E2.give , Prutect are not being removed

[SGK]

hi,
i have these two spyware which are not being removed
permanently.
The spyware each time asks for the removal, and removing
it in each run is not helping.
In the next run again these gets identified.

Is there a way to remove these once for all.

I have tried with lavasoft ad-aware....that is also
identifying these each time and not removing it.

appreciate help on this

 

[Mikolaj]

hi,

i have these two spyware which are not being removed
permanently.
The spyware each time asks for the removal, and removing
it in each run is not helping.
In the next run again these gets identified.

Is there a way to remove these once for all.

I have tried with lavasoft ad-aware....that is also
identifying these each time and not removing it.

appreciate help on this

Hi,

Try this way: start the computer in safe mode, than start the MS AntiSpyware
application,
go to Scan options, select Run a full system scan and let it clean the
system.
Also you can try other "cleaning" software:

McAfee Stinger http://vil.nai.com/vil/stinger/
Spybot Search&Destroy http://www.majorgeeks.com/download2471.html
HijackThis http://www.majorgeeks.com/download3155.html
CWShredder http://www.majorgeeks.com/download3019.html
Ad-Aware SE Personal http://www.lavasoft.com/software/adaware/

 

[skatardrummer]

Information on this and HELP request

E2.GIVE, E2.GIVE.IBEHOS, Prutect.

> These are the most annoying spyware and no one seems to know anything about them. After spending 3 weeks trying to get rid of it, here's what I've found out:

- Running your anti-spyware program in safe mode doesn't remove it, even though it says it has, and a 2nd scan turns up 0 results. All it does is get put on your ignore list.

- Prutect is a Trojan that tampers with anti-spyware and virus programs

- E2.GIve is a data miner which sells your information to companies as clientel

- wncln.exe is the process directly associated with E2.Give; it will run this process twice and the only way to end the process is to end them both fast. If one stays open, the other will reboot. The stupid thing plays chicken with you.

- After ending this process, uninstalling the E2 plugin, and the 54-57 registry keys associated to it manually, it will appear as though it is gone. However, it finds a way to regenerate upon restarting.

> The problem is, I don't know how it is doing this. I suspect that when I tamper with it, it copies itself over to some kind of Temp file in order to reinstall itself. I have tried everything within my knowledge. If anyone knows anything about this malware or if you have successfully removed it, PLEASE PLEASE PLEASE HELP!


> For fellow victims, here are my reccommendations: 1. Delete temp files & cookies after every internet session 2. Clear cache often 3. Don't allow auto-logins 4. Suspend any online banking activities 5. Clear browser history 6. Make sure your outgoing security settings on your firewalls are on high

 

[ScottG]

I have been pounding away at this crap for hours now and cannot seem to make any headway. I have contacted E2Give although I seriously doubt they will be any help. To help anyone else out there who is having a problem with IeBHOs.dll or Prutect and the fact that they reinstall / reappear / manifest themselves after apparently being uninstalled I have tried the following:

AdAware
Spybot
Microsoft Windows Defender
Microsoft Windows Malicious Software Removal Tool
HiJackThis
TrendMicro online scan
Symantec Client Security
Manual Removal via Windows Explorer and the registry

None of the above were successful in removing the problem. If anyone has a solution please post it here or email me.

 

[sLaPpY]

Well, after many many hours of trying all these things that have been previously mentioned. It was quite refreshing to see that I'm not the only one in the damned world that is being plagued by this thing. Granted, this is a corporate machine but nonetheless, I can't in good faith just reimage the damn thing. I MUST know what the hell is going on.

Lets get this one figured out. I too have E2Give and Prutect causing major issues. I've been investigating hidden processes and haven't had much luck yet. I will continue to try and track this one down. If I come across anything I will post back.

 

[ScottG]

I have the solution. Simply put, I contacted the company and they provided a removal program. I do not have a place to host the file, but I am willing to send it to anyone who has the ability to host the file.

 

[tuckerfor3]

I can host it!

Please send me the file and I'd be happy to help. I'm having the same problem. (e-mail address removed) is my email address.

Thank you!

 

[redluck]

how do I contact them directly? The removal tool that someone from another thread hosted does not work for me.

 

[moemontreal]

Contact E2.GIVE

how do I contact them directly? The removal tool that someone from another thread hosted does not work for me.

To contact them:
http://e2give.com/license.html
(e-mail address removed)

I sent them and E-mail i will see what they will reply and if they send me a software to take that sh*t off i will poste it on my server and poste the link here. If any of you guys gets any news first let us all know, we are all in the same boat here lol.

Moe.

 

[ScottG]

Here is a link to the file. I forgot I had posted in this forum so I neglected to post this link. Sorry for the delay. This worked for me, but I make no guarantees as to the safety of the software. It was provided by E2G and it solved my problem. Good luck with this and let me know how it turns out.

Scott

 

[moemontreal]

E2.give Customer Service

hey guys i gived the E2.GIVE ppl **** and they sent me the way to take it off for good here is how u do it:

Hi, Sorry to hear you are having trouble with it. The E2Give Software application was designed to be easily removed using Windows add/ remove function. If you are having trouble removing it with add/ remove, it usually means that it was deleted or removed by a manual deletion. Since Anti-Spyware and Anti Virus Software do not use the add/ remove function, use of these types of programs to remove E2Give, will only partially delete E2Give. It is also possible that the program was installed under another user login. If this is the case log in under the alternate user login and use add / remove as described below to remove the program.



To remove the e2give program:



Method A:

Please close all browser windows and go to the "Add or Remove Programs" in

the Windows control panel and remove the 'e2g plug-in' or the "e2give

plug-in". (note: the program can only be removed via Add or Remove programs)

Reboot the machine. Check add/ remove to verify E2give is no longer present.

Run you Antivirus/ spyware/ etc. to clean up any remaining e2give remnants in the registry.

That should do it.



Method B:

If it is not able to be removed from the add/remove programs section of

Windows it has become damaged. This can occur sometimes when using either a Anti-Virus or Spyware/ Adware removal software tool to remove the E2Give Software and their method of removal damaged the E2Give Software rather than remove it. This can also occur if a manual deletion of the program only deleted parts of it. I know it might sound silly, but if this happens, the best way to remove it is to re-install it and then remove it again.



In order for the program to be installed, you MUST DISABLE ALL ANTI SPYWARE AND ANTVIRUS SOFTWARE. If you do not do this the program will not install over the broken version as the anti virus / anti spy ware software will block the installation. If you are not sure how to do this, Contact your software vendor for instructions on how to disable their software.



download and run the file from the following link



http://askearth.com/downloads/AskEarth17.exe



This should perform a new and complete installation of the E2Give Program, overwriting the damaged version. Once Installed, refer back to Method A shown above Remember to re-enable your anti virus / ant spyware software after removal and reboot.



Method C:

One other possibility is the program was downloaded from another user's

account. If that is the case, try logging on to each user account on the computer and remove it from there following the instructions in Method A shown above..



I hope this helps you. Please let me know how it goes.



Customer Service

--------
--------
So thats it guys i hope it works let me know from your part.
Moe.

 

[stern]

Scott,


Can you post the link again? I'm a late-comer to this thread, but would really appreciate using the removal program if you still have it handy. For some reason the link is not showing up in your post.

Thanks.

 

[skatardrummer]

I finally got rid of it. E2 respawns itself in a temporary, random location when you've detected it as malware. Even in safe mode. I got lucky and caught it in between this period after trying to manually remove it hundreds of times.

Run in safe mode
1. Uninstal e2give plugin
2. end abnormal processes (it changes the name periodically)
3. scan with xoftspy or a similar program that will show exact locations of infected files and registry keys
4. Remove files manually and regkeys by going to Run > regedit
5. Run spyware removal software again
6. Restart computer and run in Safe Mode
7. Run spyware removal software again (hopefully by now it's all clear)
8. double check that the e2give plugin is still removed
9. restart and run windows normally.

Hopefully that should do it.