ebay toolbar...

[RavishingRocket]

anyway i can prevent it from being stealth installed? spysweep keeps detecting it. is this anything really to worry bout?

 

[Elbatrop1]

i think spybot s&d will protect your pc from it being installed. I know for sure it can get rid of it.

 

[ADZ]

download spybot, install all the latest definitions, and immunize your machine. this *should* protect you.

If it doesnt, then run Hijack this. That will get it for sure.

 

[RavishingRocket]

installed spybot but its still gettin in. i didnt see it in highjackthis unless its a weird name. spysweeper will always rid of it but it still gets back in my system somehow

 

[Lobos]

post your log

 

[RavishingRocket]

Spy sweeper is the prog that keeps detecting it. spybot doesnt even find it

10:00 PM Full Sweep has completed. Elapsed time 0 hours, 10 minutes, 27 seconds.
Files swept: 34,313
Software Located: 6
Spy Sweeper quarantined: EbayToolbar
Spy Sweeper quarantined: EbayToolbar
Spy Sweeper quarantined: EbayToolbar
Spy Sweeper quarantined: EbayToolbar
Spy Sweeper quarantined: EbayToolbar
Spy Sweeper quarantined: EbayToolbar

 

[Lobos]

sorry

i meant your hjt log

 

[RavishingRocket]

Logfile of HijackThis v1.96.2
Scan saved at 7:14:50 AM, on 6/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Accelerate\accelerate.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Documents and Settings\Rocket\Local Settings\Temp\FreeRAM XP Pro 1.40.exe
C:\Program Files\interMute\AdSubtract\AdSub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\YahooPOPs\YahooPOPs.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1031
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Accelerate] C:\Program Files\Webroot\Accelerate\accelerate.exe /S
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Rocket\Local Settings\Temp\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: AdSubtract.lnk = C:\Program Files\interMute\AdSubtract\AdSub.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: YahooPOPs.lnk = ?
O8 - Extra context menu item: AdSubtract: Bypass Site - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/360
O8 - Extra context menu item: AdSubtract: Cloak Image - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/361
O8 - Extra context menu item: AdSubtract: Report Site - res://C:\Program Files\interMute\AdSubtract\AdSub.exe/359
O9 - Extra button: AIM (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38103.7160648148
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab

 

[Vormund]

Another program to try is Ad-aware, it's worked for everything I've had as far as ads go. Spy Bot S&D only found one thing when I first used it that Ad-aware did not, and since then, I just run only Ad-aware often, then Spy Bot every time I "clean" up the computer.

Are you sure you did not choose to download and install the eBay toolbar? I would not think eBay would force something like that, muchless adware, unless it's a third party trying to make money off your hits to eBay. Anyhow, you should be sure and check Add/Remove and ensure it's not on that list.

 

[Lobos]

did you run spysweeper before running spybot

I mean did you quarantine them before running spybot

if so that is probably why we cant see it in spybot is not detecting or cannot clean it

The definition is in the spybot s/d database unless this is a new version