Korean Job Discussion Forums

Alyallen

I noticed yesterday that while waiting for pages to load here on Dave's, I would be sent to a site called www.ads234.com. I would then be shown some stupid advertisement while waiting for the page to load.

I'm wondering if this is new to Dave's or if I'm the only on seeing this? Most importantly, how do I get RID OF IT???

Thanks,
AlyAllen

the_beaver · Joined: 15 Jan 2003

Run adaware

Alyallen · Posted: Thu Jul 29, 2004 8:34 pm Post subject:

the_beaver · Joined: 15 Jan 2003

Dalton · Joined: 26 Mar 2003

I found some references to it when I did a search but no definitive removal method. Basically victims were asked to run hijack this and then told what items to delete.

I'm still looking but you can go here

cexx.org

Register, log in and ask there or save what's important and reload your OS.

Basically you will be deleting reg entries and programs residing in various places on your PC. HiJack This gives you a list of everything running on your PC. You delete the things that relate to the trojan. If you don't know what to delete then the people on the board at cexx.org will tell you.

Meanwhile if I find a definitive solution I'll post the link for you. Good luck.

barrybrown · Joined: 18 Apr 2004

Dalton · Joined: 26 Mar 2003

I'm not an expert. Spyware creates registry entries for itself as well as putting little programs all over your computer. You have to remove the registry entries and the programs to remove the trojan, BHO, spyware whatever. I don't know why but the spyware no longer shows up on/in your boot.ini (or whatever the windows startup files are called) file, after a reboot, after it's all removed.

I am not an expert but PC-cillin reports often refer to spyware writting itself to start up files like boot.ini but the removal instructions never seem to involve opening this file and deleting the instruction. Perhaps it's related to registry entries? Maybe the files in question are written anew with each boot up by checking the registry entries. PC-Cillin and others often contain instructions to remove registry entries in HKCU/software/microsoft/windows/current version/run. On my PC that area contains four programs that I know start up when my PC boots.

I often see two - four registry entries and two - four programs to delete (in those PC-Cillin reports). Don't know why.

the_beaver · Joined: 15 Jan 2003

Zenpickle · Joined: 06 Jan 2004 Location: Anyang -- Bisan

Personally, I find SpyBot catches more stuff than AdAware.

Dalton · Joined: 26 Mar 2003

I use them both. I also use spyguard, window washer, zone alarm, coolweb shredder, Hijack This and an anti virus. Laughing

Spybot's immunity and Teatime are nice extras.

Last time I had something trying to change all my IE settings both teatime and Spyguard told me immediately and prevented them from doing so. Coolweb Shredder, Spybot and Adaware all found stuff but Adaware was the one that dealt the death blow.

Hijack This is great if you're familiar with what's running on your computer. You can quickly spot anything new. Let me know here if there's anything you want a link to.

Did the OP solve his problem? It's not clear here whether he did or not.