Archived from groups: microsoft.public.windowsxp.newusers (
More info?)
On Sat, 28 May 2005 17:06:15 -0500, Jim <wdxp@cox.net> wrote:
>Can anyone tell me how to get rid of this junk? McAfee deletes it but
>it keeps coming back as;
>
>c:\windows\ceres.dll
>
>
>It was put there by a virus scumbag called abetterinternet.com.
>
>
>How can I get rid of it?
>
>Jim
I found this info at:
http://www.pro-networks.org/forum/about49533.html
and it seems to have worked for me with XP Pro. Don't forget to get
rid of all instances of buddy.exe, it apparently goes along with
ceres.dll.
Jim
=====================================================
This is a very difficult bit of spyware to remove. It involves running
various removal tools and/or editing the registry.
CERES.DLL has the following properties:
Company name: Ceres
Internal name: Ceres
Comments: www.abetterinternet.com
Legal copyright: Copyright © 2004
Legal trademarks: None
Original filename: Ceres.dll
Product name: Ceres
File description: www.abetterinternet.com
WARNING: Editing the registry incorrectly can cause serious problems
that may require you to reinstall your operating system. We cannot
guarantee that problems resulting from the incorrect use of Registry
Editor can be solved. Use Registry Editor at your own risk.
The following solution can be found HERE
========================
Removing Adware Entries from the Registry
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>
In the left panel, locate and delete the keys:
CeresDll.CeresDllObj.1
CeresDll.CeresDllObj
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>
In the left/right panel, locate and delete the entry/key:
{00000049-8F91-4D9C-9573-F016E7626484}
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>Interface>
In the left/right panel, locate and delete the entry/key:
{BB0D5ADC-028D-4185-9288-722DDCE2C757}
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>TypeLib>
In the left/right panel, locate and delete the entry/key:
{92DAF5C1-2135-4E0C-B7A0-259ABFCD3904}
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>
In the left/right panel, locate and delete the entry/key:
Ceres
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>
CurrentVersion>explorer>Browser Helper Objects>
In the left/right panel, locate and delete the entry/key:
{00000049-8F91-4D9C-9573-F016E7626484}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>CLASSES>
In the left panel, locate and delete the keys:
CeresDll.CeresDllObj.1
CeresDll.CeresDllObj
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>CLASSES>CLSID>
In the left/right panel, locate and delete the entry/key:
{00000049-8F91-4D9C-9573-F016E7626484}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>CLASSES>Interface>
In the left/right panel, locate and delete the entry/key:
{BB0D5ADC-028D-4185-9288-722DDCE2C757}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>CLASSES>TypeLib>
In the left/right panel, locate and delete the entry/key:
{92DAF5C1-2135-4E0C-B7A0-259ABFCD3904}
In the left panel, double-click the following:
HKEY_USERS>.DEFAULT>Software>
In the left/right panel, locate and delete the entry/key:
Ceres
Close Registry Editor.
Unregistering the Adware BHO
To completely remove this adware, close all Internet Explorer windows
and perform the procedure below. You will need the path of the adware
identified earlier.
Open a command prompt. To do this, click Start>Run, type CMD, and
press Enter.
In the command prompt, type the following, then press Enter:
CD <adware path>
Still in the command prompt, type the following, then press Enter:
REGSVR32 “CERES.DLL” /U
Click Yes or OK when prompted.
Facebook
Twitter
Instagram