The spyware that got away

[Worm of Despite]

Usually, my Ad-Aware always keeps my comp ad-free, but that’s not been the case, lately. Even though I’ve continually deleted it, the same old spyware keeps popping up almost every day.

I know where I got the problem from: I was looking for Super NES ROMs when it all started, and I know those sites aren’t the cleanest in the world. But it's been about a week since I went there, and the sites I regularly surf NEVER give me problems. I mean, I could go for weeks without seeing an ad or anything. But now, despite that I surf the same old places, these strange new bugs just suddenly pop it. I mean, one day my Ad-Aware shows 0 “critical objects”/spyware, the next day 40 files of spyware just pop it!

So it’s weird. What’s weirder is that when I select the spyware/bugged files to deleted them, it won’t let me delete them all. It says: “Some objects could not be removed”, and then it shows me a list of which objects. These objects generally are:

C\Program Files\cxtpls\ace.dll
C\Program Files\cxtpls\Al_19-05-2005.log
C\Program Files\cxtpls\atl.dll

I go to “Program Files” to find this “cxtpls” folder, but it’s not there! It doesn’t show up! Bah!

[High Lord Tolkien]

(Those game sites are the worst!)

You need to run Ad-Aware in your computer's "Safe Mode".

"To get into the Windows 2000 / XP Safe mode, as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key."

This is Windows at a bare minimum.
Run Ad-Aware and this time it will be able to delete those buggers.

I run both Ad-aware and Spybot.
www.download.com/Spybot-Search-Destroy/ ... ml?tag=pop
Spybot has this little utility that asks you everytime if you want to accept changes in your registry.
Which is usually triggered by spyware.
It's pretty cool.
I'm always suprised by what hits my PC by just typing in an url.

Since we're on the subject I'd also recommend using Firefox as a browser and then turning off it's Javascript function.

[Worm of Despite]

Thankies!

By the way: what is BackWeb and should I delete it? heh

Edit: I'm thinking I should, cause now I keep getting this little "Runner Error" window that says "Invalid BackWeb application id "137903".

[Edge]

www.cexx.org/dlgli.htm

Backweb is a generic, background downloading tool that software vendors can incorporate into their product to download data (e.g. product updates) to the user's PC. Its operation depends on the instructions given to it by the individual software vendor who bundles it. While this software has been neither exhonorated nor convicted of malice, some aspects of its installation and operation appear suspect. Additionally, some users have associated it with the appearance of unwanted advertising windows.

Removal:
If you did not knowingly install Backweb, or are noticing unwanted advertisements appearing on your computer, you might try disabling or removing this product. Backweb (or more specifically, the one installed with the Western Digital products) does not appear to come with an uninstall option.

The easiest way to disable the program is to rename it, e.g. from backweb.exe to backweb.ex_ . Note that if the program is used for a legitimate or wanted purpose (such as automatic software updating or displaying news, etc.), these will no longer happen automatically.

If you are sure you don't need it for anything, find and delete the BackWeb folder, normally in C:\Program Files.


WD Data Lifeline BackWeb Lite Installer (DLGLI.EXE)
This appears to use the BackWeb product to quietly install unknown items onto your computer. When installing Western Digital Data Lifeline, a reference to DLGLI.EXE is placed in the Windows StartUp folder so that it is loaded at startup. Similar to the Gator install stub, the software slowly downloads ("trickles") the software onto the system.

Removal:

Terminate DLGLI.EXE using Windows' End Task (CTRL-ALT-DEL) dialogue. It may show up as "Downloading Software..." or "Resuming Downloading of Software..."
Use Find to locate DLGLI.EXE, and delete it.
Locate Iadhide3.dll and delete it.

(Optional) Remove the entry from the StartUp folder.

[Avatar]

It says: “Some objects could not be removed”, and then it shows me a list of which objects. These objects generally are:

C\Program Files\cxtpls\ace.dll
C\Program Files\cxtpls\Al_19-05-2005.log
C\Program Files\cxtpls\atl.dll

I go to “Program Files” to find this “cxtpls” folder, but it’s not there! It doesn’t show up! Bah!

Make sure your folder options are set to show all hidden files.

--A