Cannot prevent eZula or Ebates Moneymaker from installing!

[Nymphetamine]

I've used Ad-Aware, Spyboy, Hijackthis, BHOdemon, and though the seem
to remove everything, eZula and Ebates always reinstall themselves
everyday and start the whole process of @#$@#*% up my system. Also
when I start my comp it always says "please wait while we update setup
files" or whatever that message is, and that has only started
recently, but there are no new setup files.

How do I permamently kill these @#$%@#&

 

[Harrison]

Look for a file named stub.exe and delete it.

Also see http://www.whirlywiryweb.com/removeezula.htm

 

[Robin T Cox]

(e-mail address removed) (Nymphetamine) wrote in

How do I permamently kill these @#$%@#&

Remove with Ad-aware and Spybot S&D. Then prevent any future re-infection
by using SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html

 

[Nymphetamine]

Look for a file named stub.exe and delete it.

Also see http://www.whirlywiryweb.com/removeezula.htm

I don't have stub.exe, or ezstub.exe - I have userstub.exe 11kb
modified 8-02, and I have Ezstub.lgc 12kb from 10-03, any info on
these (i think userstub is legit, and I don't know what to do with the
lgc)

 

[Harrison]

Ezstub.exe is definitely a file of Ezula and I suspect the other is as
well.

Did you follow the link on how manually remove Ezula?

http://www.whirlywiryweb.com/q/ezula.asp

This site tells you all you need to know about it.

 

[Nymphetamine]

Ezstub.exe is definitely a file of Ezula and I suspect the other is as
well.

Did you follow the link on how manually remove Ezula?

http://www.whirlywiryweb.com/q/ezula.asp

This site tells you all you need to know about it.

I dont have ezstub.exe. I HAD Ezstub.lgc but I renamed it to
ezstub.old

I also have something called defboxm.dll, which is showing up in
hijackthis as a registry entry. I think I should delete it but
searches for it reveal nothing.

 

[Harrison]

I'm not sure what defboxm.dll is either. You could back it up by
renaming it .old and give it a try.
I guess by now you're about ready suit the crap out of Ezula?

I remember having it about a year or so ago and it took a tremendous
amount of effort to remove.

 

[Nymphetamine]

I'm not sure what defboxm.dll is either. You could back it up by
renaming it .old and give it a try.

I can't because its being used by windows. Everything seems to be off
my system finally, but i did so much that i don't know exactly what
worked.
I think it was the ezstub.lgc but thats not even mentioned on that
website giving instructions to remove ezula...

 

[Paul B.]

I'm copying this from another post, it helped me, I was in the same boat
as you (basically the same boat)...

Try "HouseCall", a web-based Virus/Trojan/Adware scanner...
http://housecall.antivirus.com/housecall/start_corp.asp
It found about 3 different Trojans but it indicated that it could not
delete them since they were in use. Unfortunately I could not delete
them myself, even in Windows safe mode. So I found this handy program
called DelLater which deletes files (which are in-use) simply by tagging
them for deletion upon the next Windows bootup...
http://miataru.computing.net/security/wwwboard/forum/6454.html
or go to...
http://www.diamondcs.com.au/index.php?page=dellater
----
As a great general reference, a list of common Adware and Spyware is
talked about at:
http://www.doxdesk.com/parasite
NOTE: This site also gives manual removal instructions of Spyware/Adware
which may be infecting your PC (very imporant for when programs like
AdAware and Spybot fail to remove this sh*t).

 

[Herbert West]

I can't because its being used by windows. Everything seems to be off
my system finally, but i did so much that i don't know exactly what
worked.
I think it was the ezstub.lgc but thats not even mentioned on that
website giving instructions to remove ezula...

Remove the suspect files whilst in Safe mode. Should that not work, if
your filesystem is FAT or FAT32 (not NTFS), use Windows 98 boot floppy
to start up in DOS mode. Rename any suspect files, remove the floppy
and reboot. If that solves the problem, good. If not, you'll have to
dig deeper for a solution. If your running NTFS, there is a utility
called something like NTFSDOS which allows you to do file repair to
NTFS formated drives while in DOS.

Regards,

Herb

 

[H Leboeuf]

Have you seen this page?
http://www.cexx.org/toptext.htm

 

[Nymphetamine]

Try "HouseCall", a web-based Virus/Trojan/Adware scanner...
http://housecall.antivirus.com/housecall/start_corp.asp
It found about 3 different Trojans but it indicated that it could not
delete them since they were in use. Unfortunately I could not delete
them myself, even in Windows safe mode. So I found this handy program
called DelLater which deletes files (which are in-use) simply by tagging
them for deletion upon the next Windows bootup...
http://miataru.computing.net/security/wwwboard/forum/6454.html
or go to...
http://www.diamondcs.com.au/index.php?page=dellater

That found some trojans on my system too, I could delete all except
defboxm.dll (i knew that was bad) Thanks for the info!

 

[Guest]

"Paul B." <[email protected]> wrote in message

Scanners only help AFTER your computer is infected. To prevent infection,
remove the check next to "Enable Install On Demand (Other)" from:
Tools > Internet Options > Advanced (under Browsing)

 

[Nymphetamine]

Scanners only help AFTER your computer is infected. To prevent infection,
remove the check next to "Enable Install On Demand (Other)" from:
Tools > Internet Options > Advanced (under Browsing)

I did that. Is "Enable Third Party Browser Extensions" related to
those browser hijacking search windows etc? I unchecked that one as
well.

 

[Patrick Harkins]

(e-mail address removed) (Nymphetamine) wrote in message

I did that. Is "Enable Third Party Browser Extensions" related to
those browser hijacking search windows etc? I unchecked that one as
well.

Hi,
I guess you noticed that ezula is related to Kazaa. Presumably by now
you have removed kazaa - I just wanted to refer you to kazaalite if
file-sharing interests you - it's a good product that installs bogus
adware dlls to trick the kazaa engine into functioning.

I am using the three-part solution described above: Spybot Search and
Destroy, Ad-Aware and Spyware Blaster... with good results. I
ocassionally use Hijack This but with great care. It's very tempting
to remove something that may screw up your machine. I also use the
Google toolbar to kill popups.

hope that helps,
-Patrick

 

[Nymphetamine]

Hi,
I guess you noticed that ezula is related to Kazaa. Presumably by now
you have removed kazaa - I just wanted to refer you to kazaalite if
file-sharing interests you - it's a good product that installs bogus
adware dlls to trick the kazaa engine into functioning.

I am using the three-part solution described above: Spybot Search and
Destroy, Ad-Aware and Spyware Blaster... with good results. I
ocassionally use Hijack This but with great care. It's very tempting
to remove something that may screw up your machine. I also use the
Google toolbar to kill popups.

hope that helps,
-Patrick

I never used kazaa or klite. All of these problems and spyware started
when I needed a fast way to turn a wav into mp3 and downloaded some
stupid software, before researching what people in the newsgroups
recommend.