Webrebates trojan - anybody knows how to get rid of it? Thread poster: Katza
|
|---|
Katza
Local time: 17:22
English to Romanian
+ ...
Hi,
Yesterday, after downloading some screensavers from download.com, I started getting an error message on my computer, saying that this Webrebates0 "program" has performed an illegal operation and needs to close. I immediately started a scan with my Norton Professional, but, much to my surprise, it said that my computer is "clean". I tried deleting the program, but it doesn't work - it was installed in my program files directory and, every time I try deleting it, it just sh... See more Hi,
Yesterday, after downloading some screensavers from download.com, I started getting an error message on my computer, saying that this Webrebates0 "program" has performed an illegal operation and needs to close. I immediately started a scan with my Norton Professional, but, much to my surprise, it said that my computer is "clean". I tried deleting the program, but it doesn't work - it was installed in my program files directory and, every time I try deleting it, it just shows up again five seconds later, even if I use the "Wipe" function of Norton.
After searching the Net for some answers, I managed to discover that the so-called "program" was, in fact, a trojan. The solution recommended on some computer forums was Spybot. My only concern is that the download site for this Spybot (the English version) is the same site where I got infected in the first place and I'm a little reluctant to download anything else from them - ever again!!!
Anybody knows another method of getting rid of it? Anybody knows what exactly does this trojan do? For the moment, I can't say I've seen much activity from it, apart from the fact that my computer froze two times since last night. Then again, I'm running Windows 98, which is prone to freezing now and again.
Any help would be greatly appreciated,
TIA,
Narcisa ▲ Collapse
| | | | Gavin Bruce 
United States
Local time: 10:22
German to English
Hi there,
I really don't know anything about the trojan problem you have, but I really can recommend SpyBot. It is troubling that you say you picked up this little problem at the same place where you were going to get SpyBot. That's not good. However, I can tell you that this program is available from a number of different sites. So perhaps you could shop around a little bit and find one you think you can trust more.
Good luck,
Gavin
| | | | Schwabamädle
Canada
Local time: 10:22
English to German
+ ...
| Secure download !!! | Aug 17, 2004 |
Hi there,
There are different ways to get rid of your trojan, first try the suggested method from Gavin, you can savely download that program from the address below. There is also a program called Ad-aware and Search&Destroy they are both free and great tools.
If everything failes to work there is a download called "hijack this" you also download it from the address below, BUT you have to be very careful using this tool, what it does it makes a list of everything what is inst... See more Hi there,
There are different ways to get rid of your trojan, first try the suggested method from Gavin, you can savely download that program from the address below. There is also a program called Ad-aware and Search&Destroy they are both free and great tools.
If everything failes to work there is a download called "hijack this" you also download it from the address below, BUT you have to be very careful using this tool, what it does it makes a list of everything what is installed in your computer. It takes somebody to know what to delete,it also shows the "way" how you got infected. Once you download Hijack this DO NOT OPEN IN AN UNPROTECTED FILE, you could erase everything, if you open Hijack this you should open it with winzip or a other suggested tool and save it to your C-Drive. There is also a forum in the address below where you savely can list your log file and experts than will take a look and tell you what to delete. Make sure you follow the instructions exactly with hijack this. Good luck!!
Kind Regards,
Andrea
You have to extract HijackThis to its own folder. DO NOT run it from within a zip mangager, as no back ups will be saved.
http://www.bleepingcomputer.com/forums/index.php?showtutorial=41
[Edited at 2004-08-17 10:45]
[Edited at 2004-08-17 11:37] ▲ Collapse
| | | | | Ad-Aware is a good option | Aug 17, 2004 |
Not so infrequently, the pages we visit (of course, if our java is on, and our browser accepts cookies automatically), the page owner installs applications, java scripts, etc. in our computer without ever asking our consent, or without ever noticing such malicious installations. They are called, depending on their type and purpose, Datamining, aggressive advertising, Parasites, Scumware, Keyloggers, selected traditional Trojans, Dialers, Malware, Browser hijackers, tracking, etc. components
... See more Not so infrequently, the pages we visit (of course, if our java is on, and our browser accepts cookies automatically), the page owner installs applications, java scripts, etc. in our computer without ever asking our consent, or without ever noticing such malicious installations. They are called, depending on their type and purpose, Datamining, aggressive advertising, Parasites, Scumware, Keyloggers, selected traditional Trojans, Dialers, Malware, Browser hijackers, tracking, etc. components
They are not viruses, and as such, are not recognized by most scanners.
There are numerous utilities to detect and remove such trojans, keyloggers, malware, etc.
One of the best options is to have a free copy of Lavasoft's Ad-Aware. It has an option for updates with a mouse click, and recognizes most of such components.
The link is:
www.lavasoftusa.com/software/adaware/
h.i.h ▲ Collapse
| | |
|
|
|
Dinny
Greece
Local time: 17:22
Italian to Danish
+ ...
| Try Hijackthis | Aug 17, 2004 |
You can download it from www.hijackthis.com - the site doesn't contain spy programs or the like.
If you are not totally familiar with the contents of your PC you should have somebody help you delete the enemy file.
Good luck!
Dinny
| | | |
Start/run
in the dialog write: msconfig
Search the file in the Systemstart windows.
deselect it
start the computer again
Start/run
write: regedit
search (Ctrl + F) for the file and delete it
search again and again (F3) till there is no more hits
Regards
| | | | Katza
Local time: 17:22
English to Romanian
+ ...
TOPIC STARTER | Progress Update | Aug 17, 2004 |
Hi again,
First of all, thank you so much for all your help. I have followed your suggestions and downloaded Spybot, but, upon installation, it completely froze my computer after giving me an error message that I wasn't able to read. So, being a little paranoid by nature I uninstalled it.
Toledo, I followed your advice and deleted the file from regedit. Upon the last search, it showed up as Name "e... See more Hi again,
First of all, thank you so much for all your help. I have followed your suggestions and downloaded Spybot, but, upon installation, it completely froze my computer after giving me an error message that I wasn't able to read. So, being a little paranoid by nature I uninstalled it.
Toledo, I followed your advice and deleted the file from regedit. Upon the last search, it showed up as Name "e" - value "webrebates". Should I delete that too? Sorry if I sound stupid - I just want to make sure that I won't delete anything that I shouldn't.
Once again, thank you all for your assistance.
Narcisa ▲ Collapse
| | | |
Katza wrote:
Hi again,
Toledo, I followed your advice and deleted the file from regedit. Upon the last search, it showed up as Name "e" - value "webrebates". Should I delete that too? Narcisa
Yes,
Now take a look at start/run/msconfig/systemstart
Is it still there?
[Edited at 2004-08-17 16:02]
| | |
|
|
|
Katza
Local time: 17:22
English to Romanian
+ ...
TOPIC STARTER
Hi again,
It's gone completely!!! Thank you so much for all your help.
Have a great, virus-free day,
Narcisa
| | | | lien
Netherlands
Local time: 16:22
English to French
+ ...
| Great tip for your adware and malware | Aug 17, 2004 |
I scan regulary with pestpatrol, they have a gratis scan on their site.
Just did it and it found 64 adware and spyware. It gives you the location on the registry, you have just to desable them manually.
http://www.pestscan.com
| | | | To report site rules violations or get help, contact a site moderator: You can also contact site staff by submitting a support request » Webrebates trojan - anybody knows how to get rid of it? | Anycount & Translation Office 3000 | Translation Office 3000
Translation Office 3000 is an advanced accounting tool for freelance translators and small agencies. TO3000 easily and seamlessly integrates with the business life of professional freelance translators.
More info » |
| | TM-Town | Manage your TMs and Terms ... and boost your translation business
Are you ready for something fresh in the industry? TM-Town is a unique new site for you -- the freelance translator -- to store, manage and share translation memories (TMs) and glossaries...and potentially meet new clients on the basis of your prior work.
More info » |
|
| | | | X Sign in to your ProZ.com account... | | | | | |
Login to reply/comment 
