seeve.exe adware

  • Thread starter Thread starter Vic
  • Start date Start date
V

Vic

I was able to remove seeve.exe from my computer by doing
the following: I used "search" for every file
containing "seeve.exe". When the search was completed
I "deleted" each file until all were removed. I had to
delete them in a random order so when you get the "unable
to delete" window chose another of the files and delete
it until all are removed. I am running Windows XP home
edition. I restarted my computer and seeve.exe was
totally removed from my computer.
 
Good work Vic ,

It may also be worth you giving Hijack This a try and
making sure Media-Motor hasnt added itself to your
trusted zone (This could lead to future problems,as they
can re-install the adware without your consent)

Download Hijack This Here :

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unpack it to its own folder (either c/drive or desktop) ,
Extract and run,Choose to run a scan and save the logfile.

Theres also a Registry run command for seeve unless any
scanners have already removed it :


If this has added itself it will look like this:



O4 - HKLM\..\Run: [seeve] C:\WINDOWS\seeve.exe


O15 - Trusted Zone: *.media-motor.net

And Possibly one of these :

O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} -
http://cabs.media-motor.net/cabs/alien.cab

O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} -
http://cabs.media-motor.net/cabs/diamond.cab


check the 016 entries for anything suspicious(016 ActiveX
objects-Downloaded program files)These are installed by
sites that you visit,if you remove them using hijack this
although they will be deleted you can reinstall the
ActiveX anytime by visiting the site again.


Genuine entries will look like this,giving clear
indications of what the ActiveX is and who its by :

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMesse...pDownloader.c
ab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}
(ActiveDataInfo Class) -
http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7}
(ActiveDataObj Class) -
http://www.symantec.com/techsupp/activedata/ActiveData.cab



Entries to be suspicious off are these type that only
give basic details


O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} -
http://www.180searchassistant.com/180(Modified)x.cab
016 - DPF:{94837F90-A2CA-4A8A-9DA0-B5438EA} -
http://install.wildtangent.com/cda/islandrally/ActiveLaunc
her/ActiveLauncher(Modified).cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} -
www.azebar.com/install/azesearch(Modified).cab




You may not need most of this info but thought id mention
the trusted zones and reg command for this.


Regards Andy Manc
 
Back
Top