I need help removing some Adware/Spyware...

Well, a few weeks a go I run S&D on my Windows 2000 Professional computer, and some items didn't want to delete so today I run into safe mode and run S&D and I get the same errors as before:

Quote:

---

The application or DLL C:/Windows/WT/webdriver.dll is not a valid Windows image. Please check this against your installation diskette.

---

Quote:

---

The application or DLL C:\windows\wt\wtupdates\wtwebdriver\files\3.3.1.001\legacy\webdriver.dll is not a valid Windows image. Please check this against your installation diskette.

---

Quote:

---

The application or DLL C:\windows\wt\wtupdates\wtwebdriver\files\3.3.1.001\legacy\wt3d is not a valid Windows image. Please check this against your installation diskette.

---

This error message comes up 10 times:

Quote:

---

The dynamic link library WDNEGINE.dll could not be found in the specified path C:\Program Files\Spybot - Search & Destroy;.;C:\WINDOWS\system32;C:\Windows\System;C:\WINDOWS;C:\PROGR~1\COMMON~1\AUTODE~1;C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\WBEM;C:\Program Files\NMapWin\\bin;;C:\PROGRA~1\COMMON~1\AUTODE~1.

---

Can anyone help me out here I'm clueless. And yes this is the latest version of S&D.

The Following are the ones that could not be removed because of the above errors:
Alexa Related
DSO Exploit
FunWeb
MainPean
ShowBehind
SubSeven
WildTangent

Can I quickly ask why you got SubSeven on your comp?

Would like to know that myself...

UPDATE: Removed Alexa with Ad-Aware

Quote:

---

Originally posted here by Raion

The Following are the ones that could not be removed because of the above errors:
Alexa Related
DSO Exploit
FunWeb
MainPean
ShowBehind
SubSeven
WildTangent

---

What the hell were you doing? Surfing the web with IE and Active X downloading anything as you went about your merry way or did you download that crap and infect yourself?? =\

Looking at the errors, I'm guessing that wt would be Wild Tangent and thier crap, you can manually delete that whole directory if you don't want it and then let Ad-aware take of the keys and minor details.

And for the DSO Exploit, get some kind of AV and update it, then that sucker should be easy to take care of... but how the hell did you get so much crap?

rotflmao, I haven't formatted this computer in over 4 years..4 years a go I used kazaa, get where I'm going here?

Hijackthis, S&D (latest, they made big changes recently) and Ad-aware should fix it....not in that order though, Hijackthis pretty much kills everything, except you have to do it manualy.

if all else fails.... Format :D

It's just spyware I'm not gonna format over spyware :p especially not loose my 4yr record :D

Did you clean up/delete those kazaa files? Or scan them? Because that's probably the problem. You can contract loads of virii and the like from p2p application's such as kazaa.

Hopefully I dont jacked for this but as I have said before your virus issues aren't unique; stop acting like it. There is no need to create a new thread just so you feel special and important, you aren't! I wrote a tutorial/rant on dealing with viruses and spy-ware, it also has a message for people like you here. Enjoy the read and stop posting these threads.

-Cheers-

The DSo exploit is a current false positive that Spybot throws.
WildTangent can be removed from add/remove programs.
The other malware can be removed with one of these online scans:
*PandaSoft
*TrendMicro
or by running
* Adaware
* Spybot

If your problems persist, then you could post a HJT log so someone that knows how to read the logs can help.

EDIT: And to jump on Spyder's bandwagon, you may want to learn how to read logs, because p2p brings you many of these problems, and unless you learn how to protect your system, you will need to get good at it. :D

EDIT2: And to reinforce Noia's assessment, it will kill everything..and I mean everything. Your system will be nuked if you are not careful.

I've run into odd errors out of SpyBot on fluke occasions myself. Speaking of which, here's another strange one:

Just the other day I was fixing a friend's XP machine that got slammed hard with worms and spyware (out-of-date AV, no firewall, no spyware/adware protection...you can imagine the results...was fun to play with though). Got it all cleaned up no prob, but when I downloaded the new Spybot, it acted strange. It keeps showing me the same updates to download over and over again, despite my having already downloaded and installed them. However, this doesn't happen on any other machine, including my own XP, just hers. Not sure what would cause that fluke in updating...

Not to get off topic, but PM: What the **** is wrong with you? The man has a problem with some file's on his computer and he's asking how to remove them because it's causing a problem for him. No need to act like a dick. Geesh.

Quote:

---

Not to get off topic, but PM: What the **** is wrong with you? The man has a problem with some file's on his computer and he's asking how to remove them because it's causing a problem for him. No need to act like a dick. Geesh.

---

I don't mind helping, but these threads are always because of a lack of looking. Had he searched AO for anti-virus information or something of the like and came up with nothing (which isn't so) then I would be like ok, but he didn't. People need to help themselves too.

-Cheers-

Sure, but if that's the case, why come to AO period? Just use google all the damn time and you could search all you want, right? Sorry, but thas why this is a community and we post to ask questions and help other's. Even if it's been repeated (which his DIRECT case, hasn't).

His error messages were NOT covered in your tutorial, and that's what his initial post began with.

That's the one thing I encounter with Spybot that's a bit odd: the occasional flukes such as that and the one I mentioned above. Not really significant but I wish I knew what was causing that.

Thanks for defending me while I was gone Spyder :)
PM: Remember the old saying "if you don't have anything good to say don't say anything at all" hence why I don't get negged very often.
And at the moment running trend microsystem's online AC scanner and about to download HJT if that fails.

EDIT: Angelic thanks also :p

In addition, 95% of the people that have problems with hijackers and such don't have very much knowledge of their systems, and some guidance is required (otherwise they wouldn't have the problem in the first place) . By allowing them to ask questions, and holding their hands a little, the community can help them become a little more comfortable with their systems. By showing them what to do to help protect themselves means there is one less person to become infected, and maybe they will gain the ability to help someone else.

Quote:

---

Thanks for defending me while I was gone Spyder

---

What are big brother's for? ;)

lol Sypder
For all those wonder, AV scan is still going x.x so far 10 infected files :eek: all Trojans. Waiting for the scan to finish so I can remove them.
EDIT: TROJ.SWIZZOR.AQ? Anyone heard of it?

Wow you must have quite a bit of file's on your computer. It's been around 2 hour's since the scanning started, no? Heh, I've never had to wait that long.

32,000+ scanned files so far....not too much

Ran the AV scan (left it on while I went to work) and deleted all the trojans (none of which were subseven?) and my HJT logfile is attached, saved it as txt so you won't have to download it.

Angelic Knight..

I had the same problem with S&D with the download. After meddling with it I realised that either there was a problem with the update file from that location or somehow it wasn't installing properly. I managed to solve it but choosing another update server instead. My update was then downloaded and installed without the same problem.

Hope this helps you.

Your log looks really good, except for a few bho's:

You porbably should put HJT in it's own folder, or you are going to have backups littering your desktop.

Put a checkmark next to the following in HijackThis. Make sure all other windows and browsers are closed before clicking on “Fix Checked”

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchweb2.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchweb2.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
O2 - BHO: (no name) - {72557F9F-13AE-44C9-B3D7-5091B599027C} - C:\WINDOWS\system32\smail11.dll
O2 - BHO: (no name) - {BF55256A-3B3B-11D2-B05B-000001145917} - (no file)
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialer...ecomendada.cab


Go to your add/remove programs and remove Wild Tangent, and also check to make sure there are no dialers installed.

Reboot and submit a new log.:D

Thanks groovicous, this is the new log. Going to run S&D again now.

:oops:

Did I look at the wrong log before? Everyone names their log hjt and I must have gotten it confused..let's try this again (either that, or you have hijackers fighting with each other):

Boot into safe mode before doing the following....

Put a checkmark next to the following in HijackThis. Make sure all other windows and browsers are closed before clicking on “Fix Checked”

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm


Reboot. If I might make a recommendation, many people consider Messenger Plus as Spyware, and most of us that deal with these logs recommend that it be uninstalled. I'll let you Google for it and draw your own conclusions though.

Also, next time you post your log, do it as a hidden post, or name your log to your user name, and number it, so I can keep it straight. :D

heh, I didn't install MSN Plus, my brother did and if I un-install it i get questioned, if i get questioned I get annoyed (as i don't like answering stupid questions) and if i get annoyned--well you get the picture. Will boot into safe mode and post my log..hidden :p

EDIT: Just realized something...I get different results each time I run HJT why? Going to boot into safe mode in a minute and post a log from there. (Altough I honestly hate restarting so it might take a while)

Ususally when you get different results, it is because all the hijackers and spyware are fighting for control. As you get rid of one, another one pops up, so sometimes it takes a while to get rid of all of it.

found a good new cleaner out there that evan cleans about:blank try http://www.adwareaway.com

Simple fact is that no tool removes all malware. Even after running the tools, there is always manual removal. It's just the way it is. I personally think one should be more responsible than just suggesting one tool will fix everything...I mIght check it out just for giggles though. I don't see where it is doing anything new, but then again, I'm a little biased. :D