Sign in with
Sign up | Sign in
Your question

Adware Removal Help!

Last response: in Windows XP
Share
Anonymous
June 19, 2005 1:01:36 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Help!

My XP Home (SP2 and all MS-issued updates) machine has fallen victim to "The
Adware Meanies" (not to be confused with "The Blue Meanies" of Sgt. Pepper
Fame).

Microsoft Antispyware Beta 1, Spybot Search and Destroy and Ad Aware SE
Personal (all updated) have all found the following Spyware on my machine:

Transponder.AbetterInternet
Transponder.AbetterInternet.Aurora
Transponder.AbetterInternet.DrPMon
ShopAtHome
IEPlugin

All three (3) Ad/Spyware removal programs find these threats, but they
cannot seem to remove them.
Spybot S&D comes the closest, and reports that upon the next bootup, Spybot
will clean and remove the offending critter. S&D does indeed run during the
following bootup, but reports finding no problems.

The other piece of bad news that I've noted is that System Restore no longer
operates. When attempted to run, System Restore reports that it cannot
restore (no matter what date I request) and that no System Changes have been
made.

An interesting behavior characteristic that I've noticed is an executable
located in C:\Windows\System32 that keeps changing names (to avoid being
cleaned and removed perhaps?)

Has anyone had successful experience in removing the aforementioned nasties,
or is my only salvation an XP re-load?

Thanks VERY much in advance for any assistance!

- Bill

More about : adware removal

Anonymous
June 19, 2005 1:01:37 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

"Bill Schmidt" <bschmidt105092@comcast.net> wrote in message
news:exFZH8MdFHA.4040@TK2MSFTNGP14.phx.gbl...
> Help!
>
> My XP Home (SP2 and all MS-issued updates) machine has fallen victim to
> "The Adware Meanies" (not to be confused with "The Blue Meanies" of Sgt.
> Pepper Fame).
>
> Microsoft Antispyware Beta 1, Spybot Search and Destroy and Ad Aware SE
> Personal (all updated) have all found the following Spyware on my machine:
>
> Transponder.AbetterInternet
> Transponder.AbetterInternet.Aurora
> Transponder.AbetterInternet.DrPMon
> ShopAtHome
> IEPlugin
>
> All three (3) Ad/Spyware removal programs find these threats, but they
> cannot seem to remove them.
> Spybot S&D comes the closest, and reports that upon the next bootup,
> Spybot will clean and remove the offending critter. S&D does indeed run
> during the following bootup, but reports finding no problems.
>
> The other piece of bad news that I've noted is that System Restore no
> longer operates. When attempted to run, System Restore reports that it
> cannot restore (no matter what date I request) and that no System Changes
> have been made.
>
> An interesting behavior characteristic that I've noticed is an executable
> located in C:\Windows\System32 that keeps changing names (to avoid being
> cleaned and removed perhaps?)
>
> Has anyone had successful experience in removing the aforementioned
> nasties, or is my only salvation an XP re-load?
>
> Thanks VERY much in advance for any assistance!
>
> - Bill
>
>

Try scanning with all three programs while running in safe mode. You may
also have to do it while logged in as each user (including administrator) in
turn.

Kerry
June 19, 2005 1:50:57 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Bill Schmidt wrote:

> Help!
>
> My XP Home (SP2 and all MS-issued updates) machine has fallen victim to "The
> Adware Meanies" (not to be confused with "The Blue Meanies" of Sgt. Pepper
> Fame).
>
> Microsoft Antispyware Beta 1, Spybot Search and Destroy and Ad Aware SE
> Personal (all updated) have all found the following Spyware on my machine:
>
> Transponder.AbetterInternet
> Transponder.AbetterInternet.Aurora
> Transponder.AbetterInternet.DrPMon
> ShopAtHome
> IEPlugin
>
> All three (3) Ad/Spyware removal programs find these threats, but they
> cannot seem to remove them.
> Spybot S&D comes the closest, and reports that upon the next bootup, Spybot
> will clean and remove the offending critter. S&D does indeed run during the
> following bootup, but reports finding no problems.
>
> The other piece of bad news that I've noted is that System Restore no longer
> operates. When attempted to run, System Restore reports that it cannot
> restore (no matter what date I request) and that no System Changes have been
> made.
>
> An interesting behavior characteristic that I've noticed is an executable
> located in C:\Windows\System32 that keeps changing names (to avoid being
> cleaned and removed perhaps?)
>
> Has anyone had successful experience in removing the aforementioned nasties,
> or is my only salvation an XP re-load?
>
> Thanks VERY much in advance for any assistance!
>
> - Bill
>
>

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper’s Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm

Do all scans in safe mode.

--
Rock
MS MVP Windows - Shell/User
Related resources
June 19, 2005 11:40:40 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Try this link. Lots of information here:

http://tinyurl.com/dvmv3
June 19, 2005 11:42:29 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

As for the restor problem: try turning off system restore delete all
temporary files including temporary internet files and reboot. Then turn
Restore back on and set a new restore point.
Anonymous
June 20, 2005 3:12:36 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Hi,

Try rebooting your computer in safemode without networking then use the MSFT
anti-spyware to do the scan again.
Sometimes, it does the trick

--
Kelvin Lin


"Bill Schmidt" <bschmidt105092@comcast.net> wrote in message
news:exFZH8MdFHA.4040@TK2MSFTNGP14.phx.gbl...
> Help!
>
> My XP Home (SP2 and all MS-issued updates) machine has fallen victim to
> "The Adware Meanies" (not to be confused with "The Blue Meanies" of Sgt.
> Pepper Fame).
>
> Microsoft Antispyware Beta 1, Spybot Search and Destroy and Ad Aware SE
> Personal (all updated) have all found the following Spyware on my machine:
>
> Transponder.AbetterInternet
> Transponder.AbetterInternet.Aurora
> Transponder.AbetterInternet.DrPMon
> ShopAtHome
> IEPlugin
>
> All three (3) Ad/Spyware removal programs find these threats, but they
> cannot seem to remove them.
> Spybot S&D comes the closest, and reports that upon the next bootup,
> Spybot will clean and remove the offending critter. S&D does indeed run
> during the following bootup, but reports finding no problems.
>
> The other piece of bad news that I've noted is that System Restore no
> longer operates. When attempted to run, System Restore reports that it
> cannot restore (no matter what date I request) and that no System Changes
> have been made.
>
> An interesting behavior characteristic that I've noticed is an executable
> located in C:\Windows\System32 that keeps changing names (to avoid being
> cleaned and removed perhaps?)
>
> Has anyone had successful experience in removing the aforementioned
> nasties, or is my only salvation an XP re-load?
>
> Thanks VERY much in advance for any assistance!
>
> - Bill
>
>
Anonymous
June 20, 2005 3:34:29 AM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

You can go the slow way and remove all the guff manually
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=45...

Then use HijackThis to verify the removal and check for any remnants
HijackThis direct download:
http://216.180.233.162/~merijn/files/HijackThis.exe

Apparently you can also go to the website of AbetterInternet and download
their removal tool as well but it seems a bit hypocritical. Have you really
removed it ?
http://www.abetterinternet.com/

How to protect yourself from these intrusions is the first place:
Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

How did this happen?
When your Security settings are "soft" these sites take advantage of this
and actually install software on your system without your knowledge or
consent. In other cases downloaded software comes bundled with other
"components" (spyware\adware) that you don't realize exists until you start
having problems or discover your browser has been hijacked.

--
Touch Base
Post back here on the result- good or bad

"Bill Schmidt" <bschmidt105092@comcast.net> wrote in message
news:exFZH8MdFHA.4040@TK2MSFTNGP14.phx.gbl...
> Help!
>
> My XP Home (SP2 and all MS-issued updates) machine has fallen victim to
> "The Adware Meanies" (not to be confused with "The Blue Meanies" of Sgt.
> Pepper Fame).
>
> Microsoft Antispyware Beta 1, Spybot Search and Destroy and Ad Aware SE
> Personal (all updated) have all found the following Spyware on my machine:
>
> Transponder.AbetterInternet
> Transponder.AbetterInternet.Aurora
> Transponder.AbetterInternet.DrPMon
> ShopAtHome
> IEPlugin
>
> All three (3) Ad/Spyware removal programs find these threats, but they
> cannot seem to remove them.
> Spybot S&D comes the closest, and reports that upon the next bootup,
> Spybot will clean and remove the offending critter. S&D does indeed run
> during the following bootup, but reports finding no problems.
>
> The other piece of bad news that I've noted is that System Restore no
> longer operates. When attempted to run, System Restore reports that it
> cannot restore (no matter what date I request) and that no System Changes
> have been made.
>
> An interesting behavior characteristic that I've noticed is an executable
> located in C:\Windows\System32 that keeps changing names (to avoid being
> cleaned and removed perhaps?)
>
> Has anyone had successful experience in removing the aforementioned
> nasties, or is my only salvation an XP re-load?
>
> Thanks VERY much in advance for any assistance!
>
> - Bill
>
>
Anonymous
June 21, 2005 2:35:30 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Thanks much for your assistance, everyone!

Unfortunately, booting my machine in safe mode and running Spybot S&D, Ad
Aware and MS's AntiSpyware packages did NOT fix my problem.

Following the excellent instructions and downloading and running the
Utilities at "Geek to Go" as suggested by Jack seems to have done the trick
(Thanks VERY much, Jack!).

While at my local computer store to pick up a second hard drive (with an XP
re-load in mind), the Clerk highly recommended using Mozilla's Firefox
Browser instead of MS's Internet Explorer, explaining that the Pirates and
Hijackers write and gear their stuff more towards the Microsoft Products, as
that apparently is what the majority of folks use.

Thanks also to everyone that offered assistance,

- Bill

"Jack" <Jack@nothome.com> wrote in message
news:o q2cRhSdFHA.2696@TK2MSFTNGP09.phx.gbl...
> Try this link. Lots of information here:
>
> http://tinyurl.com/dvmv3
>
Anonymous
June 21, 2005 3:31:11 PM

Archived from groups: microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support (More info?)

Not true anymore! With FireFox's popularity increasing, you will start
seeing more attacks targeted toward FireFox. Just make sure you run SP2 (if
you can) so as to enable Microsoft "first attempt" to add a pop-up blocker
to IE.




"Bill Schmidt" <bschmidt105092@comcast.net> wrote in message
news:o qzh75mdFHA.1040@TK2MSFTNGP10.phx.gbl...
> Thanks much for your assistance, everyone!
>
> Unfortunately, booting my machine in safe mode and running Spybot S&D, Ad
> Aware and MS's AntiSpyware packages did NOT fix my problem.
>
> Following the excellent instructions and downloading and running the
> Utilities at "Geek to Go" as suggested by Jack seems to have done the
> trick (Thanks VERY much, Jack!).
>
> While at my local computer store to pick up a second hard drive (with an
> XP re-load in mind), the Clerk highly recommended using Mozilla's Firefox
> Browser instead of MS's Internet Explorer, explaining that the Pirates and
> Hijackers write and gear their stuff more towards the Microsoft Products,
> as that apparently is what the majority of folks use.
>
> Thanks also to everyone that offered assistance,
>
> - Bill
>
> "Jack" <Jack@nothome.com> wrote in message
> news:o q2cRhSdFHA.2696@TK2MSFTNGP09.phx.gbl...
>> Try this link. Lots of information here:
>>
>> http://tinyurl.com/dvmv3
>>
>
>
July 2, 2005 5:28:14 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

the company responsable for the aurora adware has apparently also made a
program to remove it all: it can be found on myPCtuneup.com - then:
uninstall. after having run this program to get rid of aurora, spybot
search and destroy is missing programs. does anyone else have
experience with this, am i the only one suspecting that the fantastic
spyware removal program spybot search and destroy is actually itself
responsable for the aurora adware?


--
vioPosted from http://www.pcreview.co.uk/ newsgroup access
!