TechSpot

spyware issues.

By amazon_sephy
May 7, 2004
  1. Hi,

    Seems ive run into a nice spyware problem. This v2x.betterinternet thing wont go away and is multiplying on my computer like crazy. I now get pop ups even with a popup blocker. Ive used both adaware 6 with all updates, and spybot search and destroy 1.2 with updates. and both delete it. but with a quick check again tehre back already!! both reg keys and new program are being installed. Anyone know of anything i can do or is a format in order? Thx.
     
  2. SmAsHeR

    SmAsHeR TS Rookie Posts: 35

  3. amazon_sephy

    amazon_sephy TS Rookie Topic Starter Posts: 108

    thx, ran it but it still is there.
     
  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

    Look for a setting to empty the Pagefile when you shut down.
    If you can't find it, go to System/Properties/Advanced, make a note of the current virtual settings and then change them to 0.
    Ignore any warnings. Reboot, set them back to what they were.

    Also, in C:\"windows or winnt"\system32\drivers\etc is a file "hosts". Remove the read-only attribute, edit with Notepad, add a new entry "127.0.0.1 v2x.betterinternet" without the quotes. If there are more variants of that web-name, enter them all in the same way. Save the file, put the Readonly back.

    Check for entries in Start/Programs/Startup that should not be there. Rightclick/delete them
    Run MSConfig and look under Start for rogue entries.

    HTH
     
  5. Goalie

    Goalie TS Rookie Posts: 703

    I'd run msconfig and look through the startup section and remove ANYTHING that shouldn't be there, that way you know for sure the stupid thing isn't getting unloaded. I also suggest finding a virus scanner as well as spybot s&D.. Spybot has always worked for me.
     
  6. Shiney

    Shiney TS Enthusiast Posts: 223

    I agree witn realblackstuff, and would turn of system restore to clear the pagefile, the spam file may be in your saved restore file and just keeps coming back. You can re-enable sys restore after a reboot.
     
  7. Goalie

    Goalie TS Rookie Posts: 703

    Ahhh... I see what ya'll were saying now. And I also note you say you already used S&D. *smacks forehead*

    If running a virus scanner like AVG or TrendMicro's housecall and then running Spybot doesn't cure it, repeating those steps followed by the sys restore steps they mention will likely do a good number. I might leave the page file off for an extra reboot to help be sure windows isn't acting on you.

    Also, I vaguely recall there was a removal tool made especially for BetterInternet... one that gets updated like everyweek with the newest variants and all. I'll google for a while, let you know if I find it.
     
  8. amazon_sephy

    amazon_sephy TS Rookie Topic Starter Posts: 108

    sry about the lag time, i tried that spy sweeper, and removed stuff, i believe the v2x is gone, but sometimes it wont show up in the searchers, then a few days later it will show up, while that "may" be gone, i still get IE popups, and my default page is constantly be changed on me. The latest thing seems to be this websearch toolbar, which autoinstalls software into the program files folder, and something that is in memory called WToolsA.exe seems to want access with IE for some reason, but i dont recall that be a legit program, and i cannot shut that down from the task manager. another suspicious thing is the WSup.exe. anyone know what these are?
     
  9. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

  10. amazon_sephy

    amazon_sephy TS Rookie Topic Starter Posts: 108

    ah, good stuff, gonna try it, looks like im gonna have to set teh safe mode check box in msconfig, as i remember trying to use teh f8 method and the comp froze trying to go into safe mode, and yes i did wait long enough for it to show, so hopefully that wont be an issue, let you know how it worked out.
     
  11. amazon_sephy

    amazon_sephy TS Rookie Topic Starter Posts: 108

    well, all the stuff has been cleared out, after running all three spyware checkers i detect nothing remaining. however i still do get an ie popup even when im not using ie.... anyone know whats up with that?
     
     
  12. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

    If you can find the originating website from that popup, add it to the "hosts" file as I described earlier.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.