TechSpot

Spyware...help please.

By gwhinck
Feb 7, 2005
Topic Status:
Not open for further replies.
  1. I finally got spywared to the point I can't get out on my own. A little help would be appreciated.

    HJT log attached:

    Attached Files:

  2. andygibbs

    andygibbs Newcomer, in training Posts: 76

    Microsoft Anti-spyware

    Have u tried microsoft anti-spyware?, its a free BETA download from the microsoft site and works quite well.
  3. Lunatic

    Lunatic Newcomer, in training Posts: 66

  4. gwhinck

    gwhinck Newcomer, in training Topic Starter

    Thanks for the replys;

    Lunatic - Ad-Aware SE finds and deletes it but it returns the next time I logon. I will try Spybot.

    andygibbs - Didn't know MS had gotten into the anti-spyware game, another one to try.

    Will try the two programs and post the results.
  5. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Hello and welcome to Techspot.

    Go HERE and follow the instructions very carefully, they will help you.

    Probably a good idea to print them out.

    Regards Howard :wave: :wave:
  6. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    You don't have any (visible) spyware AFAIK.
    But to be sure, do as Howard said and go to my post here first, and follow the instructions EXACTLY.
    How to remove Begin2Search/Coolwebsearch and Other Nasties

    When done, reboot in Safe Mode.
    Run Hijackthis ON ITS OWN and let it 'fix':
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us9.hpwis.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
    O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm (file missing)
    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)
  7. gwhinck

    gwhinck Newcomer, in training Topic Starter

    Update

    First off let me thank everyone for the help. I think it's finally resolved.

    I don't think any one of the solutions resolved the problem singularly, but the combination suggested seems to have done the trick.

    Again, I thank everyone for their help.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.