Unwanted favorites

[jackc]

I to have unwanted favorites. When I try to organize, the unwanted favorites do not appear in the list. If I right click on the favorite the only option I have is close tool bar.

One strange thing happens when I open IE6 I have to try twice, first time I get a clock and then nothing, second time it opens. When I go to my task manager Iexplorer is there multiple times under processes tab, however only there once under application tab.

I've tried running ad-Aware se, and spybot it cleaned up some spyware however the unwanted favorites remain.

I'm also getting pop-up for the first time in years. These symtoms started 2 days ago.

I'm running Windows XP, my Symantec is up to date.

HELP

 

[howard_hopkinso]

Hello and welcome to Techspot.

I have moved your post to it`s own thread in our security and the web forum.

Go and read the Trojan Pakes and other nasties preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as an attachments into this thread, only after doing the above.


Regards Howard :wave: :wave:


This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[jackc]

link

When I click on your link I get page cannot be displayed.

 

[howard_hopkinso]

Sorry about that. Link fixed.

Regards Howard

 

[jackc]

Unwanted Favorites in IE 6

I currently have unwanted favorites in IE6. I have tried using the organize option however these favorites do not display themselves under that option. I've followed Howard's instructions "Trojan Pakes and other nasties, ..." but it does not seem to have fixed the problem. I'm also getting pop-up that I have never gotten before.

I protect my computer with Norton.

Any advise would be greatly appreciated.

 

[dahli]

Hello jackc,

Please attach a copy of your HijackThis log.

 

[jackc]

Attached is my hjt .log file

 

[dahli]

Go to Add/Remove Programs in Control Panel and uninstall SpywareBot and Window Search (if present). You may be given a security code to insert, do so and reboot when done.

If the entry is not there, run the below uninstallers (If your AV queries the download, allow it. It's not malicious).


http://lop.com/new_uninstall.exe
http://lop.com/toolbar_uninstall.exe

Reboot afterwards.

Attach a new HijackThis log.

 

[tomrca]

i would also suggest to get rid of funweb too

 

[jackc]

Dakli,
Can not use the links in your reply my security setting do not allow it.

Still have unwanted Favorites I can not delete, receiving pop-ups and second IE windows from time to time.

HELP

 

[tomrca]

Dakli,
Can not use the links in your reply my security setting do not allow it.
HELP

you obviously have your IE or firewall setting to high. if this is the case, then you wouldn't have been able to complete Howard's instructions. you will need to set the IE security lower so that your pc will be able to accept cookies. switch off your firewall if need be, for a short time.
unless you can acquire all the necessary programme's physically, i cant see how you can clean your pc thoroughly

 

[jackc]

I was able to go through Howard's instructions. When I clicked on your executible was the first time I got the security message.

Can you briefly explain what these executibles will delete and why these needs to be deleted?

 

[dahli]

http://atstake.com/avcenter/venc/data/adware.lop.html

You will need to lower your security settings and allow the tools I suggest to run otherwise I cannot help.

 

[jackc]

lower my settings and downloaded new_uninstall and toolbar_uninstall. Programs would not run got a message like, not a win 32 application.

Installed IE7, unwanted favorites have disappeared, however I still get pop-ups. My Norton Add Blocking and Pop-up blocking is on. My IE7 pop-up blocker is on. Not sure what to do!!!

jackc

 

[howard_hopkinso]

Threads merged.

Please post a fresh HJT log.

Regards Howard

This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[jackc]

Hi Howard,

Attached is my new log.

As I mentioned I'm now getting pop-ups and second windows opening. I have my pop-up blocker turned on in Norton and IE7, it does stop the pop-ups from this site.

Another issue: It now seems I have to unplug my rooter whenever I reboot my PC, as my PC is advising I have no network connection.

It seems these problems are taking over my life. Any help would be appreciated.

jackc

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

spywarebot

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

SpywareBot.exe
Byte bone.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://cache:8080<fix this, if you didn`t set this proxy yourself, or you don`t know what it is.

O4 - HKLM\..\Run: [thissurfstylewait] C:\Documents and Settings\All Users\Application Data\SixthBindThisSurf\Byte bone.exe

O4 - HKLM\..\Run: [spywarebot] C:\Program Files\spywarebot\SpywareBot.exe -boot

O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll (file missing)

O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll (file missing)

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: TruePass EPF 7,0,100,684 - https://blrscr3.egs-seg.gc.ca/applets/entrusttruepassapplet-epf.cab

O16 - DPF: TruePass EPF 7,0,100,717 - https://blrscr3.egs-seg.gc.ca/applets/entrusttruepassapplet-epf.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/FunBuddyIconsFWBInitialSe tup1.0.0.15.cab

O16 - DPF: {2CDA4FA9-4A2B-4925-8EB4-61BDDE935A84} (OutlookVerification.vOutlook) - http://transition.rogershelp.com/smtp/voutlook.cab

O16 - DPF: {3734A957-FBD5-4F87-A404-4289C6F3DDFF} - http://downloads.rogershelp.com/updates.cab

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Documents and Settings\All Users\Application Data\SixthBindThisSurf\Byte bone.exe


C:\Program Files\spywarebot Delete the entire folder.

Reboot into normal mode, turn system restore back on and rehide your protected OS files.

Post a fresh HJT log and let us know is you`re still having any problems.

Regards Howard

This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[jackc]

Hi Howard,

Attached is my new log.

I deletd the "R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://cache:8080" not sure if that is what you wanted me to do.

When I restarted the PC I did not have an network connection and I had to unplug my router and restart.

This help is much appreciated.

Jackc

 

[howard_hopkinso]

Your HJT log is clean.

Are you still having any problems?

Regards Howard

This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[jackc]

Howard,

My PC is running great. Thank you very much for your help.


Jackc

 

[howard_hopkinso]

That`s great news.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[jackc]

It seemsas though my PC has grind to a snails pace again.

Attached is my HJT log. Any help would be appreciated

 

[zipperman]

Do it here

I currently have unwanted favorites in IE6. I have tried using the organize option however these favorites do not display themselves under that option. I've followed Howard's instructions "Trojan Pakes and other nasties, ..." but it does not seem to have fixed the problem. I'm also getting pop-up that I have never gotten before.

I protect my computer with Norton.

Any advise would be greatly appreciated.

Open my computer,open C:
Open Documents and settings.choose user then Start menu,then Favorites.
Delete the ones you don't want.

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Video ActiveX Object

Close control panel.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\Video ActiveX Object\iesplugin.dll (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\Video ActiveX Object<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log.

Regards Howard

This thread is for the use of jackc only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[zipperman]

Did i miss something

Isn't this simpler ? You don't have to remove them all,thats just an example.
I edit these folders all the time.add,move or "delete unwanted".
Make a new folder.