1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

spyware keeps coming back

Discussion in 'Malware and Virus Removal Archive' started by shortgal10, 2005/06/07.

Thread Status:
Not open for further replies.
  1. 2005/06/07
    shortgal10

    shortgal10 Inactive Thread Starter

    Joined:
    2004/02/20
    Messages:
    37
    Likes Received:
    0
    I have been trying to fix this myself but I can't. I have Apropos Media adware and People on Page browser helper and when my spyware program detects thems and deletes them they come right back. I ran adaware and spybot and they did not detect them only my system mechanic by IOLA spyremover detects them. I downloaded the pepper thing and it said I did not have any pepper files on my computer, then I downloaded the hijack this and I got this report but I don't know what to delete.

    Logfile of HijackThis v1.99.1
    Scan saved at 6:47:48 PM, on 6/7/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Marilyn.MARILYN-624BXFZ\Desktop\bring it\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe "
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe "
    O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe "
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe "
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1117244245421
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    can anyone please help me. :(
     
  2. 2005/06/07
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400

  3. to hide this advert.

  4. 2005/06/07
    markp62

    markp62 Geek Member Alumni

    Joined:
    2002/05/01
    Messages:
    4,012
    Likes Received:
    16
    Hello, your HJT log doesn't show it. It is way too short for an infection, there isn't any BHO's [Browser Helper Object] listed.
    But, download the trial version of ewido security suite.
    Install ewido security suite and start the program from the icon on your desktop, then check for and download updates. Close for now.
    Reboot into Safe Mode, and then do the eido scan.
     
  5. 2005/06/08
    shortgal10

    shortgal10 Inactive Thread Starter

    Joined:
    2004/02/20
    Messages:
    37
    Likes Received:
    0
    I finally got rid of it

    I ran ewido in safe mode and it said I did not have anything, I went to the coputer associates web site and followed all of their directions to no avail.

    I was just about ready to pull my hair out, when I ran across this article that said "people blame their spyware but it is not that, the pest changed your internet explorer, so I ran hijack this again and I had three internet explorers in it, so I deleted two of them the one that said internet explorer=main start page, and the one that said internet explorer=local page and that did the trick. Now I only have one and it is not infected.

    I also noticed the other day that I had two internet explorers in my processes. Well, I got a spyware program running in the background now, a firewall other than what I was using the xp one.

    I am happy. :) I thought I was going to have to reinstall windows :eek:

    thanks and I hope this helps anyone else who cannot get rid of apropos and people on page.
     
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.