing ONLY RED things with
SpyBot
S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle
until
you get a clean "no red" scan. The reason is that SpyBot sometimes
has to
remove things which are currently "in use" before it can then clean
up
others.
Note that sometimes you need to make a judgement call about what
these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
A currently common parasite is some malware called CoolWebSearch. Do
the
following:
Download, UPDATE before running, and run:
http://www.intermute.com/spysubtract/cwshredder_download.html (The
new v.2
which will automatically install in C:\Program
Files\InterMute\SpySubtract\CWShredder.exe and put a shortcut on the
Desktop. Run the program from this install location or the shortcut
after
installation. This recommendation for CWShredder is NOT
automatically a
recommendation for the other programs adverstised by Intermute in
conjunction with this install.) or
http://209.133.47.200/~merijn/files/CWShredder.exe or here:
http://hem.bredband.net/b157129/f/cwshredder.zip or here:
http://www.softpedia.com/public/scripts/downloadhero/10-17-150/ or
here: http://www.zerosrealm.com/downloads/CWShredder.zip
to remove the parasite. Try to run from Safe mode or a Clean Boot
and be
sure to close ALL other programs to the extent possible, expecially
ALL
instances of IE and OE.
There's a good tutorial about CWS and using CWShredder here:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47#domain
See
also: http://cwshredder.net/cwshredder/cwschronicles.html
BE SURE that you get v.1.59.0.1 or later or the new v.2! Note that
CWShredder may make deletions/changes to your HOSTS file (sometimes
as false
positives), and that after cleanup you may need to restore it with a
fresh
copy of any local DNS and/or blocking entries or disable it before
running
CWShredder.
You will need to show Hidden files first and then at the end clear
the
malware garbage from your System Restore backups after you've
cleaned up.
It's best to perform CWShredder (and most other malware fixers too)
from
Safe mode and then reboot. AFTER cleaning things up, then you can
disable
and then re-enable System Restore. See ******** below.
The following links give instructions on how to do these various
functions:
HOW TO Restart in Safe ModeHOW TO Enable Hidden FilesHOW TO Disable/Flush System Restore (do this at the end AFTER
cleaning or
use the suggested procedure for XP at the ******'s)(WinME)
Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore
your
tabs and remove any restrictions that the parasite has put in place.
Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to
restore
your search functions if they've been affected (as they probably
will have
been).
Be sure that you also download and install hotfix Q816093, here:
http://support.microsoft.com/?kbid=816093
which blocks the exploit upon which this parasite family depends.
Another program which performs a similar function to CWShredder is
xcleaner_free (there's a more extensive paid version also) available
here
which should also be freshly downloaded and run after you run
CWShredder:
http://www.xblock.com/download-freeware.shtml
When done, go to Start|Run and enter one line at a time (or even
easier,
open a DOS box and copy the following in its entirety and then paste
it into
the box):
regsvr32 /i browseui.dll
regsvr32 /i shdocvw.dll
regsvr32 /i mshtml.dll
regsvr32 mshtmled.dll
regsvr32 actxprxy.dll
regsvr32 /i urlmon.dll
regsvr32 scrrun.dll
regsvr32 comcat.dll
regsvr32 Oleaut32.dll
regsvr32 /i Shell32.dll
regsvr32 Msoeacct.dll
regsvr32 "C:\Program Files\Outlook Express\Msoe.dll"
regsvr32 msjava.dll
regsvr32 jscript.dll
regsvr32 Olepro32.dll
regsvr32 Hlink.dll
regsvr32 Asctrls.ocx
regsvr32 Inetcpl.cpl /i
regsvr32 Dxtrans.dll
regsvr32 Dxtmsft.dll
regsvr32 Imgutil.dll
regsvr32 Msxml.dll
regsvr32 Msjava.dll
regsvr32 Jscript.dll
regsvr32 Softpub.dll
regsvr32 Wintrust.dll
regsvr32 Initpki.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 Gpkcsp.dll
regsvr32 Slbcsp.dll
regsvr32 Cryptdlg.dll
regsvr32 Msjet40.dll
regsvr32 pdm32.dll
regsvr32 Msjtor40.dll
regsvr32 Dao360.dll
regsvr32 Sccbase.dll
with a Return after each .dll. You'll get a message about successful
completion of the re-registration process after each one, then enter
the
next (with the DOS box they'll be continuous except for the last
one).
If you use Win98x and get an error on Shell32.dll, ignore it. Only
the ME,
Win2k and XP versions of windows have shell32 as an object that needs
registering. (For these earlier operating systems, run "regsvr32
shdoc401.dll " instead of "regsvr32 Shell32.dll".) Depending on
your
system, you may also get "not found" error messages on some or all
of the
last five - if so, ignore them.
Re-start your computer when you've finished.
If they don't fix it then start here:
Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download
a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED
frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
or here:
http://www.bleepingcomputer.com/files/spyware/hijackthis.zip
There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html
In Windows Explorer, click on Tools|Folder Options|View and check
"Show
hidden files and folders" and uncheck "Hide protected operating
system
files". (You may want to restore these when you're all finished with
HijackThis.)
Place HijackThis.exe or unzip HijackThis.zip into its own dedicated
folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on
your
Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE
MUST be
closed) then press Scan. Click on SaveLog when it's finished which
will
create hijackthis.log. Now click the Config button, then Misc Tools
and
click on Generate StartupList.log which will create Startuplist.txt.
Then go to one of the following forums:
Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/
or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
or Jim Eshelman's site here: http://forum.aumha.org/
or Bleepingcomputer here: http://www.bleepingcomputer.com/
Register if necessary, then sign in and READ THE DIRECTIONS at the
beginning
of the particular sites HiJackThis forum, then copy and paste both
files
into a message asking for assistance, Someone will answer with
detailed
instructions for the removal of your parasite(s). Be sure you
include at
the beginning of your post "What problem(s) you're trying to solve"
and "What steps you've already taken."
*******
ONLY IF you've successfully eliminated the malware, you can now make
a new,
clean Restore Point and delete any previously saved (possibly
infected)
ones. The following suggested approach is courtesy of Gary Woodruff:
For XP
you can run a Disk Cleanup cycle and then look in the More Options
tab. The
System Restore option removes all but the latest Restore Point. If
there
hasn't been one made since the system was cleaned you should
manually create
one before dumping the old possibly infected ones.
*******
Once you get this cleaned up, you might want to consider installing
Eric
Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help
prevent this
kind of thing from happening in the future:
IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm
"IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of
Internet
Explorer. Once you merge this list of sites and domains into the
Registry,
the web sites for these companies will not be able to use cookies,
ActiveX
controls, Java applets, or scripting to compromise your privacy or
your PC
while you surf the Net. Nor will they be able to use your browser to
push
unwanted pop-ups, cookies, or auto-installing programs on your PC."
Read
carefully.
http://www.javacoolsoftware.com/spywareblaster.html (Prevents
malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU
or memory
load - but keep it UPDATED) The latest version as of this writing
will
prevent installation or prevent the malware from running if it is
already
installed, and it provides information and fixit-links for a variety
of
parasites.
http://www.javacoolsoftware.com/spywareguard.html (Monitors for
attempts to
install malware) Keep it UPDATED. All three Very Highly Recommended
Next, install and keep updated a good HOSTS file. It can help you
avoid
most adware/malware. See here:
http://www.mvps.org/winhelp2002/hosts.htm (Be sure it's
named/renamed HOSTS - all caps, no extension) Additional
tutorials here:
http://www.bleepingcomputer.com/forums/index.php?s=14f3f9225081133297a8acdd11137c5b&showtutorial=51
(detailed) and here:
http://www.spywarewarrior.com/viewtopic.php?t=410 (overview)
Finally, be sure that you have a good hardware or software firewall
and an
AntiVirus installed, and bring your OS up-to-date with ALL Critical
updates
from Windows Update.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
Inneedhelp said:I got this blue tool bar from
http://mysearchnow.com/passthrough/newpass2.html opening at the
botton of my screen whenever I open my browser. I cant uninstall it
or remove it, please help me.
Jim Byrd said:Hi NeedHelp - OK, you can probably use ToolbarCop, free, here:
http://windowsxp.mvps.org/toolbarcop.htm just to get rid of the toolbar.
However, I would strongly suggest that you also do the other steps that I
outlined below the lop uninstall information in my last post (see below).
You may need help in getting rid of the underlying malware, so pay
particular attention to the section about using HiJackThis when you get to
it.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
Inneedhelp said:I have tried the way u said in the post, but none of them helped me.
I cant find any titles similar to the few that u suggested in the add
and remove section.
I downloaded the program to uninstall the taskbar, but it cannot
detect anything wrong.
Now i still have the task bar and i cant get rid of it.. help!
:
Go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm
or here: http://inetexplorer.mvps.org/parasite.htm and wait a
little bit (be patient), while an analysis of a number of possible
parasites on your
machine will be made to help you identify and remove them. NOTE:
You will
need to disable Ad Blocking in Zone Alarm 3.x or later, if present
or any
other Ad Blocking software which interferes with Java Scripting for
this
scan to work. You should get a message between the two lines of
**** giving
the results of the scan.
Now do the following, even if nothing shows up on the scan
(especially note
the preventive measures at the end):
#########IMPORTANT#########
Before you try to remove spyware using any of the programs below,
download
both a copy of LSPFIX here:
http://www.cexx.org/lspfix.htm
AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
or here for Win2k/XP
http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm
The process of removing certain malware may kill your internet
connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will
enable you
to regain your connection.
NOTE: It is reported that in XP SP2, the command netsh winsock
reset
will fix this problem without the need for these programs. (You can
also
try this if you're on XP SP1. There has also been one, as yet
unconfirmed,
report that this also works there.) Also, one MS technician
suggested the
following sequence:
netsh int reset all
ipconfig /flushdns
#########IMPORTANT#########
#########IMPORTANT#########
Show hidden files and run all of the following removal tools from
Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is
fixed
after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
Clean Boot: 1. Start|Run enter msconfig.
2. In the Startup tab, click the "Disable All" button.
3. In the Services tab, check the "Hide All Microsoft Services"
checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.
#########IMPORTANT#########
Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from
the link
on this page: http://vil.nai.com/vil/stinger/
Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest
pattern
file, here: http://www.trendmicro.com/download/pattern.asp Be sure
to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might
also want
to get Art's updater, SYS-UP.Zip, here for future updating of these:
http://home.epix.net/~artnpeg/). (If you download and use the
updater from
the beginning, it will automatically handle downloading the other
files.)
Place them in a dedicated folder after appropriate unzipping. Show
hidden
and system files (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
Disable Restore if you're on XP or ME (directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then
boot to
Safe mode (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
Read tscreadme.txt carefully, then do a complete scan of your
system
in Safe mode and clean or delete anything it finds. Reboot to
normal mode
and re-run the scan again.
This scan may take a long time, as Sysclean is VERY extensive and
thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.
Sometimes the tools below will find files which they are unable to
delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the
process of "replacing, moving, renaming or deleting one or many
files which are
currently in use (e.g. system files like comctl32.dll, or
virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid
File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem
For the general hijack case, the best way to start is to get
Ad-Aware SE
Personal Edition, here:
http://www.lavasoftusa.com/support/download/.
UPDATE, set it up in accordance with this:
http://forum.aumha.org/viewtopic.php?t=5877 and run this regularly
to get
rid of most "spyware/hijackware" on your machine. If it has to fix
things,
be sure to re-boot and rerun AdAware again and repeat this cycle
until you
get a clean scan. The reason is that it may have to remove things
which
are currently "in use" before it can then clean up others.
Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click
the gear
wheel at the top and check these options to configure Ad-aware for a
customized scan:
General> activate these: "Automatically save log-file" and
"Automatically
quarantine objects prior to removal"
Scanning > activate these: "Scan within archives", "Scan active
processes", "Scan registry", "Deep scan registry," "Scan my IE
Favorites for banned
sites," and "Scan my Hosts file"
Tweaks > Scanning Engine> activate this: "Unload recognized
processes during
scanning."
Tweaks > Cleaning Engine: activate these: "Automatically try to
unregister
objects prior to deletion" and "Let Windows remove files in use after
reboot."
Click "Proceed" to save your settings, then click "Start." Make sure
"Activate in-depth scan" is ticked green, then scan your system.
When the
scan is finished, the screen will tell you if anything has been
found, click "Next." The bad files will be listed. Right click the
pane and click "Select
all objects" - This will put a check mark in the box at the side,
click "Next" again and click "OK" at the prompt "# objects will be
removed.
Continue?"
Courtesy of http://www.nondisputandum.com/html/anti_spyware.html:
HINT: If
Ad Aware is automatically shut-down by a malicious software, first
run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe,
before
opening Ad Aware. When AAWCloak is open, click “Activate Cloakâ€.
Then open
Ad Aware and scan your system.
Another excellent program for this purpose is SpyBot Search and
Destroy
available here: http://security.kolla.de/ SpyBot Support Forum
here: http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi.
I recommend
using both normally. After UPDATING and fixing ONLY RED things with
SpyBot
S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle
until
you get a clean "no red" scan. The reason is that SpyBot sometimes
has to
remove things which are currently "in use" before it can then clean
up
others.
Note that sometimes you need to make a judgement call about what
these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
A currently common parasite is some malware called CoolWebSearch. Do
the
following:
Download, UPDATE before running, and run:
http://www.intermute.com/spysubtract/cwshredder_download.html (The
new v.2
which will automatically install in C:\Program
Files\InterMute\SpySubtract\CWShredder.exe and put a shortcut on the
Desktop. Run the program from this install location or the shortcut
after
installation. This recommendation for CWShredder is NOT
automatically a
recommendation for the other programs adverstised by Intermute in
conjunction with this install.) or
http://209.133.47.200/~merijn/files/CWShredder.exe or here:
http://hem.bredband.net/b157129/f/cwshredder.zip or here:
http://www.softpedia.com/public/scripts/downloadhero/10-17-150/ or
here: http://www.zerosrealm.com/downloads/CWShredder.zip
to remove the parasite. Try to run from Safe mode or a Clean Boot
and be
sure to close ALL other programs to the extent possible, expecially
ALL
instances of IE and OE.
There's a good tutorial about CWS and using CWShredder here:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47#domain
See
also: http://cwshredder.net/cwshredder/cwschronicles.html
BE SURE that you get v.1.59.0.1 or later or the new v.2! Note that
CWShredder may make deletions/changes to your HOSTS file (sometimes
as false
positives), and that after cleanup you may need to restore it with a
fresh
copy of any local DNS and/or blocking entries or disable it before
running
CWShredder.
You will need to show Hidden files first and then at the end clear
the
malware garbage from your System Restore backups after you've
cleaned up.
It's best to perform CWShredder (and most other malware fixers too)
from
Safe mode and then reboot. AFTER cleaning things up, then you can
disable
and then re-enable System Restore. See ******** below.
The following links give instructions on how to do these various
functions:
HOW TO Restart in Safe ModeHOW TO Enable Hidden FilesHOW TO Disable/Flush System Restore (do this at the end AFTER
cleaning or
use the suggested procedure for XP at the ******'s)(WinME)
Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore
your
tabs and remove any restrictions that the parasite has put in place.
Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to
restore
your search functions if they've been affected (as they probably
will have
been).
Be sure that you also download and install hotfix Q816093, here:
http://support.microsoft.com/?kbid=816093
which blocks the exploit upon which this parasite family depends.
Another program which performs a similar function to CWShredder is
xcleaner_free (there's a more extensive paid version also) available
here
which should also be freshly downloaded and run after you run
CWShredder:
http://www.xblock.com/download-freeware.shtml
When done, go to Start|Run and enter one line at a time (or even
easier,
open a DOS box and copy the following in its entirety and then paste
it into
the box):
regsvr32 /i browseui.dll
regsvr32 /i shdocvw.dll
regsvr32 /i mshtml.dll
regsvr32 mshtmled.dll
regsvr32 actxprxy.dll
regsvr32 /i urlmon.dll
regsvr32 scrrun.dll
regsvr32 comcat.dll
regsvr32 Oleaut32.dll
regsvr32 /i Shell32.dll
regsvr32 Msoeacct.dll
regsvr32 "C:\Program Files\Outlook Express\Msoe.dll"
regsvr32 msjava.dll
regsvr32 jscript.dll
regsvr32 Olepro32.dll
regsvr32 Hlink.dll
regsvr32 Asctrls.ocx
regsvr32 Inetcpl.cpl /i
regsvr32 Dxtrans.dll
regsvr32 Dxtmsft.dll
regsvr32 Imgutil.dll
regsvr32 Msxml.dll
regsvr32 Msjava.dll
regsvr32 Jscript.dll
regsvr32 Softpub.dll
regsvr32 Wintrust.dll
regsvr32 Initpki.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 Gpkcsp.dll
regsvr32 Slbcsp.dll
regsvr32 Cryptdlg.dll
regsvr32 Msjet40.dll
regsvr32 pdm32.dll
regsvr32 Msjtor40.dll
regsvr32 Dao360.dll
regsvr32 Sccbase.dll
with a Return after each .dll. You'll get a message about successful
completion of the re-registration process after each one, then enter
the
next (with the DOS box they'll be continuous except for the last
one).
If you use Win98x and get an error on Shell32.dll, ignore it. Only
the ME,
Win2k and XP versions of windows have shell32 as an object that needs
registering. (For these earlier operating systems, run "regsvr32
shdoc401.dll " instead of "regsvr32 Shell32.dll".) Depending on
your
system, you may also get "not found" error messages on some or all
of the
last five - if so, ignore them.
Re-start your computer when you've finished.
If they don't fix it then start here:
Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download
a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED
frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
or here:
http://www.bleepingcomputer.com/files/spyware/hijackthis.zip
There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html
In Windows Explorer, click on Tools|Folder Options|View and check
"Show
hidden files and folders" and uncheck "Hide protected operating
system
files". (You may want to restore these when you're all finished with
HijackThis.)
Place HijackThis.exe or unzip HijackThis.zip into its own dedicated
folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on
your
Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE
MUST be
closed) then press Scan. Click on SaveLog when it's finished which
will
create hijackthis.log. Now click the Config button, then Misc Tools
and
click on Generate StartupList.log which will create Startuplist.txt.
Then go to one of the following forums:
Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/
or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
or Jim Eshelman's site here: http://forum.aumha.org/
or Bleepingcomputer here: http://www.bleepingcomputer.com/
Register if necessary, then sign in and READ THE DIRECTIONS at the
beginning
of the particular sites HiJackThis forum, then copy and paste both
files
into a message asking for assistance, Someone will answer with
detailed
instructions for the removal of your parasite(s). Be sure you
include at
the beginning of your post "What problem(s) you're trying to solve"
and "What steps you've already taken."
*******
ONLY IF you've successfully eliminated the malware, you can now make
a new,
clean Restore Point and delete any previously saved (possibly
infected)
ones. The following suggested approach is courtesy of Gary Woodruff:
For XP
you can run a Disk Cleanup cycle and then look in the More Options
tab. The
System Restore option removes all but the latest Restore Point. If
there
hasn't been one made since the system was cleaned you should
manually create
one before dumping the old possibly infected ones.
*******
Once you get this cleaned up, you might want to consider installing
Eric
Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help
prevent this
kind of thing from happening in the future:
IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm
"IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of
Internet
Explorer. Once you merge this list of sites and domains into the
Registry,
the web sites for these companies will not be able to use cookies,
ActiveX
controls, Java applets, or scripting to compromise your privacy or
your PC
while you surf the Net. Nor will they be able to use your browser to
push
unwanted pop-ups, cookies, or auto-installing programs on your PC."
Read
carefully.
http://www.javacoolsoftware.com/spywareblaster.html (Prevents
malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU
or memory
load - but keep it UPDATED) The latest version as of this writing
will
prevent installation or prevent the malware from running if it is
already
installed, and it provides information and fixit-links for a variety
of
parasites.
http://www.javacoolsoftware.com/spywareguard.html (Monitors for
attempts to
install malware) Keep it UPDATED. All three Very Highly Recommended
Next, install and keep updated a good HOSTS file. It can help you
avoid
most adware/malware. See here:
http://www.mvps.org/winhelp2002/hosts.htm (Be sure it's
named/renamed HOSTS - all caps, no extension) Additional
tutorials here:
http://www.bleepingcomputer.com/forums/index.php?s=14f3f9225081133297a8acdd11137c5b&showtutorial=51
(detailed) and here:
http://www.spywarewarrior.com/viewtopic.php?t=410 (overview)
Finally, be sure that you have a good hardware or software firewall
and an
AntiVirus installed, and bring your OS up-to-date with ALL Critical
updates
from Windows Update.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In needhelp <[email protected]> typed:
I got this blue tool bar from
http://mysearchnow.com/passthrough/newpass2.html opening at the
botton of my screen whenever I open my browser. I cant uninstall it
or remove it, please help me.
needhelp said:jim,
I tried using the toolbarcop, but i cant disable or delete 2
items, one is &Address and &Links. odject type is Toolbar, filename is
%systemroot%\system32\SHELL32.dll and \ browseui.dll
Both of this i cant disable or delete. wats happening!!!???? help me!!
Jim Byrd said:Hi NeedHelp - OK, you can probably use ToolbarCop, free, here:
http://windowsxp.mvps.org/toolbarcop.htm just to get rid of the
toolbar. However, I would strongly suggest that you also do the
other steps that I outlined below the lop uninstall information in
my last post (see below). You may need help in getting rid of the
underlying malware, so pay particular attention to the section about
using HiJackThis when you get to it.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
Inneedhelp said:I have tried the way u said in the post, but none of them helped me.
I cant find any titles similar to the few that u suggested in the
add and remove section.
I downloaded the program to uninstall the taskbar, but it cannot
detect anything wrong.
Now i still have the task bar and i cant get rid of it.. help!
"Jim Byrd" wrote:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)Go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm
or here: http://inetexplorer.mvps.org/parasite.htm and wait a
little bit (be patient), while an analysis of a number of possible
parasites on your
machine will be made to help you identify and remove them. NOTE:
You will
need to disable Ad Blocking in Zone Alarm 3.x or later, if present
or any
other Ad Blocking software which interferes with Java Scripting for
this
scan to work. You should get a message between the two lines of
**** giving
the results of the scan.
Now do the following, even if nothing shows up on the scan
(especially note
the preventive measures at the end):
#########IMPORTANT#########
Before you try to remove spyware using any of the programs below,
download
both a copy of LSPFIX here:
http://www.cexx.org/lspfix.htm
AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
or here for Win2k/XP
http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm
The process of removing certain malware may kill your internet
connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will
enable you
to regain your connection.
NOTE: It is reported that in XP SP2, the command netsh winsock
reset
will fix this problem without the need for these programs. (You
can also
try this if you're on XP SP1. There has also been one, as yet
unconfirmed,
report that this also works there.) Also, one MS technician
suggested the
following sequence:
netsh int reset all
ipconfig /flushdns
#########IMPORTANT#########
#########IMPORTANT#########
Show hidden files and run all of the following removal tools from
Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is
fixed
after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
Clean Boot: 1. Start|Run enter msconfig.
2. In the Startup tab, click the "Disable All" button.
3. In the Services tab, check the "Hide All Microsoft Services"
checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.
#########IMPORTANT#########
Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from
the link
on this page: http://vil.nai.com/vil/stinger/
Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest
pattern
file, here: http://www.trendmicro.com/download/pattern.asp Be
sure to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might
also want
to get Art's updater, SYS-UP.Zip, here for future updating of
these: http://home.epix.net/~artnpeg/). (If you download and use
the updater from
the beginning, it will automatically handle downloading the other
files.)
Place them in a dedicated folder after appropriate unzipping. Show
hidden
and system files (HowTo here:http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)Disable Restore if you're on XP or ME (directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then
boot to
Safe mode (HowTo here:Read tscreadme.txt carefully, then do a complete scan of your
system
in Safe mode and clean or delete anything it finds. Reboot to
normal mode
and re-run the scan again.
This scan may take a long time, as Sysclean is VERY extensive and
thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.
Sometimes the tools below will find files which they are unable to
delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the
process of "replacing, moving, renaming or deleting one or many
files which are
currently in use (e.g. system files like comctl32.dll, or
virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid
File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem
For the general hijack case, the best way to start is to get
Ad-Aware SE
Personal Edition, here:
http://www.lavasoftusa.com/support/download/.
UPDATE, set it up in accordance with this:
http://forum.aumha.org/viewtopic.php?t=5877 and run this regularly
to get
rid of most "spyware/hijackware" on your machine. If it has to
fix things,
be sure to re-boot and rerun AdAware again and repeat this cycle
until you
get a clean scan. The reason is that it may have to remove things
which
are currently "in use" before it can then clean up others.
Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click
the gear
wheel at the top and check these options to configure Ad-aware for
a customized scan:
General> activate these: "Automatically save log-file" and
"Automatically
quarantine objects prior to removal"
Scanning > activate these: "Scan within archives", "Scan active
processes", "Scan registry", "Deep scan registry," "Scan my IE
Favorites for banned
sites," and "Scan my Hosts file"
Tweaks > Scanning Engine> activate this: "Unload recognized
processes during
scanning."
Tweaks > Cleaning Engine: activate these: "Automatically try to
unregister
objects prior to deletion" and "Let Windows remove files in use
after reboot."
Click "Proceed" to save your settings, then click "Start." Make
sure "Activate in-depth scan" is ticked green, then scan your
system. When the
scan is finished, the screen will tell you if anything has been
found, click "Next." The bad files will be listed. Right click the
pane and click "Select
all objects" - This will put a check mark in the box at the side,
click "Next" again and click "OK" at the prompt "# objects will be
removed.
Continue?"
Courtesy of http://www.nondisputandum.com/html/anti_spyware.html:
HINT: If
Ad Aware is automatically shut-down by a malicious software, first
run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe,
before
opening Ad Aware. When AAWCloak is open, click “Activate Cloakâ€.
Then open
Ad Aware and scan your system.
Another excellent program for this purpose is SpyBot Search and
Destroy
available here: http://security.kolla.de/ SpyBot Support Forum
here: http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi.
I recommend
using both normally. After UPDATING and fixing ONLY RED things
with SpyBot
S&D, be sure to re-boot and rerun SpyBot again and repeat this
cycle until
you get a clean "no red" scan. The reason is that SpyBot sometimes
has to
remove things which are currently "in use" before it can then clean
up
others.
Note that sometimes you need to make a judgement call about what
these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
A currently common parasite is some malware called CoolWebSearch.
Do the
following:
Download, UPDATE before running, and run:
http://www.intermute.com/spysubtract/cwshredder_download.html (The
new v.2
which will automatically install in C:\Program
Files\InterMute\SpySubtract\CWShredder.exe and put a shortcut on
the Desktop. Run the program from this install location or the
shortcut after
installation. This recommendation for CWShredder is NOT
automatically a
recommendation for the other programs adverstised by Intermute in
conjunction with this install.) or
http://209.133.47.200/~merijn/files/CWShredder.exe or here:
http://hem.bredband.net/b157129/f/cwshredder.zip or here:
http://www.softpedia.com/public/scripts/downloadhero/10-17-150/ or
here: http://www.zerosrealm.com/downloads/CWShredder.zip
to remove the parasite. Try to run from Safe mode or a Clean Boot
and be
sure to close ALL other programs to the extent possible, expecially
ALL
instances of IE and OE.
There's a good tutorial about CWS and using CWShredder here:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47#domain
See
also: http://cwshredder.net/cwshredder/cwschronicles.html
BE SURE that you get v.1.59.0.1 or later or the new v.2! Note that
CWShredder may make deletions/changes to your HOSTS file (sometimes
as false
positives), and that after cleanup you may need to restore it with
a fresh
copy of any local DNS and/or blocking entries or disable it before
running
CWShredder.
You will need to show Hidden files first and then at the end clear
the
malware garbage from your System Restore backups after you've
cleaned up.
It's best to perform CWShredder (and most other malware fixers too)
from
Safe mode and then reboot. AFTER cleaning things up, then you can
disable
and then re-enable System Restore. See ******** below.
The following links give instructions on how to do these various
functions:
HOW TO Restart in Safe ModeHOW TO Enable Hidden FilesHOW TO Disable/Flush System Restore (do this at the end AFTER
cleaning or
use the suggested procedure for XP at the ******'s)(WinXP)http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13(WinME)
Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore
your
tabs and remove any restrictions that the parasite has put in
place.
Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to
restore
your search functions if they've been affected (as they probably
will have
been).
Be sure that you also download and install hotfix Q816093, here:
http://support.microsoft.com/?kbid=816093
which blocks the exploit upon which this parasite family depends.
Another program which performs a similar function to CWShredder is
xcleaner_free (there's a more extensive paid version also)
available here
which should also be freshly downloaded and run after you run
CWShredder:
http://www.xblock.com/download-freeware.shtml
When done, go to Start|Run and enter one line at a time (or even
easier,
open a DOS box and copy the following in its entirety and then
paste it into
the box):
regsvr32 /i browseui.dll
regsvr32 /i shdocvw.dll
regsvr32 /i mshtml.dll
regsvr32 mshtmled.dll
regsvr32 actxprxy.dll
regsvr32 /i urlmon.dll
regsvr32 scrrun.dll
regsvr32 comcat.dll
regsvr32 Oleaut32.dll
regsvr32 /i Shell32.dll
regsvr32 Msoeacct.dll
regsvr32 "C:\Program Files\Outlook Express\Msoe.dll"
regsvr32 msjava.dll
regsvr32 jscript.dll
regsvr32 Olepro32.dll
regsvr32 Hlink.dll
regsvr32 Asctrls.ocx
regsvr32 Inetcpl.cpl /i
regsvr32 Dxtrans.dll
regsvr32 Dxtmsft.dll
regsvr32 Imgutil.dll
regsvr32 Msxml.dll
regsvr32 Msjava.dll
regsvr32 Jscript.dll
regsvr32 Softpub.dll
regsvr32 Wintrust.dll
regsvr32 Initpki.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 Gpkcsp.dll
regsvr32 Slbcsp.dll
regsvr32 Cryptdlg.dll
regsvr32 Msjet40.dll
regsvr32 pdm32.dll
regsvr32 Msjtor40.dll
regsvr32 Dao360.dll
regsvr32 Sccbase.dll
with a Return after each .dll. You'll get a message about
successful completion of the re-registration process after each
one, then enter the
next (with the DOS box they'll be continuous except for the last
one).
If you use Win98x and get an error on Shell32.dll, ignore it. Only
the ME,
Win2k and XP versions of windows have shell32 as an object that
needs registering. (For these earlier operating systems, run
"regsvr32 shdoc401.dll " instead of "regsvr32 Shell32.dll".)
Depending on your
system, you may also get "not found" error messages on some or all
of the
last five - if so, ignore them.
Re-start your computer when you've finished.
If they don't fix it then start here:
Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always
download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED
frequently.)
You may also get it here if that link is blocked:http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949or here:
http://www.bleepingcomputer.com/files/spyware/hijackthis.zip
There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html
In Windows Explorer, click on Tools|Folder Options|View and check
"Show
hidden files and folders" and uncheck "Hide protected operating
system
files". (You may want to restore these when you're all finished
with HijackThis.)
Place HijackThis.exe or unzip HijackThis.zip into its own dedicated
folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on
your
Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE
MUST be
closed) then press Scan. Click on SaveLog when it's finished which
will
create hijackthis.log. Now click the Config button, then Misc Tools
and
click on Generate StartupList.log which will create
Startuplist.txt.
Then go to one of the following forums:
Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/
or Net-Integration here:http://www.bleepingcomputer.com/forums/index.php?s=14f3f9225081133297a8acdd11137c5b&showtutorial=51or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
or Jim Eshelman's site here: http://forum.aumha.org/
or Bleepingcomputer here: http://www.bleepingcomputer.com/
Register if necessary, then sign in and READ THE DIRECTIONS at the
beginning
of the particular sites HiJackThis forum, then copy and paste both
files
into a message asking for assistance, Someone will answer with
detailed
instructions for the removal of your parasite(s). Be sure you
include at
the beginning of your post "What problem(s) you're trying to solve"
and "What steps you've already taken."
*******
ONLY IF you've successfully eliminated the malware, you can now
make a new,
clean Restore Point and delete any previously saved (possibly
infected)
ones. The following suggested approach is courtesy of Gary
Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options
tab. The
System Restore option removes all but the latest Restore Point. If
there
hasn't been one made since the system was cleaned you should
manually create
one before dumping the old possibly infected ones.
*******
Once you get this cleaned up, you might want to consider installing
Eric
Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help
prevent this
kind of thing from happening in the future:
IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm
"IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of
Internet
Explorer. Once you merge this list of sites and domains into the
Registry,
the web sites for these companies will not be able to use cookies,
ActiveX
controls, Java applets, or scripting to compromise your privacy or
your PC
while you surf the Net. Nor will they be able to use your browser
to push
unwanted pop-ups, cookies, or auto-installing programs on your PC."
Read
carefully.
http://www.javacoolsoftware.com/spywareblaster.html (Prevents
malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU
or memory
load - but keep it UPDATED) The latest version as of this writing
will
prevent installation or prevent the malware from running if it is
already
installed, and it provides information and fixit-links for a
variety of
parasites.
http://www.javacoolsoftware.com/spywareguard.html (Monitors for
attempts to
install malware) Keep it UPDATED. All three Very Highly
Recommended
Next, install and keep updated a good HOSTS file. It can help you
avoid
most adware/malware. See here:
http://www.mvps.org/winhelp2002/hosts.htm (Be sure it's
named/renamed HOSTS - all caps, no extension) Additional
tutorials here:(detailed) and here:
http://www.spywarewarrior.com/viewtopic.php?t=410 (overview)
Finally, be sure that you have a good hardware or software firewall
and an
AntiVirus installed, and bring your OS up-to-date with ALL Critical
updates
from Windows Update.
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In needhelp <[email protected]> typed:
I got this blue tool bar from
http://mysearchnow.com/passthrough/newpass2.html opening at the
botton of my screen whenever I open my browser. I cant uninstall
it or remove it, please help me.