Spyware.Apropos.C....The NEW bugger on the Block!

[Yellow Trucker]

Been fighting this for a couple of weeks. Did what was posted below.
Ran Ad-Aware afterwards and found Apropos toolbar which rated level 10 spyware. Removed it and so far so good. Tried everything I know to get rid of this, so far the below posting seems to have worked. I stumbled on this site looking for an answer, think I may have found it. Thank you.


Originally Posted by illukka
wilders no loger does hijackthis logs, but i can still give you instructions on how to remove this infection

a spyware expert, Swandog46, has developed a removal tool for it

use it like this:

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode

[TexChamp]

Unfortunately the fix by swandog46 does not work. I have tried it several times.
Norton is useless.
I need a solution that will not require jacking around with the registry manually.
Help!

[illukka]

TexChamp
what tells you that you have apropos rootkit?
doeas a scanner detect it or what?

First, completely disconnect from the internet (I unplugged the eathernet cable out of my computer) then run a full system scan with Norton Antivirus. If you only have spyware.apropos.c then the sweep should return 3-4 results. Go to quarantine and delete.

[TexChamp]

Every Norton scan shows the Spyware.
Nortonis unable to remove the spyware.
Their solution is for me to go in and remove several registry lines that they cannont even clearly identify. I am not willing to do that.
I have downloaded several spyware detectors and none of them will detect much less remove apropos.c .

[TexChamp]

Also, dantsmith, Norton 2006 will not allow me to do anything to the spyware except look at their proposed "solution" which is no solution at all.
I'm supposed to be able to find the location but Norton will not allow that either and they have no means of contact for me to find out how.

[illukka]

hi
ok TexChamp, now it is hijackthis time
(cheers bubba )

TexChamp, go here;
http://www.wilderssecurity.com/showthread.php?t=12516
download hijackthis from the link there , and post its log here

instructions on how to do it here
http://www.tomcoyote.org/hjt/

for anyone else wishing to post their hjt log see this topic
http://www.wilderssecurity.com/showthread.php?t=42149

Please note that from time to time a HijackThis log may still be requested by a moderator (or specially titled forum expert) for use in other types of problem diagnosis. Only those logs requested by a Wilders team member will be worked on in forum.

i am now requesting a logfile from TexChamp, all other hjt logs will be removed

TexChamp, you can download these tools in advance for possible use later:

http://www.f-secure.com/blacklight/
accept the agreements, download the beta and install it, dont scan or fix anything with it until requested as legitimate items are listed in it too !!
and

http://swandog46.geekstogo.com/aproposfix.exe
we may need these programs later

[controler]

I forgot to mention in my former post that BoClean does get this but not all files associated. The files left over are harmless however.

Go to this internet address. There is a lot of discussion on this site and helpful suggestions as to how to handle this bug. I too have it and no matter what I have done, it just keeps popping back up.

Originally Posted by A friend

Go to this internet address. There is a lot of discussion on this site and helpful suggestions as to how to handle this bug. I too have it and no matter what I have done, it just keeps popping back up.

forums.whirlpool.net.au/forum-replies-archive.cfm/421165.html.

OOPS, forgot to put in the address.

[choregurl]

I wanted to thank you for the Apropos fix. Thanks so much! I was tearing my hair out trying to get rid of that piece of s**t! My computer is much happier now.