e2give

I am having problems getting rid of e2give spyware. I have tried most of the antispyware tricks and techniques Major Geeks suggested that applies but it keeps coming back. I think it is hijacking my antispyware (Counter Spy and Ad-Aware) Everytime I run them Counter Spy comes up and says it is downloading and it Allows it. Anyone else having this problem?

 

http://securityresponse.symantec.com/avcenter/venc/data/spyware.e2give.html
Symantec Security Response - Spyware.e2give try deleting registry keys

 

Thank you for your reply. I have already tried this. It keeps coming back. When I use Ad-Aware it takes over my mouse and clicks on the ignore button so you can't delete it. The cursor goes crazy and you have to contrl alt delete to make it quit. Prutect and e2give spyware work together, I am not sure how, but they hijack spyware programs and I can not get rid of them. I have quit using CounterSpy and Ad-Aware until they can close there hole. I have used other antispyware and hopefully it is gone for now. Until I restart at least.

 

startuplist and hijackthis quick downloads shows whats running if it comes back try them

 

hijack this catches it, I remove it, then bring up hijack this again and it is back! Hardest thing I have ever tried to get rid of. I think it is reformat time. I just wish I knew how I got it in the first place so I could possibly prevent it, if that is possible. Thanks for the info though.

 

my $.02:

If it keeps showing up on HJT log then either HijackThis is not able to delete it or it does delete it but there is another executable that is causing it to respawn!
Did you try running HJT and fixing it after booting Windows in the 'Safe Mode'? just checking...
Also since e2Give is a BHO (Browser Helper Object), download ToolbarCop to get rid of it: http://www.majorgeeks.com/download4126.html

 

Thank you for the info. I will try that. I went to Ad-Aware's site and other people are having the same problem so I think it is only a matter of time when lots of people do. I think the parasites are finding ways to disable spyware. Ad-Aware has not fixed the problem on their end as far as I know. They thought it was a "mouse issue". No. I finally tried something someone else suggested on that site to get rid of Prutect. Prutect is so sneaky it changes the file name everytime you try to delete it. If you search for all files like this you can find them, "pr*exe" without the quotations. I hope this helps someone else. I have worked on it for 2 days. I have learned alot, though. Spyware is a big nasty problem. Thank you for all who responded.

 

Change browsers and you'll avoid the nasties.

 

Locate the prutpct executable in the window/system32 folder, rename to a .bak and the delete. Rerun Microsoft antispyware e2give cannot be found along with another troublesome spyware.

 

Please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.


After doing ALL of the above if you still have a problem:

Make sure you have HijackThis 1.99.1 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT


NOTE: Please remember that Microsoft's AntiSpyware is in BETA testing only! This is NOT the full release and it does contain some flaws. It has also had reports of false detections. Please Be Careful!