Ads234/345, Netspry and Midaddle removal instructions

steamwiz · Posted: Thu 09/16/2004 5:42am [Post #1]

These are instructions for removing Ads234/345, Netspry and Midaddle from your computer ....

If you are not happy following them ... please post a hijackthis log

Click here to download >>> Hijackthis <<<

Look for the O2 - BHO which corresponds to the one in your log (to see which version you have) and follow instructions
===
Version 1 ... WinPage.dll

O2 - BHO: WinPage Blocker - {12DF6E3E-6272-4AE8-880B-2158D60791C0} - C:\Program Files\Homepage\WinPage.dll

O2 - BHO: CWinPageIEExtension Object - {12DF6E3E-6272-4AE8-880B-2158D60791C0} - C:\Program Files\Homepage\WinPage.dll

Fix the O2 entry with hijackthis then Reboot and delete the C:\Program Files\Homepage ... folder

Even seen running from the recycle bin...

O2 - BHO: WinPage Blocker - {12DF6E3E-6272-4AE8-880B-2158D60791C0} - C:\RECYCLER\S-1-5-21-568730901-1698683601-3399203189-10 07\Dc45\WinPage.dll

Fix with hijackthis then Reboot and empty the recycle bin

--
Version 2 ... midaddle.dll

O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Program Files\Common Files\midaddle\midaddle.dll

Fix the O2 entry with hijackthis then Reboot and delete the C:\Program Files\Common Files\midaddle ... folder

--
Version 3 ... Random name .dll running from the "temp" folder

O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\user name\Local Settings\Temp\rTkWk6u.dll

O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\user name\Local Settings\Temp\BV.dll

O2 - BHO: CSearchHelpIEExtension Object - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - E:\Documents and Settings\user name\Local Settings\Temp\WP2.dll

O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\user name\Local Settings\Temp\kxg.dll

With this there will be anything from 0 to 10 run keys (O4 entries) in your log, all with random filenames and all running from the "temp" folder.

Example :-

O4 - HKLM\..\Run: [uqxQ8w9 ] C:\documents and settings\user name\local settings\temp\uqxQ8w9.exe <<< Random filenames

Fix the O2 - BHO entry and ALL the O4 entries (with random names and running from the "temp" directory) with hijackthis

Then reboot into >>>safe mode<<< Click Here for instructions find and delete :-

.....The entire contents of the C:\Documents and Settings\user name\Local Settings\temp folder ( Do NOT delete the folder itself)

PLEASE NOTE The local settings folder is a hidden folder.....Click here >>> How to Show Hidden/System Files <<<

You may have many far worse issues in your log, if in any doubt ... start a "new topic" and post your hijackthis log.

I would request that the moderators do NOT lock this thread ... but leave it open for comments....

Do NOT post hijackthis logs to this thread ... if you do they will be removed ... start a "new topic" and post your hijackthis log in it.

If after removing Ads234, Netspry and Midaddle from your computer you want the rest of your log checking .... post a fresh log.

Moderators and helpers please feel free to direct posters to this thread ...

cheers

steam
===============================

HI

In the short time this post has been up, there have been 200 views, but no replies.

If you came to this thread looking for help, please add a comment to this thread telling me if it helped you or if you had trouble understanding it.

Your comments would be greatly appreciated

You DO have to be a registered member to post

cheers

steam

This post has: 7 recommendations

galena1 · Posted: Thu 09/16/2004 7:24am [Post #2]

It all appears clear enough to me, Steam. Followed your link to ASAP. It's good to know there's so many 'good guys' out there doing their stuff. Regards.

This post has: 0 recommendations

Guest · Posted: Sun 09/19/2004 8:38pm [Post #3]

I did exactly what you told me and am delighted! Thanks a million! Very Happy

This post has: 0 recommendations

MustangSally · Guest

Thank you so very much for these instructions! It was exactly what I needed and everything is looking OK so far.

This post has: 0 recommendations

It's OK · Guest

Thank you a million, sir!
I can remove netspry.com successfully by following your instruction.

However, I found that I lost all the applications that are supposed to run in the "startup", such as my palm hotsync, norton, etc. As a result, my system icon tray (right area of task bar) are almost empty. Luckily, everything seems working well so far. Do you have an idea how to get all that back? It'd be antastic.

Appreciate! Very Happy

None of the above instructions require you to go anywhere near the startup folder ... so I don't know what you have done to cause this ... steam

This post has: 0 recommendations

Oddjob · Posted: Thu 09/23/2004 6:15am [Post #6]

In Windows XP you should find programs running at Start-up are contained in the folder located at C:\Documents and Settings\(username)\Start Menu\Programs\Startup.

To make adjustments for programs running at Start-up right click the Start button and left click Explore. You will be presented with Windows Explorer in two panes -- the left-hand side showing the routing structure/tree and the right-hand side showing the file contents. In the routing structure left click the Start menu then left click Programs.

On the right-hand side you will see a pane showing the programmes that launch on Start-up.

To add programs to that folder drag-and-drop a shortcut for required program(s) to that right-hand pane of the screen.

From time to time you may find programs you won't want but which Windows launches automatically. To remove them delete the shortcuts to the unwanted program(s).

If you're not sure if you want to remove a program from Start-up then drag the shortcut to your desktop to remove it temporarily from the Start-up folder. Delete it from there when you make the final decision. Should you want to return the shortcut to the Start-up folder use drag-and-drop.

By the way, if you have any more questions please post them to the general "get computer help" section rather then here otherwise the person with the answer may not see your question.

Hope this helps.

This post has: 5 recommendations

Deana · Guest

Hi...I have to admit that I am completely baffled by your instructions. What on earth is a 'hijackthis log'? What is the easiest way to remove Ads234 from my computer? It's driving me insane! Thanks.

Deana

Check out this link :-

http://www.help2go.com/postt9431.html

A hijackthis log is the easiest way to remove this ... when you have read the above link ... if you still need help ... start a new topic in the forum and post your hijackthis log....

steam

This post has: 0 recommendations

Tvcooper2001 · Guest

I have tried and thought I was successful in removing these bothersome things. But, I rebooted and the y came back along with a "SEARCHBAR" at the bottom of my screen with adds and several icons and file folders that were created.

Tom I have deleted your log, this thread is for comments only...

Please start a new topic in the forum and post your log in it.

Thank You

steam

This post has: 0 recommendations

Woohoo! · Guest

Steamwiz:

I've been plagued with ads234 and netspry for a couple of weeks now and couldn't figure out how to get rid of it. I tried a few other methods that I found by googling without success. I followed your instructions though and it looks like everything is fixed and back to normal.

Thanks a bunch!!

That's great Woohoo! ... Glad it helped you ... steam

This post has: 0 recommendations

Chemical X · Guest

this ads234 cr@p has plagued me for weeks.....but now it is gone. amazing instructions, easy to follow. i got hit with version 3, but solved the issue. people like you have a special place in cyber land.

This post has: 0 recommendations

sharkboy · Guest

Worked great, as far as I can tell at th is point. I'll post again in a few days if everything shakes out OK.

This post has: 0 recommendations

t_c_mits · Guest

Thanks for your help. The instructions(in this thread) were very clear. I just followed them right down to a successful termination of Netspry.

I owe you much. Thanks again.

This post has: 0 recommendations

Teresaroll · Guest

You have been so helpful...................................... This log was moved to your original topic. This "Sticky" is not for HJT logs. BG

This post has: 0 recommendations

Guest · Posted: Wed 09/29/2004 9:30pm [Post #14]

This was very helpful. I finally got the ad234.com removed. Thanks Thanks

You are welcome, glad we could help

This post has: 0 recommendations

jsandler · Guest

Your solution to eliminate Netspry was brilliant. I spent hours trying to clean up my system but to no avail. Thanks again!

This post has: 0 recommendations