My computer is infected with DollarRevenue. I had ran AdAware, CoolWebSearch Shredder, Spybot, ant Trojan Hunter they found nothing. I also ran Pandasoftware. Here are resolts: Incident Status Location
Adware:Adware/DollarRevenue Not disinfected C:\Program Files\EarthLink\Toolbar\Uninst.exe[UnInstall.exe][²ÜÇ\System.dll] Adware:Adware/DollarRevenue Not disinfected C:\Program Files\EarthLink\Toolbar\UnInstall.exe[²ÜÇ\System.dll]
Does anyone know how to fix it?
Thank you for help,
Lora ************************************************ 08-08-06, 08:41 PM bedstor Hi I have not come across this on my travels and I'm well protected ( Note to Dwight :Is not listed on SpywareBlaster! ) Anyway you'll need to top up your defences with a virus scanner such as Avast!(free) And run a program called Crap Cleaner from www.ccleaner.com (making sure that the Cookies box is unticked before you start scanning) otherwise you lose all your log-ins
Oh I forgot here is a cleaner for removing this pest. www.spywareremove.com/removeDollarRevenue.html Use the automatic version first. No Ideas if its any good If it does work, then install and run the programs above to get rid of the "tail ends" There are more useful programs, advice, and links on this website http://myweb.tiscali.co.uk/lesgrotte/index.html ************************************************ 08-08-06, 11:30 PM Lora316K Thank you for help. The problem is gone.
Lora ************************************************ 08-08-06, 11:45 PM bedstor You're welcome Smile ************************************************ 08-09-06, 01:25 PM Lora316K How do I prevent this from happening again? ************************************************ 08-09-06, 03:43 PM bedstor Visit www.webuser.co.uk/forums (have to register to post) and ask their advice (very friendly) In the meantime go to www.activevirusshield.com and download/install this program (New this week).Works similar to Windows Defender(also very good) Also download install Spywareblaster from www.Javacoolsoftware.com to block items such as your little problem getting onto the computer
The ultimate block would be a Firewall there are several free ones available but they are a wee bit tricky for a novice to set up But of course if you have a broadband connection it is a top priority item Nasties bombard like mad if you visit certain sites such as XXX or Music sharing ,some webcam sites too (you need maximum (updated)protection too) ************************************************ 08-09-06, 05:58 PM clarebear DollarRevenue is an adware program that silently downloads from the Internet main components of certain advertising software and installs them to the system without user knowledge. DollarRevenue is bundled with some ad-supported products. It can also be manually installed. The threat doesn't carry any dangerous payload.
DollarRevenue properties: • Connects itself to the internet • Hides from the user • Stays resident in background
This site has a link that should remove it for good. ************************************************ 08-09-06, 06:58 PM juanruiz I may have done something wrong, but went to CB's suggested site, downloaded, did a scan, and when I tried to remove the spyware found, I got a window saying I had to buy the service, even though it said "free spyware removal tool." ************************************************ 08-09-06, 07:29 PM Lora316K
quote: Originally posted by bedstor: Visit www.webuser.co.uk/forums (have to register to post) and ask their advice (very friendly) In the meantime go to www.activevirusshield.com and download/install this program Can active virurs shiels be used if I have McAfee? Or do I have to get read of McAfee first? (New this week).Works similar to Windows Defender(also very good) Also download install Spywareblaster from www.Javacoolsoftware.com to block items such as your little problem getting onto the computer
The ultimate block would be a Firewall there are several free ones available but they are a wee bit tricky for a novice to set up I have Sunbelt Kerio Personal Firewall. Can you recomend good one or should I keep the one I have? But of course if you have a broadband connection it is a top priority item Nasties bombard like mad if you visit certain sites such as XXX or Music sharing ,some webcam sites too (you need maximum (updated)protection too)
************************************************ 08-09-06, 07:44 PM clarebear I can't get it to work. It says its spyhunter or something. Let me find something else. ************************************************ 08-09-06, 07:47 PM clarebear Hopefully this works.
DollarRevenue Removal:
To remove DollarRevenue, please follow the instruction:
2. Click Start > Run. Type REGEDIT. Then click OK. Navigate to the subkeys and delete the values: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run defender HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run newname HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run keyboard HKEY_LOCAL_MACHINE\software\microsoft\drsmartl HKEY_LOCAL_MACHINE\software\microsoft\drsmartload2 HKEY_LOCAL_MACHINE\software\microsoft\drsmartload2 installed
3. Remove the files mentioned above in Explorer if exist.
If you haven't done this before, I suggest you have an experienced friend help you so you don't mess up anything in the registry. ************************************************ 08-09-06, 08:48 PM bedstor Sorry to spoil your Hard work JR & CB The problem was resolved early in the topic
quote: Posted 08-08-06 11:30 PM Thank you for help. The problem is gone. Lora
quote: Originally posted by bedstor: Visit www.webuser.co.uk/forums (have to register to post) and ask their advice (very friendly) In the meantime go to www.activevirusshield.com and download/install this program Can active virurs shiels be used if I have McAfee? Or do I have to get read of McAfee first? (New this week).Works similar to Windows Defender(also very good) Also download install Spywareblaster from www.Javacoolsoftware.com to block items such as your little problem getting onto the computer
The ultimate block would be a Firewall there are several free ones available but they are a wee bit tricky for a novice to set up I have Sunbelt Kerio Personal Firewall. Can you recomend good one or should I keep the one I have? But of course if you have a broadband connection it is a top priority item Nasties bombard like mad if you visit certain sites such as XXX or Music sharing ,some webcam sites too (you need maximum (updated)protection too)
Unusual way of replying (readable Smile) Dealing with 2nd item 1st The Kerio Firewall is a Good one Apart from making corrections to allow or disallow applications to access the Net (not had any experience of it to tell you what to do) I Have McAfee Personal Firewall as protection on my computer The other thing McAfee Anti Virus (correct?) If you are still In subscription do nothing But uninstalling the program and Installing one of my suggested A/V Programs won't do any harm Firewall will ask for access (give it ) In fact more people are going onto the free versions from McAfee & Norton after realising they get the same or better value from the Free programs Red Face Be aware there are a lot of similarly named programs which claim to be genuine yet they attract trouble galore .The Genuine Programs very rarely advertise TIP... Don't click ads in search engines unless you know what lies beyond Mad ************************************************ 08-09-06, 10:06 PM Lora316K Thank you. ************************************************ 08-10-06, 09:48 AM Dwight As mentioned by Bedstor above, you should use SpywareBlaster. It is the best preventative tool I've found. Like any of these tools, it can only be effective if it is kept up-to-date. Run it about once a week and first update it, then enable protection. Note that you can disable protection if something doesn't work correctly, although I have never found that to be necessary. You can get the SpywareBlaster tool at my site: Click on any of the downloads.
While on my page, please read the section concerning the "Hosts" file. Then go to the download page to download/install this file. It will go a long ways toward preventing problems:
Dwight ************************************************ 08-10-06, 11:24 AM clarebear I just downloaded SpyWareBlaster. I enabled everything and updated. Smile ************************************************ 08-10-06, 12:20 PM Lora316K I alredy had SpywareBlaster, all I had to do is download "Host" file.
Lora ************************************************ 08-10-06, 01:05 PM bedstor Further tip on Spywareblaster Open the program up and make a "System Snapshot" This is useful to wind back things in emergency (like "System Restore") Do one now while there are no issues on your computer. Makes a tiny file in the Spywareblaster folder of about 30K ( called ssave.sss) All you do is give it a "name" and click the button 2 seconds later finished Wink ************************************************ 08-10-06, 10:13 PM Lora316K I think I still might have some problems as I am redirested to http://adfarm.mediaplex.com/ad/ck/711-5256-8196-2?loc=h...8%26category%3D20738 this site insted of ebay.com.
Lora316K ************************************************ 08-10-06, 10:33 PM bedstor Hi again Can you tell us if this is off a Favorites link or typing in Google or somewhere else? and is your "homepage" still the one you always use? Mines set to www.Google.com Default is www.MSN.com And are both of these links working?(going to the correct pages?) www.ebay.comhttp://search.ebay.com/ ************************************************ 08-10-06, 10:48 PM Lora316K Adware.DollarRevenu It hapens when I click on the link in froogle.com. My homepage has not been changed.
Lora ************************************************ 08-10-06, 11:10 PM bedstor Does this happen with all those links(On that webpage?) Stupid sounding question but it may tell me something? Smile ************************************************ 08-11-06, 05:39 PM Lora316K It happens just with ebay.com.
Lora ************************************************ 08-11-06, 06:53 PM bedstor Ok thought it may have been a Hijacker(where the home page is taken over by an unwanted site...and they are very difficult to remove Mad)
Do these 2 things offline 1) Open Internet Explorer click the Delete Cookies,Delete files and the Clear History buttons (underneath 2) Did you install Crap cleaner from www.ccleaner.com? 1st click the Analyze button wait for the list to appear (takes a few minutes) then click the Run cleaner button close this after the 2nd message appears Now go back online You'll find pages are slow to appear and you'll have to log on every where unless you have something like RoboForm password manager on your computer? The speed will return in a short while once the History and Temp files have something in them (to start the page up)
This should restore things back to the right order? I have had similar issues with Yahoo mail and did something similar to rectify matters. Tell us how it goes Smile ************************************************ 08-11-06, 07:11 PM Lora316K I use Firefox to surf the net and the problem I am having is with Firefox. I can try cleaning Internet Explorer as suggested, but am not sure how it will help.
Lora ************************************************ 08-11-06, 07:19 PM Lora316K I did what you told me, but I am still redirected.
Lora ************************************************ 08-11-06, 09:39 PM Dwight First, on the off chance that this high jacker file is one of the known ones, I suggest open this link: click here It will automatically check your browser for hijack. As noted this site cannot find all of the high jackers, but it is a good start.
By the way, the reason for opening the Internet Explorer browser is because in the I.E. Tools menu you can access the Internet Options Control Panel applet. You could also just access this utility in the Control Panel directly if you prefer.
I suggest you try to use the Internet Explorer and see if that browser is also redirecting your browser. If not, then the problem may be limited to a bad file within Firefox. In any event, that file(s) needs to be routed out and removed,
I suggest you run the HiJack This utility and post the results here. Perhaps we can point out the offending file which is serving to redirect your Web browser. This page will explain how to do this: Click Here I hope something here helps!
Dwight ************************************************ 08-11-06, 10:00 PM bedstor Hi Lora Looks as though it is a Hijacker and it can be fixed by going to a specialized forum run by people dedicated to these small issues Oh and I'm not a Firefox user Here is the Forum address www.webuser.co.uk/forums/postlist.php/Cat/0/Board/hijackthis
Read this post it will tell you what to do You Must register to post here Tell them about the ebay post hijacker (like you told me) and submit a Hijack this log for them to examine Details are on the link above(duplicated here) Need to download a tiny program to make this Be aware this is a very busy forum and they'll answer your query as soon as possible...Bumping the topic isn't advisable they have a good success rate Have a look at the other logs submitted they are complex looking(and every one is different) The Hijack this program has a long tick list .Do Not go ticking things off at random here it can lead to serious problems. unless you are a very experienced user. and the people to trust have this label under their screen name HijackThis Helper Anybody else replies Ignore Ok? I post on this Site in the Hints ,Security and Open forums(Similar screen name to the one I use here) People over there are as helpful as on here ************************************************ 08-12-06, 12:53 AM Lora316K It happens in Internet Explorer to. I have posted HijackThis log on webuser forum. ************************************************ 08-12-06, 11:39 PM bedstor Lora? this reply has been posted (from Australia) on the Webuser forum
quote: Download Spybot (written by Patrick Kolla). Click from http://www.safer-networking.org/ Save spybotsd13.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/spybot/ Doubleclick spybotsd13.exe. Make sure to direct the program to install in the c:/program files/spybot/ directory, NOT the default directory. Open Spybot from Start | Programs | Spybot | Spybot S&D Select . Let it install all updates. This is very important! Select Select Check all entries that are in RED. Only RED, NOTHING ELSE. For your records, write/print out each item that you have fixed. Date it. Select Close Spybot//
Give them a thank you if it resolves the Issue? Otherwise tell them its not working and they'll try another method Wink ************************************************ 08-13-06, 05:14 PM Lora316K Thank you for letting me know about a reply.
Lora ************************************************ 08-13-06, 06:26 PM bedstor Worth telling you because the Notification(of a reply)sometimes are not recieved I'm a heavy poster on that site and sometimes that does happen with the volume of postings going through the server Frown ************************************************ 08-13-06, 07:01 PM Lora316K I had followed their instruction, but that didn't fix the problem. Told them about it alredy.
Lora ************************************************ 08-19-06, 08:19 PM Lora316K Fixed the problem today with WinsockxpFix.exe. I think the problem was caused by registry corruption. I also made a snapshot with SpywareBlaster.
Thank you for help,
Lora ************************************************ 08-19-06, 09:30 PM bedstor Pleased for you Lora Smile...and Thank you for telling us about this "Fix" It may come in handy for another day? Smile Shall post the same on the other forum which accumulates many fixes like this for future use Smile In fact it may just resolve a post elsewhere on this site which I'm having difficulty answering at the Moment Roll Eyes ************************************************ 08-19-06, 11:16 PM Lora316K No problem. I just thought it would be helpful to share with others what I have learned.
Lora
This message has been edited. Last edited by: DorianGreyed,
)
