Re: toolbar virus???

From: John W. (jwilfong_at_noaolspam.com)
Date: 07/16/04 

Date: 15 Jul 2004 16:41:14 -0700

William Meyer wrote:

> On 07/02/04, Iman L Crawford said:
>
> > Get adaware, spybot, and CWSShredder. Run all of them to clean up
> > your machine and then ditch IE. Even the homeland security
> > department has recommended not using it anymore.
>
> I finally got HiJackThis, and it located the evil registry entry that
> kept reviving the toolbar. Nothing, though, has so far been able to
> discover what keeps hijacking the home page setting.

I was having some similar problems on my kids laptop. Turned out to be
synchronization. A website somehow installed itself to be saved offline
and resync'd itself at 8:00am every morning. Just when I thought I had
everything cleaned up, there it was again.

This is everything I did to clean up the infestation...

Go to McAfee and download their CleanBoot 1.0 Beta. This allows you to
create a CD and boot from it. It then scans your hard drive for
trojans. Worked great. Beta is free. I believe I found it in the
download section.

Run Ad-Aware and any other tools you like. I found NoAdWare to work
good for me on removing toolbars. There is a link to download it here:
http://www.free-web-browsers.com/remove-toolbar.shtml It requires a
registration fee to actually remove what it finds. It provides a list
of what it found and where it is, whether in the registry or in a
folder. What I did was use this list and manually deleted what it
found. If you have a large infestation you may just want to pay the $29
(??? can't remember for sure) and let it do it. I'm sure your time is
worth more than this small amount.

In IE go to Tools/Synchronize and look what may be there. Click on
anything suspicious and click properties. In the resulting dialog
uncheck the sync checkbox.

Now go to Tools/Internet Options select the Advanced tab and uncheck
anything that says 'Install on demand ...' and 'Enable offline items to
by synchronized...'.

Finally to make sure something isn't coming or going without me knowing
it I also installed ZoneAlarm. It has been catching a ton of popups,
ads, web bots, private headers.

My kids laptop now works great again. 

-- 
-john
"The worst bankrupt in the world is the person who has
lost his enthusiasm."
-- H.W. Arnold
Loading