Here's a useful tip for those of you that have trouble removing this shit. A lot of these programs are running in memory and they use filenames such as services.exe or winlogon.exe. You can not delete the file while the program is running and you won't be able to use taskmanager to stop the program because it will rather stupidly insist that the file is a system resource that can't be stopped. You will know when you have one of these when you see the program twice in taskmanager, once as SYSTEM and once as whatever your login name is. Only the SYSTEM one is legit. Using programs such as hijackthis will not work because these programs check every few seconds and will reinsert themselves into the registry. To get rid of them you need to do one of 2 things. Either use a program like RegRun which will start before windows starts and give you an opportunity to remove this crap or reboot in safe mode and use hijackthis or a similar program to clean the registry and delete the file.
And another tip is to throw ad-aware in the trash. Or at least limit it's use to looking for basic spyware. It is updated far too slowly and is totally ineffective against most scumware and trojans.
__________________
<table width="95%" border="0"><tr><td><font size="-2"><a href="http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=923906-0000&PA=462029&HTML=http://www.eromodelcash.com">Eromodel Cash. Promote it now!</a></font></td><td><div align="right"><font size="-2"><a href="http://www.eromodelgroup.com">Eromodel Group- for ALL your needs </a></font></div></td><td width="125" rowspan="3"><div align="right"><a href="http://refer.ccbill.com/cgi-bin/clicks.cgi?CA=923906-0000&PA=462029&HTML=http://www.eromodelcash.com"><img src="http://www.eromodelcash.com/Banner/00102.gif" width="120" height="60" border="0"></a></div></td></tr><tr><td width="40%"><font size="-2"><a href="http://www.lannibarbie.com">Lanny Barbie is THE Hottest New Pornstar</a></font></td><td><div align="right"><font size="-2"><a href="mailto:stewREMOVE@eromodelgroup.com?Subject= Hi%20There">Contact Me</a></font></div></td></tr><tr><td><a href="http://www.judystarxxx.com"><font size="-2">JudyStarXXX.com</font></a></td><td><div align="right"><font size="-2">ICQ #165144564</font></div></td></tr></table>
|