Getting rid of Spybots

self ^ | 17 feb 04 | self

[OldCorps]

I've got this evil spybot, undertonenet.com on my computer. Neither spybot search and destroy or lavasoft adaware removes it. I run them regularly. I suspect it comes from the drudgereport, fwiw.

[OldCorps]

anyone have an idea of how to get rid of this spyware?

[Xenalyte]

What makes you think you've "got" something?

If a small separate window pops up when you visit Drudge, that's not necessarily spyware. Many Websites are set to pop you up an auxiliary ad window when you visit the main site.

[snooker]

How do you know you have it? What detected it can usually remove it.

[cweese]

...try running regedit from start/run menu (ok, i'm assuming your o/s is microsoft) and click edit/find and type undertonenet in the search box. if a reference to undertonenet is found, click delete and continue searching until you've found/deleted them all. good luck!...

[highnoon]

I use a 2000 PC and when a spyware ad keeps coming up and/or changing my homepage I copy the URL, go to my browser (ie6.0) tools button, internet security, privacy tab, edit button for web sites and paste the offending URL into the block catagory, seems to have worked so far for me. Good luck.

[babyface00]

I have had good success with this site

http://www.pestscan.com/Scan.asp

But you have to know what you're doing to remove them without buying the product (although that info is out on the web if you do a little digging)

[HuntsvilleTxVeteran]

Goto google and put in "undertow.com" , this goes to websites which tell you how to remove it.

[ECM]

Do a Google search on 'Spybot' (search and destroy).

[Ronin]

Do you have a pop-up blocker?

The one that comes with the Yahoo taskbar seems to work OK for me.

I used to run Avant browser which also blocked them nicely, until Gates got sneaky and slipped in a Windows Update that caused it to crash.

Now I am back on IE and hating it. Tried Mozilla, but don't like it much.

[js1138]

http://www.javacoolsoftware.com/spywareblaster.html

[the_One_Neo]

I've spent the better part of 8 hours trying to remove all the spyware, adware, and the like off a friend's computer. His daughter somehow loaded the computer with so much spyware, before I got to it the windows Start button wouldn't even work. To even interact with windows at all, I had to load the task manager and kill a bunch of processes I didn't recognize. I was able to find at least three spybots, several ads and several viruses. The worst was one called Zesty Find, which is a hijacking program. I would type in www.foxnews.com or any url and every 2nd to third time my browser would be hijacked and either open up 5 windows or close all my browsers. It was horrible. Luckily I found this site...

Computer Cops

I didn't actually need to do this myself, but they have a forum. If you run this program...

hijackthis

You can post the log and they help you clean up your system. I still may have to do this on my friend's computer, but as of now he's fine again.

Good luck...

[dfwgator]

Recently I dealt with a nasty bot on a friend's machine. This thing would automatically regenerate the registry entries every time I deleted them, and made it impossible to delete the .dll file that was generating the entries and popups. Finally had to reboot into Safe mode to delete the little bugger and clear the registry.

[knarf]

This is worthy of a bump and a keeper.

[Johnny Gage]

Bump for future reference.

[tall_tex]

I agree. Bump & Keep.

[dfwgator]

Do a Google search on "Peper Virus" this is the nasty type of problem I was referring too. It requires a lot of manual work to resolve in addition to running Spy Bot et al.

[dfwgator]

Peper Trojan

Overview
Peper Trojan, also called Troj/Peper-A, Trojan.Peper.A and SandBoxer, downloads files to the user's computer, possibly adware which will open pop-up windows.

Some state that the trojan uses random filenames and registry entries, but it seems to be pseudo random (?). Extremely hard to detect, Bazooka will try, but will most likely fail to detect it.

A clear sign of infection is a 14 character long registry value starting with a number, located in 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'. Another indication of infection is random named processes listed in the Task Manager's process list.

I have not been able to find out who developed the trojan or how it gets on the end-user's systems. Please let me know if you know more about the Peper Trojan.

Classification
Trojan Horse

Files
Amh4V.exe, FmrCj.exe, JvfMa7R.exe, SjrZsY.exe, Iei1NKe7.exe, CpaFG.exe, DozMu4.exe, Cio9f.exe, Ryf9m24V.exe, Idk277g.exe, Oval73H.exe, Yfk8.exe, LgnJ8V3.exe, YmxB.exe, MtyJ62.exe, Szep85ln.exe, XioVQ8s0.exe, Corx5Ux.exe, IpwoDw.exe, Xej7.exe, Kvw1.exe, FqbPw5.exe, HqoX.exe, Cjo9f.exe, NuaK63H.exe, Fdjd3o.exe, AozDF.exe

[mlbford2]

bmp

[MississippiMan]

Be very careful plunking around in the registry if you don't know exactly what you're doing. Delete the wrong thing and create a nightmare.

MM

[RippleFire]

Try FireFox (also from Mozilla) - http://www.mozilla.org/products/firefox/