Greetings all. Hope someone can help me out on this one. The system is a Compaq Laptop running W98SE that we keep in the kitchen that is used mainly for email and the kids to do Internet research on for school. No other systems in the house are infected like this. We are using a Dial-Up connection. The problem is that whenever the system gets connected to the Internet, within a minute or so, both Ezula and its' partner Adware Web Offer begin to get downloaded and installed. It is detected by Spy Sweeper and removed during a sweep. It is also detected By Spy Sweeper as an alert for Start-up files. According to installation the log of both Ezula and Web Offer, it actually creates the directory for installation. (It is deleted during Spy Sweepers' sweep). I have done eveything I can to try to find what it is that is making the system download and begin installation. The only way I have found to stop it so far is to turn off download ability in Internet Options. I really don't want to do this for obvious reasons. I also tried dis-abling various Script and Active-X functions. The problem there is that most legitimate Websites that we visit also use them and it is very tedious to have to click "allow" again and again and again. How can I figure out just what file is being used to detect the network and download the file from wherever it is coming from? Please help.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Another option which comes to my mind, instantly, for preventing such installations is Mozilla Firefox. You can specify which websites you would like to allow to install software on your computer. It is the most safe browser that I have ever used. I am sure you must have heard of it.
Is your laptop up to date with all the patches?
Do you use Internet Explorer? Have you updated it to IE6?
Do you have a firewall / anti-virus software?
Good Luck!
There's no doubt about, that your computer is infected with the Ezula SPYWARE.
Here's how to get rid of it:
http://www3.ca.com/securit
But you will get it again soon, unless you protects your computer, and it's not only done with a anti-SPYWARE program.
In my opinion, there are at least seven issues you need to do.
I've put them all on one page so they don't need to be listed here:
http://www.tryware.dk/Engl
Many Regards
Jorgen Malmgren
IT-Supervisor
Denmark
:o) Your brain is like a parachute. It works best when it's open
Download HijackThis http://www.majorgeeks.com/
So just check and fix those that are bad. Then delete the corresponding files/folders. Make sure to uninstall eZula and Web Offer from your Add/Remove Panel first before running the HijackThis fix.
After that's done:
The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould
Restart and see if they are back.
Business Accounts
Answer for Membership
by: amirinamdarPosted on 2005-03-21 at 08:53:31ID: 13592812
Hi flubbster,
You seem to be in trouble. Look at the standard drill I have mentioned on this page and follow it to the letter:
http://insanity.bizhat.com
If you cannot connect to this drill, try this link:
http://amir.inamdar.spymac
After you have cleaned your computer, you may want to look at this page on securing your computer:
http://insanity.bizhat.com
If you cannot connect to this, try this link:
http://amir.inamdar.spymac
Good Luck!