Help needed removing spyware

  RamUK 18:15 26 Jun 2004
Locked

Since I started to use P2P software (morpheus) I have been getting hit by spyware and adware. I have removed most using different free utilities but can not get rid of the part that has changed my home page to a shopping page.

On launch I then get a few pop ups telling me that I am infected with spyware. Somehow it seems also to override by Pop Up Killer which now has to be manually reactivated every time I turn the pc on.

I'm running XP with IE6.

  VoG II 18:16 26 Jun 2004

Have you run Ad-aware and Spybot?

If so try CWShredder click here

  RamUK 20:07 26 Jun 2004

Tried all those mate and it's still had no effect. I reckon that I have tried at least 5 different spyware programmes and also done virus check but nothing is helping.

I'm pulling my hair out here.

  carver 20:47 26 Jun 2004

If I understand the workings of certain P2P sites when you download certain files you automatically agree to everything contained in that file and occasionally spyware and page setup are included, because you have agreed,it bypasses everything, unless someone knows better.

  cyberphobic 21:08 26 Jun 2004

What I have done when all else fails is use "Hijack This" (a free download which you can find with a Google search) it shows you every programme in the registry which loads when you start your PC. It goes without saying that you need to be careful what you remove, but if you copy and paste your findings and then post them here I'm sure someone will assist. Anything untoward should be obvious, I used this process yesterday to remove the "isearch" toolbar which resisted all other attempts.

  keenan 21:19 26 Jun 2004

Try 'Start Page Guard'

click here

  VoG II 21:35 26 Jun 2004

Post a HJT log click here

  RamUK 11:25 27 Jun 2004

Here's part of the log. I've no tried about 6 different things including ad-aware, spy-bot, cwshredder, spysweeper, xsoftspy and home page guard and nothing seems to work. I'm drifting into mild panic with a reformat looming.

I can't post it all but this appears to be the area of concern and that odfbe url is the one that it keep taking me too.



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odfbe.dll/sp.html#35759
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = click here
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = click here
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = click here
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odfbe.dll/sp.html#35759
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://odfbe.dll/index.html#35759
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\odfbe.dll/sp.html#35759
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by BT Openworld
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = click here
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {F33B84B4-9B35-0407-3C12-7ABB0397E43F} - C:\WINDOWS\system32\netgc32.dll

  livewire 11:28 27 Jun 2004

Try resetting your web settings Tools>Internet Options>Advanced>Reset websettings.

  RamUK 11:32 27 Jun 2004

No such commande livewire, just scrolled through 3 times and it's not there mate.

  RamUK 11:41 27 Jun 2004

A coup-le of other questions.

Will system restore help?

Why do I need need to manually reconfigure PopUP Killer each time I switch the pc on?

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Alienware 17 R4 2017 review

Illustrator Sylvain Tegroeg created thousands of intricate line drawings for the mobile game…

Best iPad buying guide 2017

Comment télécharger une application indisponible en France ?