About 2 weeks ago I got the EZULA and ELITE spyware/spamware. I
installed Spybot, AdAware, and Microsoft AntiSpyware (Beta). Each one
of these detected my spam/spyware and purportedly removed them, but the
next time I use my computer, there they are back again. How do I get
rid of them for good?

Around the same time my "trackpoint" started to act funny. It would be
skittish and moved on its own, to the right of the screen. This is not
the same behavior as the "calibration" move that I sometimes get. Any
help out there?

cmdrdata wrote:
> About 2 weeks ago I got the EZULA and ELITE spyware/spamware. I
> installed Spybot, AdAware, and Microsoft AntiSpyware (Beta). Each one
> of these detected my spam/spyware and purportedly removed them, but the
> next time I use my computer, there they are back again. How do I get
> rid of them for good?
>
> Around the same time my "trackpoint" started to act funny. It would be
> skittish and moved on its own, to the right of the screen. This is not
> the same behavior as the "calibration" move that I sometimes get. Any
> help out there?

=== try scanning and removing them in "safe mode" (tapping F8 during
startup)
or get a removal tool from your anti-virus co.'s website =====

cmdrdata wrote:
> About 2 weeks ago I got the EZULA and ELITE spyware/spamware. I
> installed Spybot, AdAware, and Microsoft AntiSpyware (Beta). Each one
> of these detected my spam/spyware and purportedly removed them, but the
> next time I use my computer, there they are back again. How do I get
> rid of them for good?
>
> Around the same time my "trackpoint" started to act funny. It would be
> skittish and moved on its own, to the right of the screen. This is not
> the same behavior as the "calibration" move that I sometimes get. Any
> help out there?
>

Hijack This
http://www.tomcoyote.org/hjt/

Grab it, then post to a forum either on that site or one in the sidebar.

P.

One common spyware technique uses multiple processes that frequently
check for each other. When you kill/remove one the other reinstalls
it. Some even use semi-random process names.

Spybot S&D includes two features that might prove useful (if you are
not already using them): Inoculate and Teatimer.

I agree with the suggestions made by Mike555 and 3 P. I would probably
do a little research first but as you already have Spybot, Ad-aware and
MS AntiSpyware installed, you could jump straight to Safe Mode. (Note,
I did NOT search for specific information on the two items you
mentioned. The steps I suggest are generally applicable, however.)

If you are using WinXP, you many have to turn off System Restore,
remove the spyware, and then turn System Restore back on.

1. Boot in Safe Mode (F8) and run Spybot, Ad-aware, and MS AntiSpyware.
2. Reboot. (Or even reboot into Safe Mode after running each one of the
above.)

3. Run System Spyware Interrogator (www.spywaredata.com) and follow
instructions as appropriate.
4. Reboot.

5. Run HijackThis, submit log to Help2Go Detective (www.help2go.com),
and follow instructions as appropriate.
6. Reboot.

7. Check anti-virus vendor sites for specific removal tools for those
specific blights. McAfee, Symantec, Panda, Trend Micro, and Kaspersky
(at least) have numerous anti-spyware removal tools. Also check
anti-spyware vendor and help sites for specific removal instructions
(e.g., www.pestpatrol.com or www.webroot.com or www.sunbelt.com) or
tools.

8. Run Panda ActiveScan, Trend Micro Housecall, and/or Kaspersky (beta
disk scanner) on-line web scan. IIRC, all three search for spyware.
CA owns PestPatrol so the eTrust on-line scanner also may remove
spyware.

You also might try using ClamWin (its anti-spyware capabilities have
greatly improved this year) and/or ewido security suite (also greatly
improved). a-squared by EMSI,Swat-It, Bazooka Scanner, and X-Cleaner
are also possibilities although I haven't found them to be very useful.
SpySubtract MD by Intermute and Trend Micro or Spy Audit by Webroot
are only scanners but the scan results and web sites may provide manual
removal instructions.
-----
ClamWin
http://www.clamwin.org
eTrust by CA (AV Disk Scan & Cure)
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
ewido Security Suite
http://www.ewido.net
Kaspersky (BETA AV Disk Scan - maybe removal)
http://www.kaspersky.com/downloads/kws/kavwebscan.html
Panda ActiveScan (AV Disk Scan & Cure)
http://www.pandasoftware.com/activescan/com/default.asp
Spy Audit by Webroot (Spy Sweeper based) (Spyware Scan)
http://www.webroot.com/services/spyaudit_03.htm
SpySubtract MD by Intermute and Trend Micro (Spyware Scan & CWShredder)
http://www.intermute.com/spysubtract...ware_scan.html
Trend Micro Housecall (AV Disk Scan & Cure)
http://housecall.trendmicro.com/
-----
9. As a last resort, reboot, run HijackThis, and submit the log to one
of the suggested sites.

Good luck,
BillR

Here's a link to a site which tells you how to remove EZULA. Hope it helps.

http://www.whirlywiryweb.com/removeezula.htm

Kev


"cmdrdata" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> About 2 weeks ago I got the EZULA and ELITE spyware/spamware. I
> installed Spybot, AdAware, and Microsoft AntiSpyware (Beta). Each one
> of these detected my spam/spyware and purportedly removed them, but the
> next time I use my computer, there they are back again. How do I get
> rid of them for good?
>
> Around the same time my "trackpoint" started to act funny. It would be
> skittish and moved on its own, to the right of the screen. This is not
> the same behavior as the "calibration" move that I sometimes get. Any
> help out there?
>

Is ALL of that really necessary?
If so, then there's a simpler procedure ... reload Windows!

"BillR" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> One common spyware technique uses multiple processes that frequently
> check for each other. When you kill/remove one the other reinstalls
> it. Some even use semi-random process names.
>
> Spybot S&D includes two features that might prove useful (if you are
> not already using them): Inoculate and Teatimer.
>
> I agree with the suggestions made by Mike555 and 3 P. I would probably
> do a little research first but as you already have Spybot, Ad-aware and
> MS AntiSpyware installed, you could jump straight to Safe Mode. (Note,
> I did NOT search for specific information on the two items you
> mentioned. The steps I suggest are generally applicable, however.)
>
> If you are using WinXP, you many have to turn off System Restore,
> remove the spyware, and then turn System Restore back on.
>
> 1. Boot in Safe Mode (F8) and run Spybot, Ad-aware, and MS AntiSpyware.
> 2. Reboot. (Or even reboot into Safe Mode after running each one of the
> above.)
>
> 3. Run System Spyware Interrogator (www.spywaredata.com) and follow
> instructions as appropriate.
> 4. Reboot.
>
> 5. Run HijackThis, submit log to Help2Go Detective (www.help2go.com),
> and follow instructions as appropriate.
> 6. Reboot.
>
> 7. Check anti-virus vendor sites for specific removal tools for those
> specific blights. McAfee, Symantec, Panda, Trend Micro, and Kaspersky
> (at least) have numerous anti-spyware removal tools. Also check
> anti-spyware vendor and help sites for specific removal instructions
> (e.g., www.pestpatrol.com or www.webroot.com or www.sunbelt.com) or
> tools.
>
> 8. Run Panda ActiveScan, Trend Micro Housecall, and/or Kaspersky (beta
> disk scanner) on-line web scan. IIRC, all three search for spyware.
> CA owns PestPatrol so the eTrust on-line scanner also may remove
> spyware.
>
> You also might try using ClamWin (its anti-spyware capabilities have
> greatly improved this year) and/or ewido security suite (also greatly
> improved). a-squared by EMSI,Swat-It, Bazooka Scanner, and X-Cleaner
> are also possibilities although I haven't found them to be very useful.
> SpySubtract MD by Intermute and Trend Micro or Spy Audit by Webroot
> are only scanners but the scan results and web sites may provide manual
> removal instructions.
> -----
> ClamWin
> http://www.clamwin.org
> eTrust by CA (AV Disk Scan & Cure)
> http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
> ewido Security Suite
> http://www.ewido.net
> Kaspersky (BETA AV Disk Scan - maybe removal)
> http://www.kaspersky.com/downloads/kws/kavwebscan.html
> Panda ActiveScan (AV Disk Scan & Cure)
> http://www.pandasoftware.com/activescan/com/default.asp
> Spy Audit by Webroot (Spy Sweeper based) (Spyware Scan)
> http://www.webroot.com/services/spyaudit_03.htm
> SpySubtract MD by Intermute and Trend Micro (Spyware Scan & CWShredder)
> http://www.intermute.com/spysubtract...ware_scan.html
> Trend Micro Housecall (AV Disk Scan & Cure)
> http://housecall.trendmicro.com/
> -----
> 9. As a last resort, reboot, run HijackThis, and submit the log to one
> of the suggested sites.
>
> Good luck,
> BillR
>

No, Margrave, all of those steps are quite unlikely to be necessary. I
should not have assumed an implicit "Stop when problem is resolved."
Perhaps I also should have been more emphatic about finding a specific
tool or set of instructions for the identified malware (although I did
note that _I_ would start by doing specific research. Given the tenor
of the original post I thought a prescriptive set of steps was needed
that started with already installed software. I also hoped that a
general response would prove useful to more than just the OP's specific
infection.

"cmdrdata" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> About 2 weeks ago I got the EZULA and ELITE spyware/spamware. I
> installed Spybot, AdAware, and Microsoft AntiSpyware (Beta). Each one
> of these detected my spam/spyware and purportedly removed them, but the
> next time I use my computer, there they are back again. How do I get
> rid of them for good?
>
> Around the same time my "trackpoint" started to act funny. It would be
> skittish and moved on its own, to the right of the screen. This is not
> the same behavior as the "calibration" move that I sometimes get. Any
> help out there?
>
Are you running me or xp? If so, you (or your software) maybe looking at the
restore point data. This is data that is saved on your hard drive for going
back if you need to. It is sometimes hidden from the user (as to when one is
created, at least). I'm no expert, but if this is the case find out how to
disable restore points>reboot>re-enable restore points.

Enjoy.