eZula TopText removal

[oldfogie@nospam.net]

I think the wonderful folks who produce this spyware/virus have
adjusted it again so that it cannot be removed/uninstalled.

I've tried:
1) Ad-aware using the latest ref files
2) Deleting the reg entries listed in earlier posts here
3) Deleting the ezula folder in c:\program files (after having to
change its read-only status)
4) Using winxp's uninstall utility in control panel (how
"coincidental" that doing this sends you right to the toptext webpage,
where I suspect it can be re-sent to your computer)
5) deleting every file an "ezula" or "zula" search turned up on my
harddrive
6) deleting every instance of stub.exe or ezstub.exe

After shut-down/re-start, the ezula folder re-appears in c:\program
files.

I'm baffled! I've spent 2 hours of my spare time trying to get rid of
this %&+#)%)* thing with no success.

My last hope will be to use GoBack to revert my harddrive to a time in
the past, but it will mean losing what I've installed since then and
backing up email, docs, address book, etc etc etc.

Can someone help me who has removed ezula/toptext recently? TIA.

[oldfogie@nospam.net]

Well, I'm still at it an hour later trying to get rid of this crap. In
looking over GoBack's list of files I see that there is a file named
ttil_sbc.exe located in C:\windows that apparently creates another
file, ezinstall.exe also in C:\windows, which starts up every time my
computer is restarted and installs the ezula folder in c:\program
files.
There's a file, mmod.exe in that folder which prevents you from
deleting the ezula folder. You have to disable it with task manager
first.
Still, though, after doing all these things, the files miraculously
reappear on my harddrive at restart and then re-install the ezula
folder and I'm back to square one.
Also I noted that at the bottom of the folder list in c:\program files
are two new folders named xxx.xxx and xxx.xxxxxx(etcetc) which contain
ezula suff. I deleted these too prior to a restart.
But blast it, it still doesn't work! I've made no real progress except
in identifying some of the culprit files. How I can end their scourge
is still beyond me. HELP !!!



On Tue, 01 Jul 2003 12:54:41 GMT, oldfogie@nospam.net wrotF:

>I think the wonderful folks who produce this spyware/virus have
>adjusted it again so that it cannot be removed/uninstalled.
>
>I've tried:
>1) Ad-aware using the latest ref files
>2) Deleting the reg entries listed in earlier posts here
>3) Deleting the ezula folder in c:\program files (after having to
>change its read-only status)
>4) Using winxp's uninstall utility in control panel (how
>"coincidental" that doing this sends you right to the toptext webpage,
>where I suspect it can be re-sent to your computer)
>5) deleting every file an "ezula" or "zula" search turned up on my
>harddrive
>6) deleting every instance of stub.exe or ezstub.exe
>
>After shut-down/re-start, the ezula folder re-appears in c:\program
>files.
>
>I'm baffled! I've spent 2 hours of my spare time trying to get rid of
>this %&+#)%)* thing with no success.
>
>My last hope will be to use GoBack to revert my harddrive to a time in
>the past, but it will mean losing what I've installed since then and
>backing up email, docs, address book, etc etc etc.
>
>Can someone help me who has removed ezula/toptext recently? TIA.

[YK]

oldfogie@nospam.net wrote:
> Well, I'm still at it an hour later trying to get rid of this crap. In
> looking over GoBack's list of files I see that there is a file named
> ttil_sbc.exe located in C:\windows that apparently creates another
> file, ezinstall.exe also in C:\windows, which starts up every time my
> computer is restarted and installs the ezula folder in c:\program
> files.
> There's a file, mmod.exe in that folder which prevents you from
> deleting the ezula folder. You have to disable it with task manager
> first.
> Still, though, after doing all these things, the files miraculously
> reappear on my harddrive at restart and then re-install the ezula
> folder and I'm back to square one.
> Also I noted that at the bottom of the folder list in c:\program files
> are two new folders named xxx.xxx and xxx.xxxxxx(etcetc) which contain
> ezula suff. I deleted these too prior to a restart.
> But blast it, it still doesn't work! I've made no real progress except
> in identifying some of the culprit files. How I can end their scourge
> is still beyond me. HELP !!!
>
>
>
> On Tue, 01 Jul 2003 12:54:41 GMT, oldfogie@nospam.net wrotF:
>
>> I think the wonderful folks who produce this spyware/virus have
>> adjusted it again so that it cannot be removed/uninstalled.
>>
>> I've tried:
>> 1) Ad-aware using the latest ref files
>> 2) Deleting the reg entries listed in earlier posts here
>> 3) Deleting the ezula folder in c:\program files (after having to
>> change its read-only status)
>> 4) Using winxp's uninstall utility in control panel (how
>> "coincidental" that doing this sends you right to the toptext
>> webpage, where I suspect it can be re-sent to your computer)
>> 5) deleting every file an "ezula" or "zula" search turned up on my
>> harddrive
>> 6) deleting every instance of stub.exe or ezstub.exe
>>
>> After shut-down/re-start, the ezula folder re-appears in c:\program
>> files.
>>
>> I'm baffled! I've spent 2 hours of my spare time trying to get rid of
>> this %&+#)%)* thing with no success.
>>
>> My last hope will be to use GoBack to revert my harddrive to a time
>> in the past, but it will mean losing what I've installed since then
>> and backing up email, docs, address book, etc etc etc.
>>
>> Can someone help me who has removed ezula/toptext recently? TIA.

Maybe Hijack This can help.
http://www.spywareinfo.com/forums/in...ST&f=24&t=5187

[oldfogie@nospam.net]

Well, in short, I gave up!

I made one final try though. I went back and did everything listed
below over again. Then in addition I opened regedit and removed every
one of the 100 or so refs to ezula I found there. Cleaned out all
cookies and temp internet files, double checked to make sure none of
the following were on my harddrive anywhere: ttil.sbc.exe,
ezinstall.exe, mmod.exe, stub.exe, ezulaboot.*, ezstub.exe and the
ezula folder. Just for the heck of it, I unplugged my cable modem feed
line. Then I rebooted. Guess what! It was gone! I thought I had this
one licked. Then I shut fown, reconnected my modem and restarted. You
guessed it. It was back! So, apparently the nice people at ezula plant
some kind of trick, tweak, setting or unknown file that re-downloads
ezula and re-installs it. And I thought the movie monster in Alien I,
II, III was hard to get rid of!

I got rid of it by using GoBack to revert my harddrive to the day
before ezula appeared.

Man, I wish there was some utility that could intercept this stuff
before it invades your system. I do have the firewall up in WinXPs
network setting, but that didn't stop it.


On Tue, 01 Jul 2003 13:57:31 GMT, "YK" <YKnot@home.invalid> wrotF:

>oldfogie@nospam.net wrote:
>> Well, I'm still at it an hour later trying to get rid of this crap. In
>> looking over GoBack's list of files I see that there is a file named
>> ttil_sbc.exe located in C:\windows that apparently creates another
>> file, ezinstall.exe also in C:\windows, which starts up every time my
>> computer is restarted and installs the ezula folder in c:\program
>> files.
>> There's a file, mmod.exe in that folder which prevents you from
>> deleting the ezula folder. You have to disable it with task manager
>> first.
>> Still, though, after doing all these things, the files miraculously
>> reappear on my harddrive at restart and then re-install the ezula
>> folder and I'm back to square one.
>> Also I noted that at the bottom of the folder list in c:\program files
>> are two new folders named xxx.xxx and xxx.xxxxxx(etcetc) which contain
>> ezula suff. I deleted these too prior to a restart.
>> But blast it, it still doesn't work! I've made no real progress except
>> in identifying some of the culprit files. How I can end their scourge
>> is still beyond me. HELP !!!
>>
>>
>>
>> On Tue, 01 Jul 2003 12:54:41 GMT, oldfogie@nospam.net wrotF:
>>
>>> I think the wonderful folks who produce this spyware/virus have
>>> adjusted it again so that it cannot be removed/uninstalled.
>>>
>>> I've tried:
>>> 1) Ad-aware using the latest ref files
>>> 2) Deleting the reg entries listed in earlier posts here
>>> 3) Deleting the ezula folder in c:\program files (after having to
>>> change its read-only status)
>>> 4) Using winxp's uninstall utility in control panel (how
>>> "coincidental" that doing this sends you right to the toptext
>>> webpage, where I suspect it can be re-sent to your computer)
>>> 5) deleting every file an "ezula" or "zula" search turned up on my
>>> harddrive
>>> 6) deleting every instance of stub.exe or ezstub.exe
>>>
>>> After shut-down/re-start, the ezula folder re-appears in c:\program
>>> files.
>>>
>>> I'm baffled! I've spent 2 hours of my spare time trying to get rid of
>>> this %&+#)%)* thing with no success.
>>>
>>> My last hope will be to use GoBack to revert my harddrive to a time
>>> in the past, but it will mean losing what I've installed since then
>>> and backing up email, docs, address book, etc etc etc.
>>>
>>> Can someone help me who has removed ezula/toptext recently? TIA.
>
>Maybe Hijack This can help.
>http://www.spywareinfo.com/forums/in...ST&f=24&t=5187

[YK]

oldfogie@nospam.net wrote:
> Well, in short, I gave up!
>
> I made one final try though. I went back and did everything listed
> below over again. Then in addition I opened regedit and removed every
> one of the 100 or so refs to ezula I found there. Cleaned out all
> cookies and temp internet files, double checked to make sure none of
> the following were on my harddrive anywhere: ttil.sbc.exe,
> ezinstall.exe, mmod.exe, stub.exe, ezulaboot.*, ezstub.exe and the
> ezula folder. Just for the heck of it, I unplugged my cable modem feed
> line. Then I rebooted. Guess what! It was gone! I thought I had this
> one licked. Then I shut fown, reconnected my modem and restarted. You
> guessed it. It was back! So, apparently the nice people at ezula plant
> some kind of trick, tweak, setting or unknown file that re-downloads
> ezula and re-installs it. And I thought the movie monster in Alien I,
> II, III was hard to get rid of!
>
> I got rid of it by using GoBack to revert my harddrive to the day
> before ezula appeared.
>
> Man, I wish there was some utility that could intercept this stuff
> before it invades your system. I do have the firewall up in WinXPs
> network setting, but that didn't stop it.

In my HOSTS file.

127.0.0.1 app.ezula.com
127.0.0.1 chat.ezula.com
127.0.0.1 www.ezula.com

Have you tried HijackThis?

> On Tue, 01 Jul 2003 13:57:31 GMT, "YK" <YKnot@home.invalid> wrotF:
>
>> oldfogie@nospam.net wrote:
>>> Well, I'm still at it an hour later trying to get rid of this crap.
>>> In looking over GoBack's list of files I see that there is a file
>>> named ttil_sbc.exe located in C:\windows that apparently creates
>>> another file, ezinstall.exe also in C:\windows, which starts up
>>> every time my computer is restarted and installs the ezula folder
>>> in c:\program files.
>>> There's a file, mmod.exe in that folder which prevents you from
>>> deleting the ezula folder. You have to disable it with task manager
>>> first.
>>> Still, though, after doing all these things, the files miraculously
>>> reappear on my harddrive at restart and then re-install the ezula
>>> folder and I'm back to square one.
>>> Also I noted that at the bottom of the folder list in c:\program
>>> files are two new folders named xxx.xxx and xxx.xxxxxx(etcetc)
>>> which contain ezula suff. I deleted these too prior to a restart.
>>> But blast it, it still doesn't work! I've made no real progress
>>> except in identifying some of the culprit files. How I can end
>>> their scourge is still beyond me. HELP !!!
>>>
>>>
>>>
>>> On Tue, 01 Jul 2003 12:54:41 GMT, oldfogie@nospam.net wrotF:
>>>
>>>> I think the wonderful folks who produce this spyware/virus have
>>>> adjusted it again so that it cannot be removed/uninstalled.
>>>>
>>>> I've tried:
>>>> 1) Ad-aware using the latest ref files
>>>> 2) Deleting the reg entries listed in earlier posts here
>>>> 3) Deleting the ezula folder in c:\program files (after having to
>>>> change its read-only status)
>>>> 4) Using winxp's uninstall utility in control panel (how
>>>> "coincidental" that doing this sends you right to the toptext
>>>> webpage, where I suspect it can be re-sent to your computer)
>>>> 5) deleting every file an "ezula" or "zula" search turned up on my
>>>> harddrive
>>>> 6) deleting every instance of stub.exe or ezstub.exe
>>>>
>>>> After shut-down/re-start, the ezula folder re-appears in c:\program
>>>> files.
>>>>
>>>> I'm baffled! I've spent 2 hours of my spare time trying to get rid
>>>> of this %&+#)%)* thing with no success.
>>>>
>>>> My last hope will be to use GoBack to revert my harddrive to a time
>>>> in the past, but it will mean losing what I've installed since then
>>>> and backing up email, docs, address book, etc etc etc.
>>>>
>>>> Can someone help me who has removed ezula/toptext recently? TIA.
>>
>> Maybe Hijack This can help.
>> http://www.spywareinfo.com/forums/in...ST&f=24&t=5187

[siljaline]

On Tue, 01 Jul 2003 12:54:41 GMT, oldfogie@nospam.net wrote:

>I think the wonderful folks who produce this spyware/virus have
>adjusted it again so that it cannot be removed/uninstalled.
>
>I've tried:
>1) Ad-aware using the latest ref files
>2) Deleting the reg entries listed in earlier posts here
>3) Deleting the ezula folder in c:\program files (after having to
>change its read-only status)
>4) Using winxp's uninstall utility in control panel (how
>"coincidental" that doing this sends you right to the toptext webpage,
>where I suspect it can be re-sent to your computer)
>5) deleting every file an "ezula" or "zula" search turned up on my
>harddrive
>6) deleting every instance of stub.exe or ezstub.exe
>
>After shut-down/re-start, the ezula folder re-appears in c:\program
>files.
>
>I'm baffled! I've spent 2 hours of my spare time trying to get rid of
>this %&+#)%)* thing with no success.
>
>My last hope will be to use GoBack to revert my harddrive to a time in
>the past, but it will mean losing what I've installed since then and
>backing up email, docs, address book, etc etc etc.
>
>Can someone help me who has removed ezula/toptext recently? TIA.

AFAIK, SpyBot targets eZula,
http://security.kolla.de/index.php?l...s-ezulahottext
That's a typo in the URL.

HTH


--
siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_