TechSpot

Unwanted favorites

By jackc
Oct 17, 2006
Topic Status:
Not open for further replies.
  1. I to have unwanted favorites. When I try to organize, the unwanted favorites do not appear in the list. If I right click on the favorite the only option I have is close tool bar.

    One strange thing happens when I open IE6 I have to try twice, first time I get a clock and then nothing, second time it opens. When I go to my task manager Iexplorer is there multiple times under processes tab, however only there once under application tab.

    I've tried running ad-Aware se, and spybot it cleaned up some spyware however the unwanted favorites remain.

    I'm also getting pop-up for the first time in years. These symtoms started 2 days ago.

    I'm running Windows XP, my Symantec is up to date.

    HELP
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Hello and welcome to Techspot.

    I have moved your post to it`s own thread in our security and the web forum.

    Go and read the Trojan Pakes and other nasties preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as an attachments into this thread, only after doing the above.


    Regards Howard :wave: :wave:


    This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. jackc

    jackc TS Rookie Topic Starter

    link

    When I click on your link I get page cannot be displayed.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Sorry about that. Link fixed.

    Regards Howard :)
     
  5. jackc

    jackc TS Rookie Topic Starter

    Unwanted Favorites in IE 6

    I currently have unwanted favorites in IE6. I have tried using the organize option however these favorites do not display themselves under that option. I've followed Howard's instructions "Trojan Pakes and other nasties, ..." but it does not seem to have fixed the problem. I'm also getting pop-up that I have never gotten before.

    I protect my computer with Norton.

    Any advise would be greatly appreciated.
     
  6. dahli

    dahli TS Rookie Posts: 28

    Hello jackc,

    Please attach a copy of your HijackThis log.
     
  7. jackc

    jackc TS Rookie Topic Starter

    attached is my hjt .log file
     

    Attached Files:

  8. dahli

    dahli TS Rookie Posts: 28

    Go to Add/Remove Programs in Control Panel and uninstall SpywareBot and Window Search (if present). You may be given a security code to insert, do so and reboot when done.

    If the entry is not there, run the below uninstallers (If your AV queries the download, allow it. It's not malicious).


    http://lop.com/new_uninstall.exe
    http://lop.com/toolbar_uninstall.exe

    Reboot afterwards.

    Attach a new HijackThis log.
     
  9. tomrca

    tomrca TS Rookie Posts: 1,051

    i would also suggest to get rid of funweb too
     
  10. jackc

    jackc TS Rookie Topic Starter

    Dakli,
    Can not use the links in your reply my security setting do not allow it.

    Still have unwanted Favorites I can not delete, receiving pop-ups and second IE windows from time to time.

    HELP
     
  11. tomrca

    tomrca TS Rookie Posts: 1,051

    you obviously have your IE or firewall setting to high. if this is the case, then you wouldn't have been able to complete Howard's instructions. you will need to set the IE security lower so that your pc will be able to accept cookies. switch off your firewall if need be, for a short time.
    unless you can acquire all the necessary programme's physically, i cant see how you can clean your pc thoroughly
     
     
  12. jackc

    jackc TS Rookie Topic Starter

    I was able to go through Howard's instructions. When I clicked on your executible was the first time I got the security message.

    Can you briefly explain what these executibles will delete and why these needs to be deleted?
     
  13. dahli

    dahli TS Rookie Posts: 28

  14. jackc

    jackc TS Rookie Topic Starter

    lower my settings and downloaded new_uninstall and toolbar_uninstall. Programs would not run got a message like, not a win 32 application.

    Installed IE7, unwanted favorites have disappeared, however I still get pop-ups. My Norton Add Blocking and Pop-up blocking is on. My IE7 pop-up blocker is on. Not sure what to do!!!

    jackc
     
  15. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Threads merged.

    Please post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  16. jackc

    jackc TS Rookie Topic Starter

    Hi Howard,

    Attached is my new log.

    As I mentioned I'm now getting pop-ups and second windows opening. I have my pop-up blocker turned on in Norton and IE7, it does stop the pop-ups from this site.:confused:

    Another issue: It now seems I have to unplug my rooter whenever I reboot my PC, as my PC is advising I have no network connection.

    It seems these problems are taking over my life. Any help would be appreciated.

    jackc
     
  17. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    spywarebot

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    SpywareBot.exe
    Byte bone.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://cache:8080<fix this, if you didn`t set this proxy yourself, or you don`t know what it is.

    O4 - HKLM\..\Run: [thissurfstylewait] C:\Documents and Settings\All Users\Application Data\SixthBindThisSurf\Byte bone.exe

    O4 - HKLM\..\Run: [spywarebot] C:\Program Files\spywarebot\SpywareBot.exe -boot

    O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll (file missing)

    O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll (file missing)

    O11 - Options group: [INTERNATIONAL] International*

    O16 - DPF: TruePass EPF 7,0,100,684 - https://blrscr3.egs-seg.gc.ca/applets/entrusttruepassapplet-epf.cab

    O16 - DPF: TruePass EPF 7,0,100,717 - https://blrscr3.egs-seg.gc.ca/applets/entrusttruepassapplet-epf.cab

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/FunBuddyIconsFWBInitialSe tup1.0.0.15.cab

    O16 - DPF: {2CDA4FA9-4A2B-4925-8EB4-61BDDE935A84} (OutlookVerification.vOutlook) - http://transition.rogershelp.com/smtp/voutlook.cab

    O16 - DPF: {3734A957-FBD5-4F87-A404-4289C6F3DDFF} - http://downloads.rogershelp.com/updates.cab

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Documents and Settings\All Users\Application Data\SixthBindThisSurf\Byte bone.exe


    C:\Program Files\spywarebot Delete the entire folder.

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log and let us know is you`re still having any problems.

    Regards Howard :)

    This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  18. jackc

    jackc TS Rookie Topic Starter

    Hi Howard,

    Attached is my new log.

    I deletd the "R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://cache:8080" not sure if that is what you wanted me to do.

    When I restarted the PC I did not have an network connection and I had to unplug my router and restart.

    This help is much appreciated.

    Jackc
     
  19. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Your HJT log is clean.

    Are you still having any problems?

    Regards Howard :)

    This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  20. jackc

    jackc TS Rookie Topic Starter

    Howard,

    My PC is running great. Thank you very much for your help.
    :)

    Jackc
     
  21. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    That`s great news.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  22. jackc

    jackc TS Rookie Topic Starter

    It seemsas though my PC has grind to a snails pace again.

    Attached is my HJT log. Any help would be appreciated
     
  23. zipperman

    zipperman TS Rookie Posts: 1,423   +7

    Do it here

    Open my computer,open C:
    Open Documents and settings.choose user then Start menu,then Favorites.
    Delete the ones you don't want.
     
  24. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Video ActiveX Object

    Close control panel.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\Video ActiveX Object\iesplugin.dll (file missing)

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Video ActiveX Object<Delete the entire folder.

    Reboot into normal mode and rehide your protected OS files.

    Post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  25. zipperman

    zipperman TS Rookie Posts: 1,423   +7

    Did i miss something

    Isn't this simpler ? You don't have to remove them all,thats just an example.
    I edit these folders all the time.add,move or "delete unwanted".
    Make a new folder.

    [​IMG]
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.