Cannot prevent eZula or Ebates Moneymaker from installing!

[Nymphetamine]

I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
to remove everything, eZula and Ebates always reinstall themselves
everyday and start the whole process of @#$@#*% up my system. Also
when I start my comp it always says "please wait while we update setup
files" or whatever that message is, and that has only started
recently, but there are no new setup files.

How do I permamently kill these @#$%@#&

[Harrison]

Look for a file named stub.exe and delete it.

Also see http://www.whirlywiryweb.com/removeezula.htm


On 3 Oct 2003 07:49:13 -0700, nymphetamine@aol.com (Nymphetamine)
wrote:

>I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
>to remove everything, eZula and Ebates always reinstall themselves
>everyday and start the whole process of @#$@#*% up my system. Also
>when I start my comp it always says "please wait while we update setup
>files" or whatever that message is, and that has only started
>recently, but there are no new setup files.
>
>How do I permamently kill these @#$%@#&

[Robin T Cox]

nymphetamine@aol.com (Nymphetamine) wrote in
news:1e71a87c.0310030649.6a168601@posting.google.c om:

> How do I permamently kill these @#$%@#&
>

Remove with Ad-aware and Spybot S&D. Then prevent any future re-infection
by using SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html

[Nymphetamine]

Harrison <nothanksonthespam@gainpro.com> wrote in message news:<fc3rnv4ps7vot1u3lcqjd3u5e3po07kpvp@4ax.com>. ..

> Look for a file named stub.exe and delete it.
>
> Also see http://www.whirlywiryweb.com/removeezula.htm

I don't have stub.exe, or ezstub.exe - I have userstub.exe 11kb
modified 8-02, and I have Ezstub.lgc 12kb from 10-03, any info on
these (i think userstub is legit, and I don't know what to do with the
lgc)

[Harrison]

Ezstub.exe is definitely a file of Ezula and I suspect the other is as
well.

Did you follow the link on how manually remove Ezula?

http://www.whirlywiryweb.com/q/ezula.asp

This site tells you all you need to know about it.


On 3 Oct 2003 13:24:51 -0700, nymphetamine@aol.com (Nymphetamine)
wrote:

>Harrison <nothanksonthespam@gainpro.com> wrote in message news:<fc3rnv4ps7vot1u3lcqjd3u5e3po07kpvp@4ax.com>. ..
>
>> Look for a file named stub.exe and delete it.
>>
>> Also see http://www.whirlywiryweb.com/removeezula.htm
>
>I don't have stub.exe, or ezstub.exe - I have userstub.exe 11kb
>modified 8-02, and I have Ezstub.lgc 12kb from 10-03, any info on
>these (i think userstub is legit, and I don't know what to do with the
>lgc)

[Nymphetamine]

Harrison <nothanksonthespam@gainpro.com> wrote in message news:<llnrnv8mfkm9n0go9f60u9rj96leqets4h@4ax.com>. ..
> Ezstub.exe is definitely a file of Ezula and I suspect the other is as
> well.
>
> Did you follow the link on how manually remove Ezula?
>
> http://www.whirlywiryweb.com/q/ezula.asp
>
> This site tells you all you need to know about it.

I dont have ezstub.exe. I HAD Ezstub.lgc but I renamed it to
ezstub.old

I also have something called defboxm.dll, which is showing up in
hijackthis as a registry entry. I think I should delete it but
searches for it reveal nothing.

[Harrison]

I'm not sure what defboxm.dll is either. You could back it up by
renaming it .old and give it a try.
I guess by now you're about ready suit the crap out of Ezula?

I remember having it about a year or so ago and it took a tremendous
amount of effort to remove.

On 3 Oct 2003 22:45:29 -0700, nymphetamine@aol.com (Nymphetamine)
wrote:

>Harrison <nothanksonthespam@gainpro.com> wrote in message news:<llnrnv8mfkm9n0go9f60u9rj96leqets4h@4ax.com>. ..
>> Ezstub.exe is definitely a file of Ezula and I suspect the other is as
>> well.
>>
>> Did you follow the link on how manually remove Ezula?
>>
>> http://www.whirlywiryweb.com/q/ezula.asp
>>
>> This site tells you all you need to know about it.
>
>I dont have ezstub.exe. I HAD Ezstub.lgc but I renamed it to
>ezstub.old
>
>I also have something called defboxm.dll, which is showing up in
>hijackthis as a registry entry. I think I should delete it but
>searches for it reveal nothing.

[Nymphetamine]

Harrison <nothanksonthespam@gainpro.com> wrote in message news:<58jtnvccfdv5g7ikbh83is0tcsse2hdgu4@4ax.com>. ..

> I'm not sure what defboxm.dll is either. You could back it up by
> renaming it .old and give it a try.

I can't because its being used by windows. Everything seems to be off
my system finally, but i did so much that i don't know exactly what
worked.
I think it was the ezstub.lgc but thats not even mentioned on that
website giving instructions to remove ezula...

[Paul B.]

I'm copying this from another post, it helped me, I was in the same boat
as you (basically the same boat)...

Try "HouseCall", a web-based Virus/Trojan/Adware scanner...
http://housecall.antivirus.com/housecall/start_corp.asp
It found about 3 different Trojans but it indicated that it could not
delete them since they were in use. Unfortunately I could not delete
them myself, even in Windows safe mode. So I found this handy program
called DelLater which deletes files (which are in-use) simply by tagging
them for deletion upon the next Windows bootup...
http://miataru.computing.net/securit...orum/6454.html
or go to...
http://www.diamondcs.com.au/index.php?page=dellater
----
As a great general reference, a list of common Adware and Spyware is
talked about at:
http://www.doxdesk.com/parasite
NOTE: This site also gives manual removal instructions of Spyware/Adware
which may be infecting your PC (very imporant for when programs like
AdAware and Spybot fail to remove this sh*t).


Nymphetamine wrote:
>
> I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
> to remove everything, eZula and Ebates always reinstall themselves
> everyday and start the whole process of @#$@#*% up my system. Also
> when I start my comp it always says "please wait while we update setup
> files" or whatever that message is, and that has only started
> recently, but there are no new setup files.
>
> How do I permamently kill these @#$%@#&

[H Leboeuf]

Have you seen this page?
http://www.cexx.org/toptext.htm
--

Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm


"Herbert West" <reanimator@miskatonic.edu> wrote in message
news:h487ovgt48pqjvvg0j5tpe1fferfegg3oj@4ax.com...
> On 5 Oct 2003 05:44:43 -0700, nymphetamine@aol.com (Nymphetamine)
> wrote:
>
> >Harrison <nothanksonthespam@gainpro.com> wrote in message
news:<58jtnvccfdv5g7ikbh83is0tcsse2hdgu4@4ax.com>. ..
> >
> >> I'm not sure what defboxm.dll is either. You could back it up by
> >> renaming it .old and give it a try.
> >
> >I can't because its being used by windows. Everything seems to be off
> >my system finally, but i did so much that i don't know exactly what
> >worked.
> >I think it was the ezstub.lgc but thats not even mentioned on that
> >website giving instructions to remove ezula...
>
>
> Remove the suspect files whilst in Safe mode. Should that not work, if
> your filesystem is FAT or FAT32 (not NTFS), use Windows 98 boot floppy
> to start up in DOS mode. Rename any suspect files, remove the floppy
> and reboot. If that solves the problem, good. If not, you'll have to
> dig deeper for a solution. If your running NTFS, there is a utility
> called something like NTFSDOS which allows you to do file repair to
> NTFS formated drives while in DOS.
>
> Regards,
>
> Herb
>