PDA

View Full Version : begin2search - Very Annoying Spyware



Ciscoheat
09-15-2004, 08:26 PM
Maybe some of you have experience with this very annoying peice of spyware that is tricky to remove..

Anyway it installs a load of shortcuts on your desktop and ads a seach bar to IE. I have spent two hours tonight getting rid of this crap and thought I'd warn all the UCP members about it.

Anyway to get to the point, if you have it and want to get rid of it, do the following;

Delete the following files:
winb2s33.dll
winb2s32.dll
AdPop.dll
winb2s32.dll
II22.exe
killinternetpops.ico
kill all spyware2123.ico
ke612.ico
download-music-now.ico
creditcard12.ico
kxp312.ico
creditcard12.lnk
download-music-now.lnk
ke612.lnk
kill all spyware2123.lnk
kxp312.lnk
Install.cab
Install.cab

Delete the following registry keys:
winb2s.omoc.1
winb2s.omoc
winb2s.cmod.1
winb2s.cmod
winb2s.amo.1
winb2s.amo
winb2s.ohb.1
winb2s.ohb
winb2s.momo.1
winb2s.momo
winb2s.iiittt.1
winb2s.iiittt
winb2s.dbi.1
winb2s.dbi
{52FE5233-367C-4EFB-BDD7-0BE4D212C107}
{07E9CDF4-20D2-46B1-B681-663968F527CE}
{7C5E5671-7A1D-4AE8-91F0-496ADF2825F7}
{4D568F0F-8AC9-40AB-88B7-415134C78777}
{09C14745-90FD-42D1-9276-4924D7DBC274}
{A8BB1898-24FA-4957-A12D-015A1A45E65C}
{BC622BEB-F0CD-4A14-B134-6B4CE442DAB1}
{081DE2F6-927B-4AA9-88C1-F531C9387383}
{4D568F0F-8AC9-40AB-88B7-415134C78777}
%systemdir%\winb2s32.dll
Ad Pop
{07E9CDF4-20D2-46B1-B681-663968F527CE}
{FE1A240F-B247-4E06-A600-30E28F5AF3A0}

Delete the following registry values:
{52FE5233-367C-4EFB-BDD7-0BE4D212C107}

I am just posting this because of the trouble I had with it. If the mods think this is an inapropriate post please remove.

Egg Nog
09-15-2004, 08:31 PM
Not getting annoying spyware like this is one of the best reasons to use Mozilla.

http://www.mozilla.com

Blue Supra
09-15-2004, 08:36 PM
yeah i have had trouble with spyware but now i just got a really good firewall that doesnt let anything get to the internet without prompting me.

Ciscoheat
09-15-2004, 08:46 PM
Just installed firefox, thank eggnog. I like the look of it and hopefully it will stop crap coming up again.

Blue - I have Norton Personal firewall, but still got the spyware. What firewall do you have?

Rockefella
09-15-2004, 09:17 PM
zone alarm works well supra

taz_rocks_miami
09-15-2004, 09:25 PM
Not getting annoying spyware like this is one of the best reasons to use Mozilla.

http://www.mozilla.com

Or a Mac:) 99% of spyware, viruses and worms have no effect on it :cool:
Glad you got rid of it Ciscoheat :)

Blue Supra
09-15-2004, 09:53 PM
iv got Nortons 2004 with live updates, works for me;)
although im thinkn of gettin a free one as you have to pay a subscription fee for the live update once a year:(

<---------------500th POST!!!

Egg Nog
09-15-2004, 10:03 PM
Or a Mac:) 99% of spyware, viruses and worms have no effect on it :cool:
Glad you got rid of it Ciscoheat :)

Very true, however it might be a little bit cheaper for us PC users to download Firefox than it is to go out and by ourselves a mac ;) :D

@wall
09-15-2004, 10:44 PM
I have major problems with spyware at work (i work in I.T.) idiots always manage to load their PCs up with different types of spyware/adware.

Common fixes I do are with IE disabling install on demand (other) and also disabling third party browser extensions (as very few are ever useful). Also this:

http://www.winpatrol.com/

the program is ace. it's free, and it tells you every time an app tries to install a browser helper object (toolbar) and when new startup programs are added. It also gives you the option to dissallow that and delete the registry entries automatically!

Karrmann
09-16-2004, 04:10 AM
you wanna know which one is the best? Zone Alerm pro, that's what I have, but how do I program it to trust UCP?

Matra et Alpine
09-16-2004, 07:23 AM
you wanna know which one is the best? Zone Alerm pro, that's what I have, but how do I program it to trust UCP?
To add to a Host or Site to the trusted Zone:
1. Select Firewall|Zones.
2. Click Add, then select Host/Site.
The Add Host/Site dialog appears.
3. Select Trusted from the Zones drop-down list.
4. Type the fully qualified host name in the Host name field. << ultimatecarpage.com
5. Type a description of the host/site, then click OK.

Matt
09-16-2004, 07:56 AM
I have major problems with spyware at work (i work in I.T.) idiots always manage to load their PCs up with different types of spyware/adware.

Common fixes I do are with IE disabling install on demand (other) and also disabling third party browser extensions (as very few are ever useful). Also this:

http://www.winpatrol.com/

the program is ace. it's free, and it tells you every time an app tries to install a browser helper object (toolbar) and when new startup programs are added. It also gives you the option to dissallow that and delete the registry entries automatically!

Assuming you use W2K or newer, you could just change the local user account to User instead of Administrator. I have found that to prevent 99% of accidental spyware installations. Our corporate antivirus program also has a spyware detection module that blocks the launch of spyware programs.

byronleehk
09-16-2004, 09:10 AM
Thanks @wall for the winpatrol link :)

VtecMini
09-16-2004, 09:56 AM
iv got Nortons 2004 with live updates, works for me;)
although im thinkn of gettin a free one as you have to pay a subscription fee for the live update once a year

Have you got the CD for it? Cos I have Norton Internet Security 2002, which only lasts a year. But when it decides that the time for more money has come, I just back up all my stuff onto CDs or DVDs, making sure I have all my driver disks handy and all my regularly used programs handy, then format the hard drive. Once I've reinstalled windows, the first thing I do is reinstall Norton, then I have another years subscription!

Its arguably a lot of hassle for the sake of £20 for another years subscription, but I usually end up formatting it before then anyway, cos I find my machine always gets bogged down after a while anyway. It's also the best way to insure you remove every single bit of spyware. :)

The other thing I'd recommend is Spybot (http://security.kolla.de/). It's what I use and I have no trouble with spyware. Though I use Firefox too. I'm not saying spybot is any better than Winpatrol by the way, cos I've never tried winpatrol, I'm just saying it's the one I use and I have no worries with it.

Ciscoheat
09-16-2004, 03:29 PM
Thanks for the tips on winpatrol and firefox, I thought that having a firewall, antivirus and spybot were enough, but guess not. No more IE for me! I am a definate firefox convert!!

DodgeNitroBIRM
09-16-2004, 04:07 PM
Where did you find those files at? I can't seem to locate them for some reason... :confused:

@wall
09-17-2004, 06:24 PM
Thanks @wall for the winpatrol link :)

no problem ;)

r1ckst4
09-19-2004, 05:32 AM
some spyware remover wont work on real Nasty ones... to get rid of these... u simply hav to send $100 to me and i will give you a rope so u can drag ur comp behind ur car on the street...lol jokes...

nah seriously... to get rid of real nasty ones... download HijackThis, run it... DONT DO ANYTHING YET! save the log... and post ur log on a forum adn ask them to check it for u..... here's the link http://computercops.biz/index.php the expert there will tell you what to delete... ;)