Korean Job Discussion Forums

Alyallen

I noticed yesterday that while waiting for pages to load here on Dave's, I would be sent to a site called www.ads234.com. I would then be shown some stupid advertisement while waiting for the page to load.

I'm wondering if this is new to Dave's or if I'm the only on seeing this? Most importantly, how do I get RID OF IT???

Thanks,
AlyAllen

the_beaver · Joined: 15 Jan 2003

Run adaware

Alyallen · Posted: Thu Jul 29, 2004 8:34 pm Post subject:

the_beaver · Joined: 15 Jan 2003

Dalton · Joined: 26 Mar 2003

I found some references to it when I did a search but no definitive removal method. Basically victims were asked to run hijack this and then told what items to delete.

I'm still looking but you can go here

cexx.org

Register, log in and ask there or save what's important and reload your OS.

Basically you will be deleting reg entries and programs residing in various places on your PC. HiJack This gives you a list of everything running on your PC. You delete the things that relate to the trojan. If you don't know what to delete then the people on the board at cexx.org will tell you.

Meanwhile if I find a definitive solution I'll post the link for you. Good luck.

barrybrown · Joined: 18 Apr 2004

Dalton · Joined: 26 Mar 2003

I'm not an expert. Spyware creates registry entries for itself as well as putting little programs all over your computer. You have to remove the registry entries and the programs to remove the trojan, BHO, spyware whatever. I don't know why but the spyware no longer shows up on/in your boot.ini (or whatever the windows startup files are called) file, after a reboot, after it's all removed.

I am not an expert but PC-cillin reports often refer to spyware writting itself to start up files like boot.ini but the removal instructions never seem to involve opening this file and deleting the instruction. Perhaps it's related to registry entries? Maybe the files in question are written anew with each boot up by checking the registry entries. PC-Cillin and others often contain instructions to remove registry entries in HKCU/software/microsoft/windows/current version/run. On my PC that area contains four programs that I know start up when my PC boots.

I often see two - four registry entries and two - four programs to delete (in those PC-Cillin reports). Don't know why.

the_beaver · Joined: 15 Jan 2003

Zenpickle · Joined: 06 Jan 2004 Location: Anyang -- Bisan

Personally, I find SpyBot catches more stuff than AdAware.

Dalton · Joined: 26 Mar 2003

I use them both. I also use spyguard, window washer, zone alarm, coolweb shredder, Hijack This and an anti virus. Laughing

Spybot's immunity and Teatime are nice extras.

Last time I had something trying to change all my IE settings both teatime and Spyguard told me immediately and prevented them from doing so. Coolweb Shredder, Spybot and Adaware all found stuff but Adaware was the one that dealt the death blow.

Hijack This is great if you're familiar with what's running on your computer. You can quickly spot anything new. Let me know here if there's anything you want a link to.

Did the OP solve his problem? It's not clear here whether he did or not.

Alyallen · Posted: Sun Aug 01, 2004 9:56 pm Post subject:

Dalton · Joined: 26 Mar 2003

Here there are.
Don't forget to go to the help and info links. They should help you get rid of it. Search their forums or register and ask for help. There are other links on those sites for spyware scumware removal plus some reviews, hints and help for using the stuff and keeping crap off your pc. Good luck.

Free:
This link is to CNets' most popular downloads page. You'll see
AdAware, Zone Alarm, Mozilla Firefox, Spybot Search and Destroy
AdAware and Zone Alarm
I think CNet and ZDNet are associated with PC World Magazine. Tons of software to dl and articles. Don't register for weekly articles from them. Major Spam.

Spybot Search and Destroy
Coolweb Shredder
note : the CWS author hasn't been updating as much lately.

HiJack This
Spyblaster
Spyware Guard

Not:
Window Washer
Scroll down and find Window Washer 5.1 on the right. DL it and open and read the .nfo file(s) with notepad. The rip is built into the program. Just install it. Run it every time you go off line.

Info and help sites:
Prevention article from cexx.org
spywareinfo.com
cexx.org

This is a lot of stuff. You have to get into the properties for each one too. For instance Ad Aware has a setting to eliminate the reg entry for anything it finds. Ad Aware will disable a lot of free stuff that comes with spyware and adware. Like free DivX and Download accelerator. I let it and learn to live with out that stuff. The Window Washer link also has Power DVD 5.0 and a lot of graphics software.

Edit: It is important to note that just dling and running all this stuff won't necessarily remove the malware. There is new bad stuff all the time. You really need to go to the cexx forum for example for a solution. If the malware isn't new then spybot, ad aware and coolweb search may do the trick. It has for me everytime except the last time when I gave in and reinstalled. I'm impatient some times.

jazblanc77 · Joined: 22 Feb 2004

Don't forget Spysweeper, it has picked up a lot on my computer that adaware, spybot, spyblaster and the rest were unable to catch.

Alyallen · Posted: Wed Aug 04, 2004 1:21 am Post subject:

Hi all,

A small update. I have tried all the various programs but they were unable to help with my annoying problem. So, I've taken my problem to cexx.com as suggested by Dalton (THANK YOU!), so I'm waiting for one of those computer gurus to help my sad self out.

Thanks again for all your suggestions,
Alyson

jazblanc77 · Joined: 22 Feb 2004

Posting HijackThis logs on cexx.org is usually the way I go after I have exhausted all of my scanning programme capabilities. If the problem still persists after you run a fix with HijackThis, I would recommend asking someone with help on editting your registry (thought this is only a last resort).