Spyware proxy removal trouble

[Guest]

Hi, my wife installed some software on my Windows xp machine and it contained some spyware stuff. I uninstalled the software, and ran both Adaware, and spybot and they indicated removal of the items. However, I get two issues. There is a netsetter registry entry that recreates itself after reboot of the machine, and in the Lan settings, in the address line, a reference to www.compete.com/pane...... When I remove this reference, I loose internet access, until I restart IE, but once IE restarts, that reference is back as well. I am fairly knowledgable in computers, and am having trouble resolving this. The netsetter is picked up by adaware every time its run after a reboot but I"m not sure if its doing anything else. When I remove the reference for the compete.com, and then try to browse the web, I get the "detecting proxy settings" message, then an error message in reference to cannot find yada yada yada.. These both are data harvesting items (not sure they're related, don't think so) which I want to get removed. I'm running WinXP Pro, and IE6 with all the latest updates. Please help! Need advise/ideas on how to remove these 2 items permanently and still have internet access. I'm also using a broadband cable connection if that helps. Currently at work, but will be monitoring this today. If you need specific info, I can try to get it, or it will have to wait until my return home this afternoon. Thanks for any and all help in advance

Jaso

 

[mac]

Hi, my wife installed some software on my Windows xp machine and it

contained some spyware stuff. I uninstalled the software, and ran both
Adaware, and spybot and they indicated removal of the items. However, I get
two issues. There is a netsetter registry entry that recreates itself after
reboot of the machine, and in the Lan settings, in the address line, a
reference to www.compete.com/pane...... When I remove this reference, I
loose internet access, until I restart IE, but once IE restarts, that
reference is back as well. I am fairly knowledgable in computers, and am
having trouble resolving this. The netsetter is picked up by adaware every
time its run after a reboot but I"m not sure if its doing anything else.
When I remove the reference for the compete.com, and then try to browse the
web, I get the "detecting proxy settings" message, then an error message in
reference to cannot find yada yada yada.. These both are data harvesting
items (not sure they're related, don't think so) which I want to get
removed. I'm running WinXP Pro, and IE6 with all the latest updates.
Please help! Need advise/ideas on how to remove these 2 items permanently
and still have internet access. I'm also using a broadband cable connection
if that helps. Currently at work, but will be monitoring this today. If
you need specific info, I can try to get it, or it will have to wait until
my return home this afternoon. Thanks for any and all help in advance!

Jason

Have a look for it/them in the start up @ start>run>msconfig>start up, if
found disable, and then run both the spyware detector programs again.
re-boot.

 

[Bob Dietz]

Hi, my wife installed some software on my Windows xp machine and it
contained some spyware stuff.

Let's say the software was named - Real Pain
Have you done any search at google for things like -
"Real Pain" remove proxy
"Real Pain" spyware
"Real Pain" "www.compet.com"

Note: If anything like a URL comes first google is like to only return
pages from that site.

I uninstalled the software, and ran
both Adaware, and spybot and they indicated removal of the items.
However, I get two issues. There is a netsetter registry entry that
recreates itself after reboot of the machine, and in the Lan
settings, in the address line, a reference to
www.compete.com/pane...... When I remove this reference, I loose
internet access, until I restart IE, but once IE restarts, that
reference is back as well. I am fairly knowledgable in computers,
and am having trouble resolving this. The netsetter is picked up by
adaware every time its run after a reboot but I"m not sure if its
doing anything else. When I remove the reference for the
compete.com, and then try to browse the web, I get the "detecting
proxy settings" message, then an error message in reference to cannot
find yada yada yada.. These both are data harvesting items (not sure
they're related, don't think so) which I want to get removed. I'm
running WinXP Pro, and IE6 with all the latest updates. Please help!
Need advise/ideas on how to remove these 2 items permanently and
still have internet access. I'm also using a broadband cable
connection if that helps. Currently at work, but will be monitoring
this today. If you need specific info, I can try to get it, or it
will have to wait until my return home this afternoon. Thanks for
any and all help in advance!

Jason

Have you looked turning off poxies in Internet Options?

Bob

 

[CWatters]

In the past I've found that some spyware removal programs don't remove
everything - possibly because the adware was changed. In this case I google
search the name of the problem (eg netsetter +remove) and you can usually
find manual removal instruction on the websites of other adware removal
programs.

For example here are Pest Patrols removal instructions for netsetter....

http://www.pestpatrol.com/PestInfo/m/marketscore_netsetter_.asp

http://www.pestpatrol.com/PestInfo/M/MarketScore.asp

or try these from someone else...

http://www.marioncomputer.com/internet/Help/netsetter.htm

Manual instructions can sometimes very tricky to follow and involve editing
the registry but usually work well. Just be sure to make a restore point
first and be very careful not to delete/change the wrong registry entry.
Frequently spybot will already have deleted most of them so it's just a
matter of ticking them off as you follow the instructions.

Colin

Hi, my wife installed some software on my Windows xp machine and it

contained some spyware stuff. I uninstalled the software, and ran both
Adaware, and spybot and they indicated removal of the items. However, I get
two issues. There is a netsetter registry entry that recreates itself after
reboot of the machine, and in the Lan settings, in the address line, a
reference to www.compete.com/pane...... When I remove this reference, I
loose internet access, until I restart IE, but once IE restarts, that
reference is back as well. I am fairly knowledgable in computers, and am
having trouble resolving this. The netsetter is picked up by adaware every
time its run after a reboot but I"m not sure if its doing anything else.
When I remove the reference for the compete.com, and then try to browse the
web, I get the "detecting proxy settings" message, then an error message in
reference to cannot find yada yada yada.. These both are data harvesting
items (not sure they're related, don't think so) which I want to get
removed. I'm running WinXP Pro, and IE6 with all the latest updates.
Please help! Need advise/ideas on how to remove these 2 items permanently
and still have internet access. I'm also using a broadband cable connection
if that helps. Currently at work, but will be monitoring this today. If
you need specific info, I can try to get it, or it will have to wait until
my return home this afternoon. Thanks for any and all help in advance!

 

[Guest]

CWatters, I actually have already been there, and the things that those sights recommend for manual removal, don't exist on my machine, this is why I'm not sure that the netsetter/marketwatch is still actually functioning, but it does still recreate the registry entry on every reboot. Bob, yes, I have seached several places, and several different ways regarding both, and have been largely unsuccessful in finding anything about the compete.com item, other than reference to hijackthis program logs, which those particular entries don't seem to gain any attention? Thanks again!

Jason

 

[Guest]

Netsetter and many other spyware\adware programs frequently add keys in the registry that have either a numerical or letter designation only or a combination of both. This can be the problem as that key is designed to reinstall the startup if it is either removed or deleted. In most cases this now becomes an in depth problem. You can use tools like JV16 power tools and then do a registry search for Netsetter or attempt the search yourself. If you want to attempt it yourself then go>start\run and type in regedit and click ok or hit enter on your keyboard. Now click edit\find and type in Netsetter and hit find next. Then it will find and highlight the entries. Right click on those entries and then click delete. Be sure that it is the exact key on the left or subkey on the right as deleting any incorrect key here could cause you some problems. Then click f3 and it will look for the next entry. You may need to do this a dozen times or more to get all the entries. Do it until you get a "finished searching the registry" box. If you are unsure of this and would like to attempt a remote application share and have me do a registry search and show you how it's done let me know by e:mail. Good luck.

 

[\(yet another\) Steve]

Try posting your HiJackThis log in this forum and ask for help. You should
also read their posting rules at the beginning of the post list.

http://www.dslreports.com/forum/security,1

Steve

CWatters, I actually have already been there, and the things that those

sights recommend for manual removal, don't exist on my machine, this is why
I'm not sure that the netsetter/marketwatch is still actually functioning,
but it does still recreate the registry entry on every reboot. Bob, yes,
I have seached several places, and several different ways regarding both,
and have been largely unsuccessful in finding anything about the compete.com
item, other than reference to hijackthis program logs, which those
particular entries don't seem to gain any attention? Thanks again!!

 

[Guest]

Thanks for the advise, but, I did just that, went into the registry editor, removed the only key there was related to netsetter, and after reboot, it returns.. Possibly should search also for a market watch key I guess too? And still haven't been able to find a solution to my bigger problem, the compute.com reference in Lan settings? Automatically detect settings is selected, as I believe it has to be for my ISP provider? Use automatic configuration script is unchecked, but it shows a path to a url on www.compete.com. I can remove it via clicking on the use automatic configuration script and deleting the entry, then unchecking the box again. But after doing so, I no longer have internet access. Upon a restart of IE, then the entry returns?

Jason

 

[Chuck]

Hi, my wife installed some software on my Windows xp machine and it contained some spyware stuff. I uninstalled the software, and ran both Adaware, and spybot and they indicated removal of the items. However, I get two issues. There is a netsetter registry entry that recreates itself after reboot of the machine, and in the Lan settings, in the address line, a reference to www.compete.com/pane...... When I remove this reference, I loose internet access, until I restart IE, but once IE restarts, that reference is back as well. I am fairly knowledgable in computers, and am having trouble resolving this. The netsetter is picked up by adaware every time its run after a reboot but I"m not sure if its doing anything else. When I remove the reference for the compete.com, and then try to browse the web, I get the "detecting proxy settings" message, then an error message in reference to cannot find yada yada yada.. These both are data harvesting items (not sure they're related, don't
think so) which I want to get removed. I'm running WinXP Pro, and IE6 with all the latest updates. Please help! Need advise/ideas on how to remove these 2 items permanently and still have internet access. I'm also using a broadband cable connection if that helps. Currently at work, but will be monitoring this today. If you need specific info, I can try to get it, or it will have to wait until my return home this afternoon. Thanks for any and all help in advance!

Jason

Jason,

Start by downloading LSP-Fix from <http://www.cexx.org/lspfix.htm>,
and CWShredder <http://www.majorgeeks.com/download4086.html>.

First, run CWShredder.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155> and Spybot S&D
<http://security.kolla.de/index.php?lang=en&page=download>, both of
which are free and very trusted crapware detectors and removers.
1) Install and run Spybot. First update it ("Search for updates"),
then run a scan ("Check for problems"). Trust Spybot, and make all
recommended deletions.
2) Install and run HijackThis. Do NOT make any changes immediately.
3) Have your HJT log interpreted by experts at one or more of the
following forums (and post it here):
<http://forums.tomcoyote.org/>
<http://63.247.79.145/~coyote/forums/index.php?act=idx>
<http://www.wilderssecurity.com/index.php?board=17>
<http://forums.net-integration.net/index.php?s=8a1e9d7c1978cff54ca06a3210c7c1b0&showforum=32>
<http://www.spywareinfo.com/forums/index.php?s=68ddc23721b063d5411ece09e5ac93f9&showforum=11>
(The latter may or may not respond for you as I have read reports that
the SWI site is currently under DoS attack). All of these forums
appear to be rather busy right now, so be patient.

If removal of any of the spyware affects your ability to access the
internet (some spyware builds itself into the network software, and
removal may damage your network), run LSP-Fix.

BTW, please read this article about Cross-Posting vs Multi-Posting:
http://www.uwasa.fi/~ts/http/crospost.html

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[CWatters]

Could this be a hosts file thing? I mean perhaps there is an entry in a host
file redirecting www.compete.com/pane etc to somewhere nasty that repairs
the adware?

 

[Li'l Roberto]

Hi, my wife installed some software on my Windows xp machine and it

contained some spyware stuff. I uninstalled the software, and ran both
Adaware, and spybot and they indicated removal of the items. However, I get
two issues. There is a netsetter registry entry that recreates itself after
reboot of the machine, and in the Lan settings, in the address line, a
reference to www.compete.com/pane...... When I remove this reference, I
loose internet access, until I restart IE, but once IE restarts, that
reference is back as well. I am fairly knowledgable in computers, and am
having trouble resolving this. The netsetter is picked up by adaware every
time its run after a reboot but I"m not sure if its doing anything else.
When I remove the reference for the compete.com, and then try to browse the
web, I get the "detecting proxy settings" message, then an error message in
reference to cannot find yada yada yada.. These both are data harvesting
items (not sure they're related, don't think so) which I want to get
removed. I'm running WinXP Pro, and IE6 with all the latest updates.
Please help! Need advise/ideas on how to remove these 2 items permanently
and still have internet access. I'm also using a broadband cable connection
if that helps. Currently at work, but will be monitoring this today. If
you need specific info, I can try to get it, or it will have to wait until
my return home this afternoon. Thanks for any and all help in advance!

Jason

I had a simillar problem recently with a win98 machine, it was a pain
to fix but the way I found it was to search through C:\windows\system
for files created on the date that the problem started . I then
renamed suspicious ones to *.old until it would boot without
displaying the rouge web address as the home page.
Look for "DOS" exe icons, you will probably will have to enable show
all protected and system files .

rgds
Li'l Roberto

 

[Terry]

Just wanted to say thanks a million! I have lost sleep
over this and racked my brain trying to remove this sucker
from my computer. I appreciate it sincerely! Blessings and
Peace from Terry.
---------------------------

-----Original Message-----
Netsetter and many other spyware\adware programs

frequently add keys in the registry that have either a
numerical or letter designation only or a combination of
both. This can be the problem as that key is designed to
reinstall the startup if it is either removed or deleted.
In most cases this now becomes an in depth problem. You
can use tools like JV16 power tools and then do a registry
search for Netsetter or attempt the search yourself. If
you want to attempt it yourself then go>start\run and type
in regedit and click ok or hit enter on your keyboard. Now
click edit\find and type in Netsetter and hit find next.
Then it will find and highlight the entries. Right click
on those entries and then click delete. Be sure that it is
the exact key on the left or subkey on the right as
deleting any incorrect key here could cause you some
problems. Then click f3 and it will look for the next
entry. You may need to do this a dozen times or more to
get all the entries. Do it until you get a "finished
searching the registry" box. If you are unsure of this and
would like to attempt a remote application share and have
me do a registry search and show you how it's done let me
know by e:mail. Good luck.