Get Rid of xlime.offeroptimer

Unknown
edited December 2004 in Spyware & Virus Removal
I'm trying to get rid of popups. By reading other threads, I've done the following:

* Set the computer to show hidden files and folders
* Disabled System Restore
* Reboot in Safe mode with Networking
* Ran HijackThis and have attached the log file


I did not have it fix anything. What do I do next?

Thank you.

Dave

Comments

  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    O1 - Hosts: 64.82.99.5 www.asdsoftware.com asdsoftware.com
    O1 - Hosts: 24.107.73.77 daveshome.com
    O2 - BHO: (no name) - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\multimpp.dll
    O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
    O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
    O4 - HKLM\..\Run: [xxxxxxanhupmx] C:\WINDOWS\system32\xxxxxoinvln.exe
    O4 - HKLM\..\Run: [rsnbjv] C:\WINDOWS\system32\oinvln.exe
    O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
    O4 - HKLM\..\RunOnce: [djebmm350.exe] "C:\DOCUME~1\DAVE~1.ASD\LOCALS~1\Temp\djebmm350.exe"
    O9 - Extra button: Ebates (HKCU)

    Fix those entries then find and delete the files listed above, reboot and post a new log.
  • dwurtz
    edited December 2004
    Thanks for helping me with this!

    I had Hijaak fix the issues you stated (when I ran the scan, one of the entries was not found - 04 - HKLM\..\RunOnce: [djebmm350.exe] "C:\DOCUME~1\DAVE~1.ASD\LOCALS~1\Temp\djebmm350.exe". I did verify that this file does not exist.) and reran the scan.

    I have attached the new log.

    Do I need to do anything else?

    Thank you.
    Dave
  • dwurtz
    edited December 2004
    Oops. Forgot to attach the log file. Here it is.
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    Boot into Safe Mode (press F8 at the BIOS screen when booting) and do the following:

    O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm

    Fix that entry then (still in safe mode) find and delete "Ebates_MoeMoneyMaker", boot back into normal mode, and post a new log.
  • dwurtz
    edited December 2004
    Ok. Did that. Here's the new log.

    The popups appear to have gone away! Thank you very much!!!

    Anything else I should do other than reset my Explorer options for the system files, hidden files, and turn system restore back on?

    Thanks
    Dave
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    Nope, you don't need to do anything else. the problem is resolved.
  • dwurtz
    edited December 2004
    Terrific. Thank you very much.
This discussion has been closed.