Spybot 'finds' that cannot be removed

  • Thread starter Thread starter Papa Joe
  • Start date Start date
P

Papa Joe

Hi
I have an xp machine that I have repeatedly run spybot on and it just
cannot get rid of these two items:

Elitum.EliteBar and
eXact Advertising.Bargains Buddy--this one has 17 files. It seems to
take them off at the time but they're back the next time I run

Has anyone seen this/these two, and, if so, have you figured how to
rid the systems of them?

I appreciate the time.
Joe
 
1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt261.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

2) Update Adaware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point

* * * Please report back your results * * *

Dave




| Hi
| I have an xp machine that I have repeatedly run spybot on and it just
| cannot get rid of these two items:
|
| Elitum.EliteBar and
| eXact Advertising.Bargains Buddy--this one has 17 files. It seems to
| take them off at the time but they're back the next time I run
|
| Has anyone seen this/these two, and, if so, have you figured how to
| rid the systems of them?
|
| I appreciate the time.
| Joe
|
|
|
|
|
 
Thanks for all the work/time.
Already have the adaware but not the Tend Micro Stuff.

Have now obtained them and will complete the work on Friday or
Saturday.......

Happy Thanksgiving.

Joe
 
I hope that is Adaware SE v1.05 and not Adaware 6.

Dave



| Thanks for all the work/time.
| Already have the adaware but not the Tend Micro Stuff.
|
| Have now obtained them and will complete the work on Friday or
| Saturday.......
|
| Happy Thanksgiving.
|
| Joe
|
| On Wed, 24 Nov 2004 21:05:03 GMT, "David H. Lipman"
|
| > http://www.trendmicro.com/download/pattern.asp
|
|
|
|
|
|
 
Good thing you asked and I checked--version 6.
Never figured that version 1.05 would succeed version 6...but., to be
sure is 1.05 later than 6? The version 1.05 looks to have been
released in September(17th). It may be a follow up build to the
original version 6.....

Just a bit confusing....

If so, I will get whatever the current version is now along with the
definitions file for it.

Joe
 
Latest version is 1.05, Joe. It has had some freezing problems, but they
may have fixed it by now.....I am still using 1.03.

Heather
 
Hi
I have an xp machine that I have repeatedly run spybot on and it just
cannot get rid of these two items:

Elitum.EliteBar and
eXact Advertising.Bargains Buddy--this one has 17 files. It seems to
take them off at the time but they're back the next time I run

Has anyone seen this/these two, and, if so, have you figured how to
rid the systems of them?
Click to expand...
Yep. Seen it. Killed it. It lives with me no more.

Are you good with a file manager?

So far as I know you are going to need to do a slash-and-burn on this one.
I did. Maybe there is something out there which will do it with a push of a
button.

Most likely it keeps coming back because you have a rogue dll which contains
it's code and a cutesy exe that starts at startup and recreates it after you
delete it.

Also, check your Add/Remove programs in control panel and see if you have
something called CASprog. Do not attempt to uninstall it from there, if you
try you will activate it. CASprog, Golden Casino, Bargain Buddy and Lycos
often travel together. Check your Program Files tree for things like
Bargains and/or MY SEARCH.

Have you checked MSCONFIG for unknown startup items?


FACE
 
Back
Top