George wrote:
> Spybot claims to have cleared it out. But it appears every time I run Spybot!
>
> --- Search result list Spybot---
> Win32.Joleee.K: [SBI $881A1524] Settings (Registry value, nothing done)
>
> HKEY_USERS\S-1-5-21-950235333-310148379-1175707535-1008\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servises
>
> Win32.Joleee.K: [SBI $25C24901] Settings (Registry value, nothing done)
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\servises
>
> AVG Free 8.5 detected it and claims to have cleared it out. It no longer appears
> in this one.
>
> Any suggestions please.
>
> George.

Hello George:

Some evidence suggests that you may have received this through your email.

Try running:

In Normal Mode - MBAM: <http://www.malwarebytes.org/>
In Safe Mode - SAS: <http://www.superantispyware.com/>

Please post a follow-up to this thread with your progress.

Regards,

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]

On Sun, 02 Aug 2009 11:38:24 -0700, 1PW <(E-Mail Removed)> wrote
this:

>Some evidence suggests that you may have received this through your email.
Thanks.

By the way, I don't use e-mail!!!!

George.

George wrote:
> On Sun, 02 Aug 2009 11:38:24 -0700, 1PW <(E-Mail Removed)> wrote
> this:
>
>> Some evidence suggests that you may have received this through your email.
> Thanks.
>
> By the way, I don't use e-mail!!!!
>
> George.

Hello George:

Then that eliminates one of several attack vectors. Have you tried
MBAM/SAS?

Regards,

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]

George wrote:
>On Sun, 02 Aug 2009 11:38:24 -0700, 1PW <(E-Mail Removed)> wrote
>this:
>
>>Some evidence suggests that you may have received this through your email.
>Thanks.
>
>By the way, I don't use e-mail!!!!
>
>George.

Tried this yet?:
http://forums.spybot.info/showthread.php?t=38962

George wrote:
>On Sun, 02 Aug 2009 11:38:24 -0700, 1PW <(E-Mail Removed)> wrote
>this:
>
>>Some evidence suggests that you may have received this through your email.
>Thanks.
>
>By the way, I don't use e-mail!!!!
>
>George.

Tried this yet?:
http://forums.spybot.info/showthread.php?t=38962

On Sun, 02 Aug 2009 11:38:24 -0700, 1PW <(E-Mail Removed)> wrote
this:

>George wrote:
>> Spybot claims to have cleared it out. But it appears every time I run Spybot!
>>
>> --- Search result list Spybot---
>> Win32.Joleee.K: [SBI $881A1524] Settings (Registry value, nothing done)
>>
>> HKEY_USERS\S-1-5-21-950235333-310148379-1175707535-1008\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servises
>>
>> Win32.Joleee.K: [SBI $25C24901] Settings (Registry value, nothing done)
>>
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\servises
>>
>> AVG Free 8.5 detected it and claims to have cleared it out. It no longer appears
>> in this one.
>>
>> Any suggestions please.
>>
>> George.
>
>Hello George:
>
>Some evidence suggests that you may have received this through your email.
>
>Try running:
>
> In Normal Mode - MBAM: <http://www.malwarebytes.org/>
> In Safe Mode - SAS: <http://www.superantispyware.com/>
>
>Please post a follow-up to this thread with your progress.
>
>Regards,
>
>Pete

Thank you. Malwarebytes did the trick.

I indulge my grand children but it that does have it's moments.
On mentioning my problem and your comments my grand daughter
volunteered the information that she does use hotmail to keep
in touch with her friends whilst she is with us. She has free range, but
with "parental protections" built in, of my PC because like any other
teenager she likes to keep in contact with "civilization". (She is American
we live in Scotland.) I thought she used facebook or whatever.

Thank you for your help.

George.

George wrote:
> On Sun, 02 Aug 2009 11:38:24 -0700, 1PW <(E-Mail Removed)> wrote
> this:
>
>> George wrote:
>>> Spybot claims to have cleared it out. But it appears every time I run Spybot!
>>>
>>> --- Search result list Spybot---
>>> Win32.Joleee.K: [SBI $881A1524] Settings (Registry value, nothing done)
>>>
>>> HKEY_USERS\S-1-5-21-950235333-310148379-1175707535-1008\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servises
>>>
>>> Win32.Joleee.K: [SBI $25C24901] Settings (Registry value, nothing done)
>>>
>>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\servises
>>>
>>> AVG Free 8.5 detected it and claims to have cleared it out. It no longer appears
>>> in this one.
>>>
>>> Any suggestions please.
>>>
>>> George.
>> Hello George:
>>
>> Some evidence suggests that you may have received this through your email.
>>
>> Try running:
>>
>> In Normal Mode - MBAM: <http://www.malwarebytes.org/>
>> In Safe Mode - SAS: <http://www.superantispyware.com/>
>>
>> Please post a follow-up to this thread with your progress.
>>
>> Regards,
>>
>> Pete
>
> Thank you. Malwarebytes did the trick.
>
> I indulge my grand children but it that does have it's moments.
> On mentioning my problem and your comments my grand daughter
> volunteered the information that she does use hotmail to keep
> in touch with her friends whilst she is with us. She has free range, but
> with "parental protections" built in, of my PC because like any other
> teenager she likes to keep in contact with "civilization". (She is American
> we live in Scotland.) I thought she used facebook or whatever.
>
> Thank you for your help.
>
> George.

Hello George:

I'm happy for you that MBAM helped. A follow-up with SAS in the Safe
Mode is usually the next step.

Best wishes,

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]