Extra favorites appeared

[Guest]

There is a whole bunch of favorites listed that were not saved, (both link
and directories of links). When you open "Organise favorites", they are not
listed, so I don't know how to get rid of them. I have run a number of the
spyware tools (Ad-aware & Microsoft new spy-tool), but they do not appear to
be able to see these - found other stuff that I have removed. Also, there is
an additional tool bar that won't go away. Any clues how to get rid of this
thing that appears to attached itself to Internet Explorer?

 

[Frank Saunders, MS-MVP IE/OE]

There is a whole bunch of favorites listed that were not saved, (both link
and directories of links). When you open "Organise favorites", they are
not
listed, so I don't know how to get rid of them. I have run a number of
the
spyware tools (Ad-aware & Microsoft new spy-tool), but they do not appear
to
be able to see these - found other stuff that I have removed. Also, there
is
an additional tool bar that won't go away. Any clues how to get rid of
this
thing that appears to attached itself to Internet Explorer?

One anti-spyware program won't catch everything.
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

CAUTION!!!!! Removing some spyware can damage the Winsock stact. Before
you try to remove spyware using any of these programs , download a copy of
LSP-Fix - a free program to repair damaged Winsock 2 stacks (all Windows
versions)
http://www.cexx.org/lspfix.htm
Winsockfix for W95, W98, ME, NT, 2000, XP
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
WinXP:
Get WinSockxpFix
http://www.spychecker.com/program/winsockxpfix.html
How to Reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/kb/299357
In WinXP SP2: You can fix Winsock by going to Start | Run and typing
CMD
In the command window type
netsh winsock reset

See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.intermute.com/products/cwshredder
**Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.

See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/

 

[Jan Il]

Hi Tommy

The problem is due to some kind of scumware on your system. You don't give
us the version of Windows you are using, but, try the steps below and and
see if it helps

For the rogue toolbar:

ToolbarCop
http://www.majorgeeks.com/downloadget.php?id=4126&file=10&evp=161f1ddc1d3919e9bb9524f2094d2b64

For the Favorites links:

Close all instances of IE. Go to your User Favorites Folder in Windows
Explorer (not IE) and see if the links you do not want are there. If so,
delete them.

Go to the Control Panel>Add/Remove programs>scroll down and see if there are
any programs listed there that you did not install yourself. If so,
uninstall them.

NExt: Even if you have already run some programs, run them again according
to the instructions in the information below to thoroughly clean you system.
Some variants of malware can replicate itself and return repeatedly if not
cleaned properly. It is best to read through all the information before you
start to know before hand what you need to do and how. Follow all
instructions to letter as much as possible.

WARNING>>>> Backup all documents and files before removing any spyware!!

First., download and install BHODemon from
http://www.definitivesolutions.com/bhodemon.htm
Your problem may be caused by a bad BHO.

If this does not resolve the problem, download, install and run the
following programs in Safe Mode:

CWShredder: Free
http://www.majorgeeks.com/download4086.html

SpyBot S &D
http://www.majorgeeks.com/download2471.html
You must immediately update after installation to be sure the definitions
are current

Also download and install HiJackThis -

How to download and install HiJackThis:
http://www.bleepingcomputer.com/forums/topict309.html

Please DO NOT post your log to this newsgroup, but to the HiJackThis Support
Forums below:
AumHa HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30
or Bleeping Computer Forum
http://www.bleepingcomputer.com/forums/forum22.html
to allow the experts there to evaluate your log and advise you of any
necessary steps to clean your system.
(Note: You will have to Register before posting on these Forums. Please
follow all posting instructions carefully to avoid having your log deleted
or ignored.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also... From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
or Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[M8RIX]

This sounds exactly like what happened to me last week. In my case it was
azesearch and coolwebsearch that had dumped their crap on my system. I
removed them myself through exhaustive searches of the registry. I later
found more detailed help with a google search regarding the culprits named
above.

I was running the latest updated versions of Spybot S&D and Spyware blaster
at the time I was "infected", but the crud got through anyway. I think I was
suckered into clicking on a pop-up that looks alot like the one that pops up
with Windows Security Center but this one was actually a Flash animation.

I am not skilled enough to help you with removal but I hope that this helps
you in tracking down your problem

Mark N