Help please... I have found that paytime.exe was hidden on my computer and kept trying to change my home page settings for internet use ! I have managed with my firewall to now keep it stopped but want some advice as to if I should delet the file and what info has this program been taking from my computer.

Thanks

Happy New Year To You All :)

Im running window XP home use ! And have never had a problem like this ever.. Where could this have been picked up from as I'm always so careful about programs I down load and run on my home system.

Nice and easy really, just download and run Adaware (http://www.lavasoftusa.com/software/adaware/) and Spybot (http://www.safer-networking.org/) and this will remove this problem.

This kind of thing is dealt with in a lot of other threads in this forum.

Hope this helps

Next...


Instructions for use:
Download and run SpyBot

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED entries.
Reboot...

Next...

Download and run AD-Aware

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Reboot...



Also to really cover yourself run Trend Housecall (http://housecall.trendmicro.com/) on FULL settings to make sure you are clean.

Nice and easy really, just download and run Adaware (http://www.lavasoftusa.com/software/adaware/) and Spybot (http://www.safer-networking.org/) and this will remove this problem.

This kind of thing is dealt with in a lot of other threads in this forum.

Hope this helps

Thanks for the fast reply ! Sorry I'm new and getting used to searching the forum for topics... Im going to get on it now and clean my system up..

Once again many thanks and a Happy New Year to You

Hi,
This is a CoolWebSearch hijacker, that if run, will install an address on your computer.
If the suggestions about AdAware, etc, does not work, here is a link:
http://www.bleepingcomputer.com/forums/Remove_the_CWS_Paytimeexe_http_8122213149_indexphp-t16400.html

Scroll down about 1/2 way to "Removal Instructions".
Hopefully, AdAware, etc, will get rid of it.

Also, here is a link to CWShredder, which removes most CoolWebSearch Spyware:

http://www.trendmicro.com/cwshredder/

It also sometimes helps to run AdAware and SpyBot in Safe Mode.
Best of luck.

Thanks for all of your help I have run all the checks and managed to remove this little F**** off my computer. Im also in the middle of updating my windows bits and bobs and upgraded my fire wall.. My system scan seems to come up clean no.

Many Thanks

Hi,
You are quite welcome.
Another suggestion is to have a free program that normally stops this spyware, hijacking stuff, before it gets into the computer.
I use SpyWare Blaster; free from http://www.javacoolsoftware.com/sbdownload.html

Since using it, I haven't had a single spyware, hijacking, advertising program get into my computer. It integrates its "definitions" into the Restricted Zone of Internet Explorer.
Another good one is the one by Microsoft, recommended by many.

Hi,
You are quite welcome.
Another suggestion is to have a free program that normally stops this spyware, hijacking stuff, before it gets into the computer.
I use SpyWare Blaster; free from http://www.javacoolsoftware.com/sbdownload.html

Since using it, I haven't had a single spyware, hijacking, advertising program get into my computer. It integrates its "definitions" into the Restricted Zone of Internet Explorer.
Another good one is the one by Microsoft, recommended by many.

Thanks I have taken all the advice. My system seems to be running fast now lol and all the crap that should never have crept in has been removed, your all massive stars, thanks for all the support.