Adware won't go away

talk random
1

When I go to Start > Settings > Control Panel > Add/Remove Programs, I see this program called “WebRebates (by TopRebates.com)”. There is also an annoying program of the same name in my task manager which takes up quite a lot of CPU and RAM. I’ve run Ad-aware and Norton Internet Security and uninstalled it numerous times, but it just won’t go away.

This adware was stupid enough to include its website in the program name. So how I can shut their website down and get rid of my virus? I need revenge!!!

2

I made a draft of an angry letter. Any suggestions?

To:
Ed Yeh
4546 B-10 El Camino Real, Suite 327
Los Altos, CA 94022

It seems that your company, www.toprebates.com, has installed adware on my computer. I’ll remind you that this is illegal under US law. Please tell me how to remove this adware from my computer. I’ve already tried many anti-virus programs, and they’ve all failed. If I do not receive a response within 48 hours, I will be forced to take legal action.

Katsuhiro Nakagawa
Toyota Motor Corp
Vice Chairman

3

Yea, I just formatted, and my little brother was visiting my house, and he somehow installed around 40 adware programs. One of them is that toprebates.com thing too. Screw them man.

4

don’t have much time - but a program called “Pest Patrol” should remove it without a hitch for you.

5

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).
Be sure you’re able to view hidden files, and remove the following files in bold (if found):

C:\Program Files*Web_rebates*<-----folder

more information hit up geekstogo

6

Not Free = Not for me. :trout:

Been there, done that. Failed :wink:

7

[ot]Are you really the vice chairman of toyota?[/ot]

8

ok well here we go…Download HiJack This

open it, hit scan, then save log, then copy and paste the log here.

9

theres a freeware program called “Adaware” made by a swedish company “lavasoft”. just install it and update the file defenitions…that should do it, very nice program for spam and stuff like that

10

Adaware + Spybot + 2 restarts = no more spy/adware

11

Go check out spysweeper

12

TopRebates Manual Removal:
Follow these steps to remove TopRebates from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Kill these running processes with Task Manager:
arupdate.exe
programfilesdir+\web_rebates\disp1150.exe
programfilesdir+\webrebates\webrebates.exe
programfilesdir+\webrebates\webrebates1.exe
systemroot+\2805e.exe
unregister.exe
unstsa3.exe
webrebates0.exe

go to start - run - type regedit -

Go to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates, delete it and reboot the machine immediately.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates0, delete it and reboot the machine immediately.

Unregister these DLLs with Regsvr32, then reboot:
start - run then type as an example the following format:
"regsvr32 /u filefromlistbelow.dll"
continue through the list - typing the command each time and pressing ok

adroar.dll
systemroot+\3_0_1browserhelper3.dll
systemroot+
eti.dll
systemroot+\system32\imgconv.dll
systemroot+\system32\vic32.dll

Remove these registry items (if present) with RegEdit:
HKEY_LOCAL_MACHINE\software\classes\appid\hungryhands.dll\appid
HKEY_LOCAL_MACHINE\software\classes\clsid{0a8ce102-fa03-4612-9bee-7fe5452f4cb1}
HKEY_LOCAL_MACHINE\software\classes\clsid{bcf96fb4-5f1b-497b-aecc-910304a55011}\appid
HKEY_LOCAL_MACHINE\software\classes\interface{f8fb4ea2-6c05-4de5-8cd0-625b03f48e22}
HKEY_LOCAL_MACHINE\software\classes ypelib{03f8822f-8877-4002-8bcd-b532d53d8471}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer oolbar{26398112-f068-4273-964b-a1d8bcf3e576}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\bho_path
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\bhonew
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\bhonew_url
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\bhonew_version
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\bhoversion
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\keynew
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\keynew_url
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\keynew_version
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects{c5941ee5-6dfa-11d8-86b0-0002441a9695}\keyversion
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\dcr2
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
\c:/winnt/downloaded program files/conflict.1/installer.dll.owner
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
\c:/winnt/downloaded program files/conflict.1/installer.dll{7eb15626-cb8e-4174-8a72-c055b12b4310}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
\c:/winnt/downloaded program files/wuinst.dll.owner
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
\c:/winnt/downloaded program files/wuinst.dll{e2f2b9d0-96b9-4b25-b90c-636ecb207d18}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates0
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved{26398112-f068-4273-964b-a1d8bcf3e576}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\untopr1150
\displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\untopr1150
\uninstallstring
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\windows sr 3.0--
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\windows sr 3.0\displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\windows sr 3.0\uninstallstring

Remove these files (if present) with Windows Explorer:
1150_0.dat
1150_1.dat
1150_2.dat
1150sh.dat
40d3649e11d4.dat
40d364a11d51.dat
40d364a94b0d.dat
40d364aa1c1d.dat
adroar.dll
arupdate.exe
autotrack_readme1.txt
b3_t_%22web+rebates%22763.xml
belt.ini
fwntoolbar.dll.manifest
install.log
jau5055.dat
jsy5055.dat
key3.txt
log.txt
merc1158.dat
popo1150a_r.htm
popo1150a_rb.htm
popo1150a_rbh.htm
popo1150a_u.htm
popo1150a_ub.htm
popo1150a_ubh.htm
pref1150a.htm
programfilesdir+\web_rebates\disp1150.exe
programfilesdir+\webrebates\webrebates.exe
programfilesdir+\webrebates\webrebates1.exe
psid1158.dat
rge5055.dat
scri1150a.htm
spec1150a_r.htm
spec1150a_rb.htm
spec1150a_rbh.htm
spec1150a_u.htm
spec1150a_ub.htm
spec1150a_ubh.htm
sty5055.dat
systemroot+\2805e.exe
systemroot+\3_0_1browserhelper3.dll
systemroot+\artmmp.ini
systemroot+\cache371\b_371_0_1_501300.htm
systemroot+\cache371\b_371_0_1_569200.htm
systemroot+\cache371\b_371_0_1_582200.htm
systemroot+
eti.dll
systemroot+\system32\adcache\b_371_0_1_501300.htm
systemroot+\system32\adcache\b_371_0_1_569200.htm
systemroot+\system32\adcache\b_371_0_1_582200.htm
systemroot+\system32\imgconv.dll
systemroot+\system32\vic32.dll
topr1150.dat
toprebates.txt
unregister.exe
unstsa3.exe
web_rebates.txt
webrebates0.exe

Remove these directories (if present) with Windows Explorer:
programfilesdir+\web_rebates
programfilesdir+\web_rebates\da1150\david
programfilesdir+\web_rebates\sy1150\html
programfilesdir+\web_rebates\sy1150\images
programfilesdir+\web_rebates\sy1150\sy1150
programfilesdir+\web_rebates\sy1150 p1150
systemroot+\winskw

make sure that the first processes are stopped - if they aren’t you will run into problems - you could also reboot into safe mode to do this procedure.

if you have trouble let me know.

13

hijack this is the easiest way to get rid of it but be careful when deleting stuff be very careful

14

hijack this doesn’t remove but like half of the program unfortunately.

15

No, it’s just to intimidate the hoe.