TechSpot

Spy and Ad ware continually detected on Spybot

By IBN
May 20, 2006
  1. Whenever i use Spybot after it detects Spyware and Adware, then after its fixed i run the scan again and it detects spyware and adware again!!! This happens everytime i rescan.

    ???
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Lets see if you have any nasties on your system.

    Go HERE and follow the instructions.

    Post a fresh HJT log as an attachment, only after doing the above.

    Regards Howard :)
     
  3. IBN

    IBN TS Maniac Topic Starter Posts: 487

    Thats was one hell of a mission. Here is the HJT log!!!
     

    Attached Files:

  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    ALCMTR.EXE

    Close task manager.

    Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O17 - HKLM\System\CCS\Services\Tcpip\..\{6692504B-1B16-4C2C-9509-D936EAA6F916}: NameServer = 83.146.21.5 212.158.248.6<Only fix this, if it doesn`t belong to your ISP.

    O20 - Winlogon Notify: winuns32 - winuns32.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files(if there).

    C:\WINDOWS\SYSTEM32\winuns32.dll
    ALCMTR.EXE

    Run Spybot search and destroy and delete whatever it finds.

    Reboot into normal mode and turn system restore back on.


    Regards Howard :)
     
  5. IBN

    IBN TS Maniac Topic Starter Posts: 487

    It worked. Many thanx. :)
     
  6. IBN

    IBN TS Maniac Topic Starter Posts: 487

    Howard i am having the same problem again The link you posted in the past doesnt work. I have attached a HJT log to look at also.

    Thanx
     
  7. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I`ve fixed the link.

    Your HJT log is clean.

    What problems are you having?

    Regards Howard :)
     
  8. IBN

    IBN TS Maniac Topic Starter Posts: 487

    Whenever i run spybot it always picks up something.
     
  9. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Can you please tell me what Spybot is picking up?

    I need the exact name of the file or files.

    Regards Howard :)
     
  10. IBN

    IBN TS Maniac Topic Starter Posts: 487

    I have attached the pic.
     
  11. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    They`re just tracking cookies and nothing to worry about.

    You can actually disable any website you choose from setting cookies in Firefox. See HERE for more info. Just scroll down the page untill you find the section on cookies.

    Regards Howard :)
     
  12. Peddant

    Peddant TS Rookie Posts: 1,446

    Post removed.
     
  13. IBN

    IBN TS Maniac Topic Starter Posts: 487

    OK phew. I have set it to until I close firefox. What setting do you recommend.
     
  14. IBN

    IBN TS Maniac Topic Starter Posts: 487

    Another question. If your HJT log is clean does that mean you dont have no spyware or viruses?

    Thanx
     
  15. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    To answer you first question. I`d personally recommend blocking those tracking cookies in Firefox.

    As for your second question. A clean HJT log is a good indicator that your system is clean. However, it is possible for some viruses to hide on your system and not show up in HJT.

    Unless you`re having some unexplained problems, I wouldn`t worry about it too much though.

    Regards Howard :)
     
  16. IBN

    IBN TS Maniac Topic Starter Posts: 487

    Thanx alot for your help. I'll read up on how to block tracking cookies.
     
  17. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...