adware/trojan

Discussion in 'Trojan Defence Suite' started by daf89, Apr 5, 2004.

Thread Status:
Not open for further replies.
  1. daf89

    daf89 Guest

    Recently ive been getting a lot of popup ads eventhough i have an IE popupkiller. A search bar call "Road Ball Safe" has been installed to my IE as well. I downloaded Spybot S&D and AdAware in hopes of getting rid of this searchbar and the popups.
    I ran both and deleted the infected files they came up with. But the problem persisted. SO i downloaded a progam called NoAdware v2.0. It scanned my system and came up with a load of bad files/trojans. Because im only using the unregistered version i have to manually delete the files by going to teh locations it supplied me with, such as
    C:\\WINDOWS\System32\wtcpl.cpl

    But then there are other locations that are :
    HKEY_LOCAL_MACHINE\Software\classes\clsid\{8734......7df}

    Or even a location as simple as "lop" or "Gator"

    How can i delete these files? If they are remote can they be purged?

    Thanks alot
    -daf
     
  2. snapdragin

    snapdragin Administrator

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi daf89, and welcome.

    It sounds like you still have some spyware on your computer. Could you follow the instructions
    Here
    . Since you already have Spybot S&D and AdAware, skip to step 2 for instructions on downloading HijackThis and posting a log.

    Do not fix anything in HijackThis yet, most of what it will list will be harmless. Wait until someone has had a chance to review it and they will advise you what to delete, and how. :)

    Regards,

    snap
     
  3. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    What you have described is a LOP toolbar, that always installlls along with a load of other rubbish, so please follow Snapdragon's advice and post a log in the Hijack forum

    The No adware program is not efficient and has a lot of false positives, I would never reccomend it.
     
Thread Status:
Not open for further replies.