Re: eZula TopText removal

[oldfogie@nospam.net]

OK, ITS BACK !!!!!

WTF is going on here? Everything looked fine, but then after a reboot
its back!! I then ran spybot again and it removed it. But then when
spybot asks to reboot, it comes back after the reboot is over.

Somehow, there's something that reinstalls it on reboot. Spybot cleans
it out, but then it comes back.

Is there some kind of program that I can install that will monitor
what's coming into my computer from the web. When I disconnect my
cable modem and get rid of ezula, everything is fine after multiple
reboots. But when I reattach cable and reboot, that sucker gets put
right back on my computer.

This IS DRIVING ME CRAZY!

[siljaline]

On Tue, 01 Jul 2003 22:08:59 GMT, oldfogie@nospam.net wrote:

>WILL SOMEONE PLEASE FOR GODS SAKE HELP ME OUT !!!

Go to:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location: Spyware and Hijackware Removal Support.
http://www.spywareinfo.com/forums/in...74&act=SF&f=11

Sign in, then copy and paste both files in your message.

HTH


--
siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_

[oldfogie@nospam.net]

Many thanks for your interest in me solving this problem. I found two
more ezula related files in c:\windows\prefetch:
ezinstall.exe-33113f94.pf
ezstub.exe-17641339.pf
which I deleted. I believe the prefetch files are some kind of
reloader. Anyway, I also used msconfig to discover that mmod.exe was
in the start-up list. I disabled that. Then I went back over my
harddrive with a search and removed any ezula associate files. Then I
ran spybot again, which found and cleaned up ezula. I pulled the cable
modem just to be safe and rebooted. Spybot restarted and finished the
clean-up. I then rebooted several times and she's clean.
Then I reattached the cable feed and rebooted. This time no ezula. I
rebooted once more. No ezula.
Is this finally cleaned out. I'm keeping my fingers crossed. I will
keep your hijack this info close by if it comes back. If you don't
hear from me within a day, the demon has been exorcised.
Thanks again.
Somebody should save this thread somewhere for any others who get
possessed.




On Tue, 01 Jul 2003 18:39:51 -0400, siljaline <siljaline@invalid.com>
wrotF:

>On Tue, 01 Jul 2003 22:08:59 GMT, oldfogie@nospam.net wrote:
>
>>WILL SOMEONE PLEASE FOR GODS SAKE HELP ME OUT !!!
>
>Go to:
>http://www.spywareinfo.com/~merijn/files/hijackthis.zip
>
>Unzip, double-click "HijackThis.exe" and Press "Scan".
>
>When the scan is finished, the "Scan" button will change into a "Save Log"
>button.
>Click: "Save Log" (generates "hijackthis.log")
>
>Next, HijackThis | Config [button] | Misc Tools [button]
>Click: Generate StartupList log [button] (generates "startuplist.txt")
>
>Next, go to the below location: Spyware and Hijackware Removal Support.
>http://www.spywareinfo.com/forums/in...74&act=SF&f=11
>
>Sign in, then copy and paste both files in your message.
>
>HTH

[siljaline]

On Tue, 01 Jul 2003 22:57:38 GMT, oldfogie@nospam.net wrote:

>Thanks again.
>Somebody should save this thread somewhere for any others who get
>possessed.

You're welcome, the instructions for Hijack This are here:
http://www.tomcoyote.org/hjt/ Bookmark it for future infestations.


--
siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_