Cannot prevent eZula or Ebates Moneymaker from installing!

[Nymphetamine]

I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
to remove everything, eZula and Ebates always reinstall themselves
everyday and start the whole process of @#$@#*% up my system. Also
when I start my comp it always says "please wait while we update setup
files" or whatever that message is, and that has only started
recently, but there are no new setup files.

How do I permamently kill these @#$%@#&

[Harrison]

Look for a file named stub.exe and delete it.

Also see http://www.whirlywiryweb.com/removeezula.htm


On 3 Oct 2003 07:49:13 -0700, nymphetamine@aol.com (Nymphetamine)
wrote:

>I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
>to remove everything, eZula and Ebates always reinstall themselves
>everyday and start the whole process of @#$@#*% up my system. Also
>when I start my comp it always says "please wait while we update setup
>files" or whatever that message is, and that has only started
>recently, but there are no new setup files.
>
>How do I permamently kill these @#$%@#&

[Nymphetamine]

Harrison <nothanksonthespam@gainpro.com> wrote in message news:<fc3rnv4ps7vot1u3lcqjd3u5e3po07kpvp@4ax.com>. ..

> Look for a file named stub.exe and delete it.
>
> Also see http://www.whirlywiryweb.com/removeezula.htm

I don't have stub.exe, or ezstub.exe - I have userstub.exe 11kb
modified 8-02, and I have Ezstub.lgc 12kb from 10-03, any info on
these (i think userstub is legit, and I don't know what to do with the
lgc)

[Harrison]

Ezstub.exe is definitely a file of Ezula and I suspect the other is as
well.

Did you follow the link on how manually remove Ezula?

http://www.whirlywiryweb.com/q/ezula.asp

This site tells you all you need to know about it.


On 3 Oct 2003 13:24:51 -0700, nymphetamine@aol.com (Nymphetamine)
wrote:

>Harrison <nothanksonthespam@gainpro.com> wrote in message news:<fc3rnv4ps7vot1u3lcqjd3u5e3po07kpvp@4ax.com>. ..
>
>> Look for a file named stub.exe and delete it.
>>
>> Also see http://www.whirlywiryweb.com/removeezula.htm
>
>I don't have stub.exe, or ezstub.exe - I have userstub.exe 11kb
>modified 8-02, and I have Ezstub.lgc 12kb from 10-03, any info on
>these (i think userstub is legit, and I don't know what to do with the
>lgc)

[Nymphetamine]

Harrison <nothanksonthespam@gainpro.com> wrote in message news:<llnrnv8mfkm9n0go9f60u9rj96leqets4h@4ax.com>. ..
> Ezstub.exe is definitely a file of Ezula and I suspect the other is as
> well.
>
> Did you follow the link on how manually remove Ezula?
>
> http://www.whirlywiryweb.com/q/ezula.asp
>
> This site tells you all you need to know about it.

I dont have ezstub.exe. I HAD Ezstub.lgc but I renamed it to
ezstub.old

I also have something called defboxm.dll, which is showing up in
hijackthis as a registry entry. I think I should delete it but
searches for it reveal nothing.

[Harrison]

I'm not sure what defboxm.dll is either. You could back it up by
renaming it .old and give it a try.
I guess by now you're about ready suit the crap out of Ezula?

I remember having it about a year or so ago and it took a tremendous
amount of effort to remove.

On 3 Oct 2003 22:45:29 -0700, nymphetamine@aol.com (Nymphetamine)
wrote:

>Harrison <nothanksonthespam@gainpro.com> wrote in message news:<llnrnv8mfkm9n0go9f60u9rj96leqets4h@4ax.com>. ..
>> Ezstub.exe is definitely a file of Ezula and I suspect the other is as
>> well.
>>
>> Did you follow the link on how manually remove Ezula?
>>
>> http://www.whirlywiryweb.com/q/ezula.asp
>>
>> This site tells you all you need to know about it.
>
>I dont have ezstub.exe. I HAD Ezstub.lgc but I renamed it to
>ezstub.old
>
>I also have something called defboxm.dll, which is showing up in
>hijackthis as a registry entry. I think I should delete it but
>searches for it reveal nothing.

[Robin T Cox]

nymphetamine@aol.com (Nymphetamine) wrote in
news:1e71a87c.0310030649.6a168601@posting.google.c om:

> How do I permamently kill these @#$%@#&
>

Remove with Ad-aware and Spybot S&D. Then prevent any future re-infection
by using SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html

[Paul B.]

I'm copying this from another post, it helped me, I was in the same boat
as you (basically the same boat)...

Try "HouseCall", a web-based Virus/Trojan/Adware scanner...
http://housecall.antivirus.com/housecall/start_corp.asp
It found about 3 different Trojans but it indicated that it could not
delete them since they were in use. Unfortunately I could not delete
them myself, even in Windows safe mode. So I found this handy program
called DelLater which deletes files (which are in-use) simply by tagging
them for deletion upon the next Windows bootup...
http://miataru.computing.net/securit...orum/6454.html
or go to...
http://www.diamondcs.com.au/index.php?page=dellater
----
As a great general reference, a list of common Adware and Spyware is
talked about at:
http://www.doxdesk.com/parasite
NOTE: This site also gives manual removal instructions of Spyware/Adware
which may be infecting your PC (very imporant for when programs like
AdAware and Spybot fail to remove this sh*t).


Nymphetamine wrote:
>
> I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
> to remove everything, eZula and Ebates always reinstall themselves
> everyday and start the whole process of @#$@#*% up my system. Also
> when I start my comp it always says "please wait while we update setup
> files" or whatever that message is, and that has only started
> recently, but there are no new setup files.
>
> How do I permamently kill these @#$%@#&

[Nymphetamine]

"Paul B." <billingsleyNOSPAM@earthlink.net> wrote in message news:<3F80B016.272E@earthlink.net>...

> Try "HouseCall", a web-based Virus/Trojan/Adware scanner...
> http://housecall.antivirus.com/housecall/start_corp.asp
> It found about 3 different Trojans but it indicated that it could not
> delete them since they were in use. Unfortunately I could not delete
> them myself, even in Windows safe mode. So I found this handy program
> called DelLater which deletes files (which are in-use) simply by tagging
> them for deletion upon the next Windows bootup...
> http://miataru.computing.net/securit...orum/6454.html
> or go to...
> http://www.diamondcs.com.au/index.php?page=dellater

That found some trojans on my system too, I could delete all except
defboxm.dll (i knew that was bad) Thanks for the info!

"Nymphetamine" <nymphetamine@aol.com> wrote in message
news:1e71a87c.0310200003.1d4f600b@posting.google.c om...
> "Paul B." <billingsleyNOSPAM@earthlink.net> wrote in message
news:<3F80B016.272E@earthlink.net>...
>
> > Try "HouseCall", a web-based Virus/Trojan/Adware scanner...

Scanners only help AFTER your computer is infected. To prevent infection,
remove the check next to "Enable Install On Demand (Other)" from:
Tools > Internet Options > Advanced (under Browsing)