Hello I tried everything to get rid of approvedlinks (HT and adaware). Can someone help this newbie (soory HYlian-lynk!) on this? This is the log C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\LEXBCES.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\System32\Linksts.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\Creative\ShareDLL\MediaDet.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\gebruiker\Local Settings\Temp\Tijdelijke map 3 voor hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://approvedlinks.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://approvedlinks.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://approvedlinks.com/sp.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://approvedlinks.com/sp.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.exe /run O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [iedll] C:\WINDOWS\iedll.exe O4 - HKCU\..\Run: [loader] C:\WINDOWS\loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9221B1FB-91F5-4BD3-98EF-C6EFF6A743FD}: NameServer = 195.121.1.34 195.121.1.66 I tried a few things but I must be doing something wrong. It keeps appearing and I looked in this forum and tried some solutions. No workie! Thanks in advance! Mart

Hi Guys!! I fixed it myself (I think). Thanx anyway Mart

Hey mart i have the same problem, could you tell me how you got rid of it--please? I can't seem to get rid of it. Thanks for your time Henry

Hi.I had the same problem as you.And the solution to fix the problem is very easy.Just open this approvedlinks page in your browser(type www.approvedlinks.com).When you are done with this at the bottom of the page you'll find a link: "if problem send mail here".Open it and open the next link:"To get tech support click here".And download the programme that will uninstall this adware.And that's all.In my case it helped.

First my thanks to Pablo who provided the link above. It did in fact fix the problem. However, this is the stuff that makes me really angry. When you load the program CWShredder.exe found at http://super-spider.com/antispy/CWShredder.exe (the link you get to from Pablo's instructions) you get this message: This tool will find and destroy all traces of the CoolWebSearch (CWS) hijacker on your system. This includes: * Redirections to CoolWebSearch related pages * Redirections when mistyping URLs * Redirections when visiting Google * Enormous IE slowdowns when typing * IE start page/search page changing on reboot * Sites in the IE Trusted Zone you didn't add * Popups in Google and Yahoo when searching Click 'Next' to start removing the infection The vendor of the product calls this an infection and should have his PC and internet access revoked and then he/she should be hung in the courtyard for beatings by all who became infcted. Glenn

Here is some more usefull information taken from the following link: http://forums.techguy.org/t169187/s94a5431d3b7f85f1cb7cf808180a58dc.html The posting reads: You could also download Ad-Aware 6 and have it do a thorough cleaning of your unwanted files. Go here for the free Ad-Aware 6 Personal Build 181: http://www.lavasoft.de/support/download/ Launch the program ... on the start-up screen, you will need to first run the Webupdate Feature (globe at the top), or click "check for updates" to get the Reference File up to date. Please use the Custom Scan with Memory and Both registry scans ON. Also.... make sure that you activate IN-DEPTH scanning before you proceed. Then see that you have these options checked: Under Ad-Aware 6 Settings, Tweaks, Scanning Engine: "Unload recognized processes during scanning." Under Ad-Aware 6 Settings, Tweaks, Cleaning Engine: "Automatically try to unregister objects prior to deletion." "Let Windows remove files in use after reboot." Next ... Run Ad-Aware 6. Mark the objects you wish to eliminate for removal. There are many options available with a right-click. Make a Quarantine only if you do not have the Auto-Quarantine option ON. Then choose "Next" to remove the chosen objects. Finally ... Reboot Once you are cleaned up, you might want to visit http://www.wilderssecurity.net/index.html and download the following: SpywareBlaster v2.6.1 SpywareGuard v2.2 These will prevent Active-X drive-by installations, as well as provide real-time browser hijacking protection. Lastly, consider installing IE-SPYAD, a registry file that adds a long list of known crapware to the Restricted Sites of your Internet Explorer