ms-search. spyware prog.???

[friskyfitz]

[img]res://msaps.dll/logo.gif[/img]

anybody know about this..????

i cant get rid of it with any of my anti virus stuff and i'm daft when it comes to these things anyway.

its most probably spyware but it seems to be a program called "ms-search.com ads remover" which is listed in my xp programs but it wont allow me to delete it.

its search page appears after i press back after being on any site requiring a password

anything helpful is much appreciated and if it can be removed without any cost then all the more.

thanks in advance guys.

please help a thick paddy....

plus the bloody image won't load at the top of this post either...sorry

[kompressaur]

Grab this Fitz-

Mirror 1:
http://www.filehog.com/BPSFV/bpssr82-FV.exe



Description:
Spyware Remover is a multi Adware, SpyWare, Trackware, Thiefware & Big Brotherware removal utility with multi-language support. It scans your Memory (for active memory ad components), Registry and Drives for known SpyWare components and lets you remove them safely even ad component DLLs.

Also features SpyWatch --A real-time SpyWare monitor watching your memory and registry for SpyWare that tries to install or change your system.

Features:

· Includes PopUp Killer - A web browser POP-UP Window Killer / Stopper. Works with all major web browsers
· Includes SpyWatch - A real-time Spy ware monitoring program
· Includes Spy Add/Remove - A Spy ware / Ad ware installer scanner and complete un-uninstaller
· We have added the ability to scan for Key loggers, Trojans, Browser Hijackers, Dialers, Mal ware, and more Spy ware cookies, and added many more new Spy ware components.Also features BHO Manager and Startup Manager have been added.

· Scans for almost all SpyWare components out there today!
· Easy to use (just one click of a mouse)
· Scans Running processes (Memory), Registry, Fixed, and removable drives.
· Backup and restore removed items.
· Multi-Language Support
· Ignore List (Found items can be ignored)
· Also features Spy-Watch
· Also features Popup-Watch
· Also features BHO Manager
· Also features Startup Manager
· Registered users get at least 1 year of free upgrades.


What's New in This Release:

· Scans and detects More Spyware, Key Loggers, Dialers, Browser Hijacker, spy cookies.
· Added a spyware Add-Remove program
· Added the ability for popup blocker to allow some popups when the user presses the ctrl key.
· Added Winsock 2 repair tool
· Added Startup Manager tool
· Added Browser Hijacker Tool

[slick]

Try spysweeper i had a similar prob and it seemed to do the trick, also runs in the background and stops any further attacks.

Download here.....

hxxp://sales.webroot.com/downloads/registered/links/sspsetup1_3863.exe

Serial here.....

hxxp://mightyexodianxs.sphosting.com/spysweeper.txt

[friskyfitz]

thanks KOMP and SLICK,

will let you know how i get on after downloading these,

[slick]

i didnt see Komps post, he must have sneaked it in while i was typing.

[friskyfitz]

thanks guy,

2 brilliant piece of info there but absolutely NO luck in getting rid of this program. (im assuming it is a program)

when i do a search i find "msaps c\windows\system32 32kb application extention" but dont know if i should delete this or not.

i'm really absolute rubbish at this kind of thing

[Mike]

hey fitz

Click on the link below download the CWShredder file it will work

http://www.pcworld.com/downloads/fil...d,23551,00.asp

[friskyfitz]

cheers mrjt

unfortunately i already have this and still no luck,
so far i have used :

1. xoftspy
2. cwshredder
3. enigma/hijack this
4. avast
5. spyhunter
6. spysweeper
7. spywatch
8. winsock
9. system hijack scanner
10. spyware remover
11. kazza begone

and all to no avail. the best one was KOMP'S spyware remover but when i went to delete program - it just did nothing at all but it did clear several associated threats that others missed. i'm at a loss guys on what to do.

xoftspy located something like it as being " registry value Data Miner software\microsoft\internet explorer\extensions\CmdMapping\(c95fe080-8f5d-11d2-a20b-00aa003c157a) minor annoyance

windows xp - control panel wont allow me to add/remove it (when this is done the page just flickers with no end result)

maybe its not dangerous but its just a pain in the arse when refreshing and using the back button as everything must be re-typed (i.e. passwords)

i'm more afraid of infecting others than what it will do to me.

other things that i dont quite know are : from SYSTEM HIJACK SCANNER

1. 05 hkcu\control panel\dont load:ncpa.cpl = no and
2. 05 hkcu\control panel\dont load:odbccp32.cpl = no and
3. 27 different 018 Protocol items listing various things

does any of this make sense???

[Mike]

Oh shame Fitz thought we might have fixed it.

Go through this that i found

click Start, and then click Run. (The Run dialog box appears.)
Type, or copy and paste, the following text:
regsvr32 /u C:\WINDOWS\System32\wins32t.dll
then click OK. If a dialog box confirming this action appears, click OK.

Now click Start, and then click Run. (The Run dialog box appears.)
Type, or copy and paste, the following text:
regsvr32 /u C:\WINDOWS\System32\wmpul.dll
then click OK. If a dialog box confirming this action appears, click OK.


Now run HijackThis and put check marks next to the following but DO NOT click FIX YET:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://msaps.dll/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = res://msaps.dll/index.html
R3 - URLSearchHook: MailTo Class - {FDE3577A-6254-181C-4E11-339E4F746BD3} - C:\WINDOWS\System32\wins32t.dll
O2 - BHO: (no name) - {95C5F6E8-7337-52A7-8D34-0F02B43C478F} - C:\WINDOWS\System32\wmpul.dll
O4 - HKLM\..\Run: [tapisys] C:\WINDOWS\System32\tss.exe
O4 - HKCU\..\Run: [tapisys] C:\WINDOWS\System32\tss.exe
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - (no file)
Now shutdown all applications especially Internet Explorer (yes the window you are in right now too).
Then click Fix.


Now reboot in safe mode: http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

Enable viewing of hidden files and folders: http://forums.majorgeeks.com/showthread.php?t=37650

Now delete the following:

msaps.dll or c:\windows\msaps.dll or c:\windows\system\msaps.dll or c:\windows\system32\msaps.dll
C:\WINDOWS\System32\wins32t.dll
C:\WINDOWS\System32\wmpul.dll
C:\WINDOWS\System32\tss.exe

report back if you need help :) Good Luck :hope

[friskyfitz]

thanks mrjt....eh....mike?

that seems to have done the b***ard,

owe you a few next time i'm down around CRAWLEY or BRIGHTON.
thanks for your help and taking the time to reply

thanks too, SLICK and KOMP, the same goes for you two

cheers again lads

[Mike]

cool mate

Superb, stubbon little fcuker eh!

[kompressaur]

Nice one Mike.

Now stay away looking for rare and bizzare porn Fitz!

[friskyfitz]

how DID you know......?

who TOLD you....?

ha ha ha NOW the evidence is GONE, GONE, GONE

[friskyfitz]

anyway there's nothing bizzarre about trying to buy an inflatable sheep is there???

don't believe i just printed that..... aaaaagggghhhhhh!!!

somebody erase this "guilt proving" post a.s.a.p

[Mike]

Fitz nah i think your reply is best staying

btw, what operating system do you run?

[friskyfitz]

Windows XP home edition

in conjunction with the dreaded Internet Explorer and Microsoft Outlook Express

[Jamie]

Originally Posted by friskyfitz

don't believe i just printed that..... aaaaagggghhhhhh!!!

I believe the actual saying is "bah"

[Mike]

Fitz have you installed the latest Service Pack 2?

i'll assume you havent and post these two links.

http://www.microsoft.com/downloads/d...displaylang=en

use this link if the one below doesnt allow you to install Service Pack 2

http://windowsupdate.microsoft.com/

Try those and report back.

[friskyfitz]

cheers mike,


will do, thanks again

[Mike]

XP service pack has a lot of security updates which will prevent you from having this problem.

Let me know if you any other questions, or need help with the install etc