Removal of BHO called cbaya

[Magnus]

There is a VERY annoying little program called cbaya.dll
that loads itself in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\cbaya

The file can not be deleted (c:\windows\system32
\cbaya.dll) and if one try to delete any settings they do
just pop back up again. Doesn't even help to load in safe
mode.

Anyone out there that knows how to get rid of thisone?

Magnus

 

[Engel]

Boot into Safe Mode (F8) at startup;
Empty your temporary files AND your Temporary Internet
Files* C:\Documents and Settings\Username\Local
settings\Temporary Internet Files folder ;
Run the scan while in safe mode;

If you are running SP2, open IE--->Tools--->Manage Add-
ons, and uncheck any
BHO's that you don't recºgnize.

Engel

 

[Magnus]

I did finally manage to remove this one by removing
SYSTEMS accessright for dll. Now when the system booted
up I could just take ownership of the file and then
delete.

I can explain further if anyone will have a problem with
this spyware.

Thanks,

Magnus

 

[Guest]

Thanks, but i did try similar but since it was loaded in
the login procedure it didn't help to boot up safe it is
still loaded and belongs to system login process. Can not
be removed. If you tried to remove it from the registry
it just reentered itself. I never had to deal with such
sticky device. Even the ID->Tools-->Man... procedure
didn't work again. It reregistered itself within one sec.
I finally managed to remove it by revoking rights for
system to read the dll file.

But thanks for the help.

/Magnus

 

[sagatrepair]

Removal of cbaya

How do I take back ownership of the file like you said from system processes?