Help needed removing spyware

  RamUK 18:15 26 Jun 04
Locked

Since I started to use P2P software (morpheus) I have been getting hit by spyware and adware. I have removed most using different free utilities but can not get rid of the part that has changed my home page to a shopping page.

On launch I then get a few pop ups telling me that I am infected with spyware. Somehow it seems also to override by Pop Up Killer which now has to be manually reactivated every time I turn the pc on.

I'm running XP with IE6.

  VoG II 18:16 26 Jun 04

Have you run Ad-aware and Spybot?

If so try CWShredder click here

  RamUK 20:07 26 Jun 04

Tried all those mate and it's still had no effect. I reckon that I have tried at least 5 different spyware programmes and also done virus check but nothing is helping.

I'm pulling my hair out here.

  carver 20:47 26 Jun 04

If I understand the workings of certain P2P sites when you download certain files you automatically agree to everything contained in that file and occasionally spyware and page setup are included, because you have agreed,it bypasses everything, unless someone knows better.

  cyberphobic 21:08 26 Jun 04

What I have done when all else fails is use "Hijack This" (a free download which you can find with a Google search) it shows you every programme in the registry which loads when you start your PC. It goes without saying that you need to be careful what you remove, but if you copy and paste your findings and then post them here I'm sure someone will assist. Anything untoward should be obvious, I used this process yesterday to remove the "isearch" toolbar which resisted all other attempts.

  keenan 21:19 26 Jun 04

Try 'Start Page Guard'

click here

  VoG II 21:35 26 Jun 04

Post a HJT log click here

  RamUK 11:25 27 Jun 04

Here's part of the log. I've no tried about 6 different things including ad-aware, spy-bot, cwshredder, spysweeper, xsoftspy and home page guard and nothing seems to work. I'm drifting into mild panic with a reformat looming.

I can't post it all but this appears to be the area of concern and that odfbe url is the one that it keep taking me too.



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odfbe.dll/sp.html#35759
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = click here
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = click here
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = click here
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\odfbe.dll/sp.html#35759
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://odfbe.dll/index.html#35759
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\odfbe.dll/sp.html#35759
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by BT Openworld
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = click here
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {F33B84B4-9B35-0407-3C12-7ABB0397E43F} - C:\WINDOWS\system32\netgc32.dll

  livewire 11:28 27 Jun 04

Try resetting your web settings Tools>Internet Options>Advanced>Reset websettings.

  RamUK 11:32 27 Jun 04

No such commande livewire, just scrolled through 3 times and it's not there mate.

  RamUK 11:41 27 Jun 04

A coup-le of other questions.

Will system restore help?

Why do I need need to manually reconfigure PopUP Killer each time I switch the pc on?

This thread is now locked and can not be replied to.

Huawei P10 review

1995-2015: How technology has changed the world in 20 years

An overview: What leading creative agencies are doing to improve diversity

New iPad, iPhone SE & Red iPhone 7 on sale now