I visited a website last night for the pc game the Sims. This sim fan site had a couple pop up ads that began installing something to my computer. I tried to stop it and couldn't. Afterward I ran Spybot and Adaware and came up with 219 things total etc etc anyway removed EVERYTHING. Adaware said it couldn't remove all of it but would try again when I rebooted. I immediately rebooted and then it said something was "bridge.. driver?" I can't remember what it said but that it had been removed, apparently I shouldn't have removed it as it made it sound like this was something my pc needed. So, I did a system restore to the previous day. All seemed to go well. I ran Trend micro online virus scan and it found nothing. Ran adaware and it found 2 more files that I promptly removed. Today I am running McAfee and it found a trojan, "exploit-ByteVerify" so I've deleted that with McAfee because it says it cannot be cleaned. The thing is McAfee is also showing Adaware-SearchCentrix, Adaware-BetterInet,Adaware-NetPals,Adaware-Ezula.. why does it show theses? They were listed as "potentially harmful". I am confused, please tell me if I'm doing this right, what more should I do?
Newbie to technical stuff needs your expertise!

am not much for mcafee or norton as they dont get every virus and sometimes crash

i found avg about 5.5yrs ago and never looked back it insures 100% detection..try it
and u probably throw that mcafee away choice is yours

www.grisoft.com click download lefthand side click avg 6.0 free.

once u scan your drive with it if u get no viruses what u need is something to go along with adware...

try useing this for a backup to adware it will tell ya whats in your reg that u can delete..of course anything that says (tracking cookie, malware, spyware,adware,searchbars,etc)

be sure to know what programs u have on your computer as it brings them up to last thing u want to do is delete a (good) reg string.

http://www.no-spybot.com/

i've done alot of control testing on sites with known virus trojans and such and i found that zonealarm configured right will block everysingle one out..here is an idea for a good computer setup

avg 6.0=real antivirus protection
zonealarmpro=great firewall
ad-ware=good for finding spy malware

registry mechanic 2.1=good for finding strings and broken strings leftbehind.

hope these help and good luck.

I am confused. Do I delete these in McAfee or should I leave them alone? It says they cannot be cleaned. I do not understand why McAfee is telling me Adaware is potentially harmful either. Thanks for posting those links, avg, might check that out sooner or later. I've got my McAfee open while I wait on what to do I just don't know that much about computers or what it means for all (listed them above) of these that are showing up in here. Should I ignore them and leave them alone?

Oh I should mention this.. I had turned off my msn pop up ad blocker and then forgotten to turn it back on before going to the site with the terrible pop up ads.

I knew this site I went to was having some strange issues with their pop up ads and Knew not to go there unless I had my pop up ad blocker on.. well d'oh me for forgetting it was off.

I am looking at this no-spybot site and I have spybot and adaware already. I just don't understand why McAfee is showing those in there and what I need to do next. I did delete the Trojan.. do you think I should run another system scan just to be sure that the trojan is actually gone too?

Ok I'll just be quiet now and wait for someone to help again lol

ty ty ty by the way!!

Tbh I don't think you have a problem with McAfee misbehaving, I actually think your system may be fully loaded with spyware and trojans, hence all the chaos.

I'd advise you to scan your system with McAfee or maybe an online scan with housecall @ trendmicro.com, Ad-Aware, Spybot S&D, Trojan Remover CWShredder (all with updated virus definitions). If you still have problems, the most sensible thing would be to post a HijackThis log.

Download Hijack-This Here

ER4S3R.
Hope That Helps.

____________________________________________
### Nobody believes the official spokesman, but everybody trusts an unidentified source ###

Report Offensive Follow Up For Removal

Tazzyness

Sounds like you have a pretty nasty spyware problem...will take a few steps to fix it all.

You can let mcafee delete what it can...all those things you say mcafee is finding is adware junk. Mcafee will detect some adware and spyware items now too. (potientially unwanted programs)
Mcafee isn't saying Ad-Aware is bad...it's telling you that you have several adware programs.
Yes it can be confusing looking at the list mcafee displays when new to this kind of thing.

That bridge.dll thing....that is another adware trojan, it was safe to delete. You get errors about bridge.dll because there are still instructions in registry telling windows to load that file during startup.

I don't know if you set up ad-aware to its best potiential but follow instructions here: (after Updating Ad-aware)

How to set up Ad-aware Properly

Once set up like that page suggests...go offline to run the scan.
Shut off your mcafee to prevent conflicts.
Use the custom scanning option in ad-aware.
Allow it to remove all it finds.
Reboot to finish cleaning process.

There will be still things to fix manually...so post your hijack log as ER4S3R suggested.

Make a new folder for hijackthis and put hijack in that folder. It makes backups of stuff fixed in case something goes wrong.

Once unzipped, run hijack, click scan, the scan button changes to save log button, click save log, click save...it will pop up in notepad. Hit ctrl+a keys on keyboard to select all text, right click text, select copy, right click in reply window here, select paste.

Don't fix anything with hijack yet...most of what you see is safe or even essential.

Wait for further instructions.

I never give up!

Windows Update

I sure appreciate y'all responding to this thread!!! I tend to freak out and be impatient and well I did go ahead and delete the things that came up in McAfee. I then used spybot and adaware again and it was clean. Then I ran McAfee again and it was clean. I think my pc is ok now? I will hold onto the info you've given for next time and if you think I should still follow thru with the suggested advice even though my pc seems clear I will do it. What do you think?

Ok and one more thing will installing avg on top of having mcafee be ok? can I do that? I had to remove my norton today (which was severely outdated anyway) to have mcAfee which was free with my dsl I found out. I'd like to be sure that I'm covered in the future, if I could have both avg and mcafee that would be ideal I think.

Ok I was wrong, I'm not in the clear. I just ran a search for Ezula and have a bunch of stuff showing up. I have changed my adaware settings to the custom ones and am running another scan. When I get the log do I just post here with it or make a new thread with it and is this even where I would post that log?

thx y'all for helping me thru this, I feel like I'm getting a few grey hairs out of this.

Logfile of HijackThis v1.97.7
Scan saved at 9:58:05 PM, on 4/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN\MSNCoreFiles\MSN.EXE
C:\Documents and Settings\Tazzy\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/yessentials_cq/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thesims.ea.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKCU\..\Run: [Yahtzee.exe] C:\DOCUME~1\Tazzy\Desktop\YAHTZE~1.EXE /r
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Popup Eliminator (HKLM)
O9 - Extra 'Tools' menuitem: Popup Eliminator (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bresnan.net
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt1_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} (shizmoo Class) - http://www.uproar.com/applets/activex/shizmoo/flipside_web18.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
O16 - DPF: {1671869C-25B3-4C80-9446-8AE6111F8765} (MaxisHotDateTeleX Control) - http://thesims.ea.com/teleport/hotdate/MaxisHotDateTeleX.cab
O16 - DPF: {2DAE59A1-B355-4653-8D33-33A3A8F8C078} (MaxisVacationTeleX Control) - http://thesims.ea.com/teleport/vacation/MaxisVacationTeleX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
O16 - DPF: {5D1E3FA5-64FF-4387-9418-F1D67AFB2247} (MaxisSuperstarTeleX Control) - http://thesims.ea.com/teleport/superstar/MaxisSuperstarTeleX.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/PEInstaller.exe
O16 - DPF: {8629CFEB-C31A-4429-9BB0-8765A8A24FDA} (MaxisUnleashedLotTeleX Control) - http://thesims.ea.com/teleport/unleashed/LOT/MaxisUnleashedLotTeleX.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37765.9858217593
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://hoylegames.sierra.com/cab/WONWebLauncherControl.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {A44B714B-EE0F-453E-9300-A69B321FEF6C} (MaxisSimsFamilyTeleX Control) - http://thesims.ea.com/teleport/families/MaxisSimsFamilyTeleX.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

Please won't anyone tell me what to do? I don't understand this log thing. Please??

OK Tazzyness, fix these: -

If you have NOT set your homepage as yahoo.com fix: -

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/yessentials_cq/defaults/sp/*http://www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html

-

Fix the following entries: -

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thesims.ea.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R3 - Default URLSearchHook is missing

-

These three entries look suspicious, you can delete them, but if you have any problems you can always restore them with HijackThis.exe: -

O4 - HKLM\..\Run: [VTPreset] VTPreset.exe

O4 - HKCU\..\Run: [Yahtzee.exe] C:\DOCUME~1\Tazzy\Desktop\YAHTZE~1.EXE /r

O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} (shizmoo Class) - http://www.uproar.com/applets/activex/shizmoo/flipside_web18.cab

-

If your ISP is Bresnan online than leave this entry alone, otherwise delete it: -

O14 - IERESET.INF: START_PAGE_URL=http://www.bresnan.net

-

If you play The Sims you can leave these, otherwise fix them: -

O16 - DPF: {1671869C-25B3-4C80-9446-8AE6111F8765} (MaxisHotDateTeleX Control) - http://thesims.ea.com/teleport/hotdate/MaxisHotDateTeleX.cab

O16 - DPF: {2DAE59A1-B355-4653-8D33-33A3A8F8C078} (MaxisVacationTeleX Control) -http://thesims.ea.com/teleport/vacation/MaxisVacationTeleX.cab

O16 - DPF: {5D1E3FA5-64FF-4387-9418-F1D67AFB2247} (MaxisSuperstarTeleX Control) - http://thesims.ea.com/teleport/superstar/MaxisSuperstarTeleX.cab

O16 - DPF: {8629CFEB-C31A-4429-9BB0-8765A8A24FDA} (MaxisUnleashedLotTeleX Control) - http://thesims.ea.com/teleport/unleashed/LOT/MaxisUnleashedLotTeleX.cab

O16 - DPF: {A44B714B-EE0F-453E-9300-A69B321FEF6C} (MaxisSimsFamilyTeleX Control) - http://thesims.ea.com/teleport/families/MaxisSimsFamilyTeleX.cab

I have also noticed a lot of things yahoo related like toolbars, games etc. I have left them alone since you might need them.

ER4S3R.
Hope That Helps.

____________________________________________
### Nobody believes the official spokesman, but everybody trusts an unidentified source ###

Report Offensive Follow Up For Removal

Good morning ER4S3R,

I have the MSN toolbar and really like it, can I keep that or do I need to change to Yahoo's toolbar to fix the adware that is still in my computer?

Also when you point out the different things to delete do I check mark them in hijack to have them removed?

I do play the Sims, matter of fact my homepage is http://thesims.ea.com/

I ran a search for Ezula and a ton of things are still showing up in my system. They are under documents and settings but when I try to find them in the physical folders I can't locate them. When you do a search for all files and folders and these come up I can dbl click on them and then each one is a zip and it will have at least 2 files in each of them.

Thanks again for helping me, if it weren't for you noticing I'm still here needing abc, 123 and being so patient I don't know what I would do.

Good evening Tazzyness,

You can keep your MSN toolbar, I have left that one out on purpose, so you can still use it. I've noticed you have various yahoo related toolbars and games which look harmless, but since you say your homepage is actually http://thesims.ea.com/. You might want to delete the yahoo entries and the various others mentioned, you can keep The Sims entries if you like.

When you want to delete entries with HijackThis.exe, simply double-click the HijackThis exe file, click scan, check entries that I mention and click Fix Checked.

Ezula is definitely adware, I think either system restore is interfering with Ad-aware, Spybot and McAfee from doing it's job or Ezula is running secretly in the background.

Check for a program called Ezulamain.exe running in the background( press Ctrl + Alt + Del & click processes tab). If you find it, select it and press end task, close the window. Next go to Start>Run>msconfig>select startup tab and uncheck the entry labeled Ezulamain.exe.

ER4S3R.
Hope That Helps.

____________________________________________
Beware of computer programmers that carry screwdrivers.

Report Offensive Follow Up For Removal

I did everything you suggested and when I rebooted my computer I got a black screen with 2 lines of type that read "non-system disk or disk error Replace and strike any key when ready"

I struck a key. It took me to my desktop and then I rebooted again to see if it did it again, in fact I've rebooted a few times since that message and haven't seen it since.

I ran a search for all files and folders for Ezula again and those are still showing up. I do not have the .exe file you mentioned and there is nothing for it (that I'm aware of) in add/remove programs.

Still need help removing Ezula. Any ideas?

>>>>> I got a black screen with 2 lines of type that read "non-system disk or disk error Replace and strike any key when ready"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This message usually appears if you started your computer with a floppy disk in the 3 1/2" floppy disk drive. Just push the Eject button on the front of the 3 1/2" Floppy Disk Drive, this will eject the floppy disk then push any key, the computer should start up on the hard disk, instead of the floppy drive.

Try this to remove Ezula

Download and use bazooka from HERE

Download and use the FREE version of Spy Sweeper HERE

ER4S3R.
Here to Help.

____________________________________________
Beware of computer programmers that carry screwdrivers.

Report Offensive Follow Up For Removal

This is going to sound terribly dumb I'm afraid LOL but I followed the first link so far and have located the ezstub.exe file that I need to remove and it says to "Open a command prompt (aka DOS window)" and I'm not sure what this means.

How do I open the command prompt?

Ty I didn't know having a disk inserted to the tower would make my computer do that lol.. I'm learning SO much!

Don't be afraid lol, that's the whole point of this forum, it's about sharing knowledge and helping each other.

Opening the command prompt is very simple just go to Start>Run>type command prompt.
To close the command prompt window, simply type exit.

ER4S3R.
//Signing-off for now

____________________________________________
Beware of computer programmers that carry screwdrivers.

Report Offensive Follow Up For Removal

Hey Tazzyness, don't delete this entry.

O4 - HKLM\..\Run: [VTPreset] VTPreset.exe

As far as i know it is a file related to the S3 graphics chip or card (what ever...i dont' know). Cuz i also have this same graphics chip, i mean its not a card. Its inbuilt with the motherboard. I got suspicious and searched for it. This file is in C:\WINDOWS\system32 forlder of my computer. U can find urs too. Right click the file and click properties. Go to "version" tab and u will see the S3 graphic company stuff written here. It comes with the latest driver i guess. So better not delete it.

Hey Tazzyness, don't delete this entry.

O4 - HKLM\..\Run: [VTPreset] VTPreset.exe

As far as i know it is a file related to the S3 graphics chip or card (what ever...i dont' know). Cuz i also have this same graphics chip, i mean its not a card. Its inbuilt with the motherboard. I got suspicious and searched for it. This file is in C:\WINDOWS\system32 forlder of my computer. U can find urs too. Right click the file and click properties. Go to "version" tab and u will see the S3 graphic company stuff written here. It comes with the latest driver i guess. So better not delete it.