6 replies to this topic

[linder5]

Have run SuperAntiSpyware and repeatedly cannot get rid of Browser Hijacker.deskbar. Have also booted in safe mode and cannot get rid of it. Even tried to manually delete the registry keys and Windows will not allow it to be deleted. Here's the log... would appreciate some assistance in getting this off my system. Thanks.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/02/2009 at 09:04 PM

Application Version : 4.27.1002

Core Rules Database Version : 4083
Trace Rules Database Version: 2023

Scan type : Quick Scan
Total Scan Time : 00:43:00

Memory items scanned : 596
Memory threats detected : 0
Registry items scanned : 664
Registry threats detected : 16
File items scanned : 10859
File threats detected : 5

Adware.Tracking Cookie
C:\Documents and Settings\zixan\Cookies\zixan@tribalfusion[1].txt
C:\Documents and Settings\DJJ\Cookies\djj@specificclick[1].txt
C:\Documents and Settings\DJJ\Cookies\djj@specificmedia[1].txt
C:\Documents and Settings\DJJ\Cookies\djj@iacas.adbureau[1].txt
C:\Documents and Settings\DJJ\Cookies\djj@insightexpressai[1].txt

Browser Hijacker.Deskbar
HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}
HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0
HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0
HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0\win32
HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\FLAGS
HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\HELPDIR
HKCR\Interface\{6ABB739A-787B-495B-82B8-1526B804E912}
HKCR\Interface\{6ABB739A-787B-495B-82B8-1526B804E912}\ProxyStubClsid
HKCR\Interface\{6ABB739A-787B-495B-82B8-1526B804E912}\ProxyStubClsid32
HKCR\Interface\{6ABB739A-787B-495B-82B8-1526B804E912}\TypeLib
HKCR\Interface\{6ABB739A-787B-495B-82B8-1526B804E912}\TypeLib#Version
HKCR\Interface\{EA5C58AE-7DB0-40C3-BAAE-BA9008A243EB}
HKCR\Interface\{EA5C58AE-7DB0-40C3-BAAE-BA9008A243EB}\ProxyStubClsid
HKCR\Interface\{EA5C58AE-7DB0-40C3-BAAE-BA9008A243EB}\ProxyStubClsid32
HKCR\Interface\{EA5C58AE-7DB0-40C3-BAAE-BA9008A243EB}\TypeLib
HKCR\Interface\{EA5C58AE-7DB0-40C3-BAAE-BA9008A243EB}\TypeLib#Version

[siliconman01]

It sounds like you have a "Permissions" issue with these registry keys. What Windows operating system are you running (with service pack #)?

[linder5]

I am running Windows XP with Service Pack 3. I've looked at the permissions and they looked ok, but maybe I need to be walked through how to check them again for proper settings. Thanks.

[linder5]

Thanks... I worked on the permissions for these registry items and finally was able to delete this. Something in the registry from freeze.com that had changed the permission so that nothing would delete it. Uuugh... what a pain. Thanks for the help.

[siliconman01]

Glad you are fixed up. It's a typical cybercriminal tactic to change key permissions to prevent removal of their nasty registry keys.

[Jarred12]

I have the same problem, but i dont know how to get to change permissions.

[siliconman01]

Jarred12,

What Windows operating system are you running? And are you familiar with using the registry editor Regedit? If not, it is best that you submit a Customer Service Request and let the SAS gurus fix you up.

http://www.superanti...eateticket.html