Adware keeps reappearing

[paulbemis]

Hi Again,
So I am still fighting this adware issue. When I run spybot, I get the following issue report. I go ahead and fix it, only to have the browser open a new window and take me somewhere again shortly there after. Any suggestions today?

Paul
____________________________________________________________
Microsoft.Windows.Security.InternetExplorer: [SBI $A3433CBF] Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-65919605-242604490-1238627039-1008\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALM ACHINE_LOCKDOWN\iexplo
re.exe
--- Spybot - Search & Destroy version: 1.6.0 (build: 20080729) ---
2008-08-14 blindman.exe (1.0.0.8)
2008-08-14 SDFiles.exe (1.6.0.4)
2008-08-14 SDMain.exe (1.0.0.6)
2008-08-14 SDShred.exe (1.0.2.3)
2008-08-14 SDUpdate.exe (1.6.0.9)
2008-08-14 SDWinSec.exe (1.0.0.12)
2008-07-30 SpybotSD.exe (1.6.0.31)
2008-08-18 TeaTimer.exe (1.6.2.23)
2004-04-27 unins000.exe (51.13.0.0)
2008-08-22 unins001.exe (51.49.0.0)
2008-08-14 Update.exe (1.6.0.7)
2008-08-14 advcheck.dll (1.6.1.12)
2007-04-02 aports.dll (2.1.0.0)
2004-05-12 borlndmm.dll (7.0.4.453)
2004-05-12 delphimm.dll (7.0.4.453)
2008-06-14 DelZip179.dll (1.79.11.1)
2008-08-14 SDHelper.dll (1.6.0.12)
2008-06-19 sqlite3.dll
2008-08-14 Tools.dll (2.1.5.7)
2004-05-12 UnzDll.dll (1.73.1.1)
2004-05-12 ZipDll.dll (1.73.2.0)
2008-08-05 Includes\Adware.sbi (*)
2008-08-19 Includes\AdwareC.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-06-03 Includes\Dialer.sbi (*)
2008-08-05 Includes\DialerC.sbi (*)
2008-07-23 Includes\HeavyDuty.sbi (*)
2008-08-19 Includes\Hijackers.sbi (*)
2008-08-19 Includes\HijackersC.sbi (*)
2008-08-05 Includes\Keyloggers.sbi (*)
2008-08-12 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-08-20 Includes\Malware.sbi (*)
2008-08-19 Includes\MalwareC.sbi (*)
2008-08-05 Includes\PUPS.sbi (*)
2008-08-19 Includes\PUPSC.sbi (*)
2007-11-07 Includes\Revision.sbi (*)
2008-06-18 Includes\Security.sbi (*)
2008-08-19 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-08-12 Includes\Spyware.sbi (*)
2008-08-12 Includes\SpywareC.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-08-05 Includes\Trojans.sbi (*)
2008-08-20 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

[drragostea]

Good to hear that you've upgraded to the latest version.
http://forums.spybot.info/showpost.p...40&postcount=3
--
Can you do that for me?

In addition, after resetting the zones to default go the 'Advanced' tab in Internet Explorer and click "Restore to Advanced Settings".

See if Spybot still detects it.

[paulbemis]

Hi,
Yes I did that. Set them all to default. I am running IE 7.0. The Spybot is updated to the most recent level, but the browser is still getting hijacked and taking me to various sites. Thankfully, none of them are porn, but it is still very annoying.

Thanks for your continued help with this...

Paul

Paul, what version is your Internet Explorer? It seems that there might be something "out-of-the-ordinary" from your Internet Zones.

Can you go to: Internet Properties>Security(tab)> and reset all of them to default?

[drragostea]

In addition, after resetting the zones to default go the 'Advanced' tab in Internet Explorer and click "Restore to Advanced Settings".

See if Spybot still detects it.

How about the 'Advanced Tab'?

A HiJacked browser? Do you mean a changed homepage? Or just random redirections out of no where?

What kind of sites were they? The cheap search engine sites? Poker?

[paulbemis]

Yes, I did change the advance tabs back to "defaults" as well. The sites are random redirections of the browser. It just opens new windows (tabs) and points to things like Antivirus 2009, "the dumb test" and other advertising kinds of sites etc. Spybot is detecting nothing at this point.

How about the 'Advanced Tab'?

A HiJacked browser? Do you mean a changed homepage? Or just random redirections out of no where?

What kind of sites were they? The cheap search engine sites? Poker?

[drragostea]

That's not good... a browser HiJacker?
However, I can confirm that XPAntiVirus [Pro] 2006/07/08/09 is definately malware. Thing is Spybot does not currently detect the variants at the moment.



Do you use a firewall? How about an anti-virus program? Currently, some anti-virus programs (such as avast!) detects this.

I'll be right back...

[paulbemis]

I went ahead and downloaded the Malwarebytes Anti-malware program and did a scan. The output is below, and it seems to have fixed the problem for the moment. Time will tell...

_____________________________________
Edit; removed

[tashi]

Hello paulbemis,

If you still experience problems please follow the procedure in this link: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)


Then start your own thread in the Malware Removal Forum where a helper will advise you as soon as available.

Cheers.