http://adserver.sharewareonline.com/...?Referrer=acpa


The above link is what keeps popping up when I open my homepage and try to type in a url and sometimes when I try to open a page from google.

I'd just updated my Ad-Aware to their new program today and it helped with many popup problems I've had this past few days. I finally got rid of the DSO Exploit (5) errors that Spy Bot kept bringing up. I just cannot get rid of this
irritating pop up from adserver.

Thanks in advance.

fredg

Hi,
This pop-up is probably already located itself in your Registry.
Here are steps to rid a computer with most Spyware/Malware/Advertising programs:

If you think you already have Spyware/Advertising Ware in your computer, run these as follows:

http://www.security-related.com/download2.htm
Download: SpyBot Search & Destroy; 1.3

AdAware at:
www.lavasoftusa.com
Download: AdAware_SE

CWShredder at:
http://www.download.com/CWShredder/3...ml?tag=lst-0-1
(CWShredder is intended only for removal of CoolWebSearch files; placed as spyware on the harddrive). It is not a "stand alone" scan, but needs to be run.

All 3 of the above programs run better and much faster when run in SafeMode.
It's best to run the AdAware scan first; 3 times; then re-boot.
Then, run the AdAware scan again 3 times; then run the SpyBot. Then, run CWShredder.
Re- Boot.
Reason for running so many times:
Some of these trojans' files can be deleted the first time; leaving some others; but on re-boot, they re-write the files that were deleted.
Running multiple times deletes most of it the first
time.

If you wish to have a great program, after you clean out Spyware/Advertising Ware:
SpyWare Blaster 3.2
Great, free, program that STOPS spyware, trojans, home page hijacks, etc, BEFORE they get into your computer. Check it out at CNET at link:

http://www.download.com/SpywareBlast...ml?tag=lst-0-2

Two Tips:
If you notice the little green computer lights that show your dial-up connection to the internet staying on when they shouldn't be, located on the bottom right of the system tray, disconnect immediately and run AdAware. These lights staying on means that some URL is sending or receiving spyware/advertising ware to or from your computer, most of the time.

Other Tip: After being on the net, if you have visited any sites you don't really trust, then run AdAware BEFORE you shut down or re-start the computer. This will delete any Spyware easier, before the computer can configure it, set it up, spread it throughout the Registry, and make it more difficult to remove after re-booting.

If the above doesn't solve the issue, please post back for steps on how to edit the Registry; and find the URL that is causing this.

Have you cleared out all cookies, History, etc, from Internet Explorer temp files?
Best of luck,
fredg

srobert11

Thank you for all of your suggestions. I had each program installed
except CW Shredder. I have installed it since your post.
I followed your instructions and ran each item 3 (sometimes 4) times.

I'm getting mixed messages. I have also installed VX2 add-on to Ad-Aware SE.
When I click it, it tells me system is clean, no VX2 files found. When I run Ad-Aware scan I keep getting 3 VX2 files. I have quarantined them, since they will not delete. One of them keeps coming back even though it has been put in quarantine. It is in my memory. The log reads: Warning!! VX2 object fund in memory (C:\WINDOES\system32\0266lcjslfo6.dll). It ask if I want it to remove it when I reboot. I say yes, but it doesn't happen!

When I run Spy Bot it tells me Congratulations...no items found.
Talk about being confused. Each program tells you something else.

I have installed Webroot Spy Sweeper. That has helped with many pop-ups including Clkoptimizer. I have all of them in quarantine as well.

I'm still getting my browser hijacked when I run a search, but not as often.
Any further suggestions about the VX2 in my momory?

Sorry to have been so long replying. Yesterday I did not have the time to run all items and scans in order. I appreciate your help very much.
Shirley

SESaskDFC

Howdy:

Lavasoft’s new plug-in VX2 Cleaner detects the malware VX2 and offers you the ability to remove it from your computer. Some users have experienced a very difficult variant of VX2 which cannot be removed by Ad-Aware. For those users which have this variant, we have developed a plug-in to help you remove this VX2 variant.

This VX2 variant registers itself in a way, which gives it system privileges. It also prevents the user from viewing this information by removing the user’s rights to do so. Furthermore it constantly monitors the registry and prevents any attempts to remove its associated values. This makes it very difficult for the user to manually remove it.

VX2 Cleaner plug-in:
- Close Ad-Aware and Ad-Watch (if running)
- Download the free VX2 Cleaner here
- Install the VX2 Cleaner
- Start Ad-Aware
- Go to “Plug-ins”
- Select the VX2 Cleaner plug-in and click “Run Plugin”
- If your computer isn’t infected, click “Close”.

http://www.majorgeeks.com/download4283.html

Murray

srobert11

As outlined in my message previous to this reply, I have Ad-AwareSE
add in tool called VX2. It says I'm not infected, but the scan shows
4 VX2 objects. 3 I could quarantine when I couldn't remove them but
one will not guarantine or remove!

What now?
Thanks

SESaskDFC

Okay.. what operating system and where does it say this "malware" is located on your system??

Murray

srobert11

OS:Microsoft Windows XP Professional Service Pack 1 (Build 2600)
AdAware says the Malware is running in memory.
I'll attach the last scan I just did, if that will help.

My main two problems when trying to search or use I.E. is I'm being
my browser is being "hijacked" I guess, to one of these two items.
http://adserver.sharewareonline/adse...m/ad080504.htm
Or/and as popovers and popunders
http://urllogic.com

I think I've got the clkoptimizer-aepesi.dll quarantined in spy sweeper. It has stopped coming up in Ad-Aware and SpyBot tells me my computer is clean.
Go figure.
Thanks again for the hlep

Attached Files

Scan Log 1-29-05.TXT (19.2 KB, 99 views)

SESaskDFC

Thank you for the scan..

Go into Registry and navigate to the following..

HKEY_CURRENT_USER: software\microsoft\internet explorer\toolbar\webbrowser: {0E5CBF21-D15F-11D0-8301-00AA005B4383}

Highlight the area I put in bold and delete it.. (make sure System Restore is disabled)..

Reboot and re-enable System Restore..

Murray

srobert11

Thank you for you help.
Sorry to be so much trouble, but how do I get into the Registry?
That is something I've never done.

60 year old grandmothers shouldn't be allowed to have computers!
Shirley

SESaskDFC

Start>Run type in regedit and press "okay"..

Make sure you look for the EXACT area your "trojan" shows up in..

Murray