PDA

View Full Version : BHO's not removed by Spybot



gilberto
2009-06-26, 14:29
I want remove 2 BHO's bellow using Spybot and I don't have sucess:

1)
{C41A1C0E-EA6C-11D4-B1B8-444553540000} (G-Buster Browser Defense)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: G-Buster Browser Defense
CLSID name: GbIehObj Class
description: G-Buster Browser Defense
classification: Legitimate
known filename: gbieh.dll
info link:
info source: TonyKlein
Path: C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\
Long name: gbieh.dll
Short name:
Date (created): 16/1/2009 05:16:00
Date (last access): 26/6/2009 08:30:44
Date (last write): 29/4/2009 08:55:04
Filesize: 294192
Attributes: archive
MD5: D4AC6DC87FD8C6575476FBFB44BFB998
CRC32: B92B7818
Version: 3.8.3.1

2)
{C41A1C0E-EA6C-11D4-B1B8-444553540003} (G-Buster Browser Defense CEF)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: G-Buster Browser Defense CEF
CLSID name: GbIehObj Class
Path: C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\
Long name: gbiehcef.dll
Short name:
Date (created): 20/8/2008 10:32:14
Date (last access): 26/6/2009 08:30:44
Date (last write): 27/1/2009 13:40:04
Filesize: 404032
Attributes:
MD5: 342503A85A961384A705725B2D97B123
CRC32: F8C35309
Version: 3.8.1.60

Could you Help me?Thanks

On Windows normal mode, even being very quickly, until I to made righ click on my computer/manager/services and applications, the Windows services.exe is using 99% of CPU, the machine stop, and I could not delete GPB Service.

On Windows safe mode, there are few prograns running and GPB service is stopped ( used only on Windows normal mode ).
Therefore I have time to make righ click on my computer/manager/services/GPB Service.
The problem is all that I try to change in 4 folders of GPB service ( general, logon, fails, dependencies ), I receive the message "It's not possible write in local computer".

Could you help me delete GPB Service?

tashi
2009-06-26, 16:05
Hello gilberto, :welcome:

Please start a new topic providing a HJT log after reading this: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Best regards. :)