Need help killing annoyware/spyware/ whatever ~~ Temujin - Pls read the moderator's message in this thread.

[Temujin2k2]

Hi. Stupid me clicked on an unidentified executable that installed itself on my WinME partition. It is that internation porn calling program that claims to only charge you a "small" fee to dial some number. I deleted and uninstalled immediately and scanned my system using Adaware 5.62. However, despite deleting the "Gamble online" icon and everything associated with "fo-download" including all the directories, it still pops up on boot with a window that says "extracting html files" and automatically launches my browser and fetches some ads.

I have gone through the entire registry, startup folder, win.ini, system.ini, autoexec.bat and config.sys and anything else I can think of to get rid of it. I suspect it's embedded itself in one of the OS's dll or something. It only pops up after boot and logging onto windows. Hitting cnt-alt-del when the window appears reveals "winoldap" so it's rather difficult trying to pinpoint the exact file and delete it.

Does anyone know how to delete this beast? Thanks.

 

[mrbass]

you did msconfig (winme have that?) and the startup tab.

 

[AnandTech Moderator]

Temujin2k2,

Please enable your PM's and contact us about restoring your old account.

Thank you,

AnandTech Moderator

 

[osage]

I think if you format/mbr that should get rid of it.

 

[bevancoleman]

Have you updated the add list in Ad-aware? they may have added it to their list.

 

[Temujin2k2]

<< Have you updated the add list in Ad-aware? they may have added it to their list. >>



Yup, I have updated it to the lastest which is 02/02/2002. I was actually hoping to get rid of this annoyance without a reformat.

Somethings I found out about this:
a) it starts BEFORE everything in the startup tab. Filemon starts too late to find out the exact filename. So it's hidden in win.ini or system.ini
b) It uses a file in the Netscape folder called "xppref32.dll"
c) Deleting Netscape and all subfolders prevents the browser from popping up but the html file still extracts.

This is just annoying... it just like accidentally clicking on "Bonzi Buddy".

Anandtech Mod: PM sent.

 

[bevancoleman]

If you can work out what it is called (or what files it installs) you may be able to find a removal tool