Re: "The Best Offers" Spyware Removal in Security http://www.dslreports.com/forum/r14413638 en Thu, 03 Dec 2009 09:47:54 EDT Thu, 03 Dec 2009 09:47:54 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14488917 mrchris : Shouldn't you two new guys make a seperate thread instead of hijacking GameGuy's thread? :hmm:]]> http://www.dslreports.com/forum/remark,14488917 Sun, 02 Oct 2005 15:55:42 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14487752 nalobu : To GameGuy:

After I read your post I downloaded the Kaspersky AV and it caused my computer to crash immediately.

It keeps crashing and I can't seem to do anything about it. :\ Any ideas? ]]> http://www.dslreports.com/forum/remark,14487752 Sun, 02 Oct 2005 12:07:48 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14459676 CalamityJane : Hi Pixieelf, welcome to the forum! :)

This Aurora malware sometimes comes bundled with other nasties as well which require a different routine. Try the Ewido full system scan and also the nailfix utility.

Adaware with the vx2cleaner plug-in has been successful with this bundle (in addition to Ewido)
Make sure you have Adaware SE Personal Edition v. 1.06 1r installed and updated.
»www.download.com/Ad-Aware-SE-Per···910.html
and get the VX2 Cleaner Plug-in. Install Ad-Aware using the default options, then install vx2cleaner_inst.exe, taking all the defaults there as well.

Run Ad-Aware, update to the latest definitions, then click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.

Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.

You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.

When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.
--
It takes a disaster to make a woman out of a female
Microsoft MVP/Windows Security 2003-2005
Proud Member of ASAP (Alliance of Security Analysis Professionals)]]> http://www.dslreports.com/forum/remark,14459676 Wed, 28 Sep 2005 10:29:03 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14459556 Pixieelf : Thanks to all for the advice on this, I got hit with it and it has taken me hours to 'hopefully' get rid of it.

I followed CalamityJane's advice, and unfortunately, it all came back within about 10 minutes. I tried again and deleted items from the Registry as well, and it seems to have gone. If it helps anyone, below are the lines/sections I killed from the registry.

---------
HKEY_CURRENT_USER\Software\aurora (delete whole section)
---------
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SvcProc (delete whole section)
---------
In the section...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

...you will see a very obvious value pointing to a file that Aurora has created in %System32%. The value will be...

%System32%\randomname.exe r

randomname is exactly that, but really easy to spot, both times I saw it, it was two different names, both were just 8 random characters long.
---------
in the key...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

It changes the value of the Shell key from...

Explorer.exe

to

Explorer.exe %WindowsDir%\Nail.exe

All I did here was change it back to Explorer.exe
---------

I haven't had any problems yet with this, so hopefully the above has killed it off for good.

Pixie.]]> http://www.dslreports.com/forum/remark,14459556 Wed, 28 Sep 2005 10:11:23 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14456013 CalamityJane : Good luck. That combo of Ewido with latest updates (in Safe mode!) and the nailfix utility has worked pretty good with the masses I have dealt with.

Not everything shows up in HijackThis since it doesn't scan the entire system...it only sometimes points us in the direction of a tool or special fix to use. Aurora is complicated and comes sometimes with other nasties that Ewido should be able to find.

"The Best Offers" is Direct Revenue's new naming of the thing
--
It takes a disaster to make a woman out of a female

Microsoft MVP/Windows Security 2003-2005


Proud Member of ASAP (Alliance of Security Analysis Professionals)]]> http://www.dslreports.com/forum/remark,14456013 Tue, 27 Sep 2005 19:35:29 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14454396 GameGuy369 : OK now I feel dumb. I have removed nail a thousand times and didn't think this was it since it was not in HiJackThis. I will try that today when I am at work. Also, ewido amazingly is pretty good at this stuff. Thanks!]]> http://www.dslreports.com/forum/remark,14454396 Tue, 27 Sep 2005 15:21:15 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14452036 CalamityJane : We've had good results on Direct Revenue's "The Best Offers" (Aurora/Nail infection) with this program, Ewido Security Suite. And a utility called Nailfix.

Please download the Nail/Aurora Spyware Fix from NoIdea.US
www.noidea.us/easyfile/file.php?download=20050515010747824

Unzip it to the desktop but do NOT run yet.

Next, please download, install and update free trial version of Ewido Security Suite 3.5
»www.ewido.net/en/
{click on free malware scan on the left-hand menu which will take you to the free trial download}

(a)From the main ewido screen, click on update in the left menu, then click the Start update button.

(b)After the update finishes (the status bar at the bottom will display "Update successful")

(c) Reboot to SAFE MODE and keep IE closed.

Once in Safe Mode, please double-click on nailfix.cmd that you unzipped earlier. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

(d) Run a scan with Ewido. Click on the Scanner button in the left menu, then click on the Complete System Scan button. This scan can take quite a while to run, so please be patient

(e) If Ewido finds anything, it will pop up a notification. You can select "remove" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.

(f)When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Reboot back into normal mode and post the results from the Ewido log. Let us know if any problems remain and what sypmtoms you see if any
--
It takes a disaster to make a woman out of a female
Microsoft MVP/Windows Security 2003-2005
Proud Member of ASAP (Alliance of Security Analysis Professionals)]]> http://www.dslreports.com/forum/remark,14452036 Tue, 27 Sep 2005 09:04:37 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14451214 GameGuy369 : The log is clean. And for that I am sure as I have done hundreds of them. Here's a list of the following that found nothing, after the initial cleaning of course.

HiJackThis!
Spybot S&D
Ad-aware
Trend Micro Housecall
Xoft Spy
XCleaner
Norton AV
Kaspersky AV (this shocked me)
MS Anti-spyware.

I believe that is everything. ]]> http://www.dslreports.com/forum/remark,14451214 Tue, 27 Sep 2005 03:07:45 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14448798 CalamityJane :
said by GameGuy369 See Profile :

We hoped someone had some manual instructions for removal. Thanks though.
Yes, we do :)

But we need a HijackThis log, forum rules state that you must follow these steps first
»Security »I think my computer is infected or hijacked. What should I do?
(If you have done them, please elaborate what you have done) and post the log from Ewido please, along with a HijackThis log
--
It takes a disaster to make a woman out of a female
Microsoft MVP/Windows Security 2003-2005
Proud Member of ASAP (Alliance of Security Analysis Professionals)]]> http://www.dslreports.com/forum/remark,14448798 Mon, 26 Sep 2005 19:52:44 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14448109 GameGuy369 : It's cool. I only responded out of a frustrating day. The thing you need to keep in mind, is that I can only speak from my experience. Personally our "precinct" is very smart, and quick and honest. We tell people when to just buy a new system rather than pay us to replace parts. Obviously we push for them to buy the system from Best Buy, but that is a typical thing. Also, you would be amazed at how much we get yelled at on a daily basis by people who have no idea what they are talking about. So our job isn't just as easy as it may seem.

Obviously we are not the experts of the world, but we are good enough to fix most problems people have.]]> http://www.dslreports.com/forum/remark,14448109 Mon, 26 Sep 2005 18:30:37 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14446856 aquias0 : Wasn't meant as an attack. Observations that came out very poorly due to a frustrating day. I apologize for that.]]> http://www.dslreports.com/forum/remark,14446856 Mon, 26 Sep 2005 15:48:19 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14446779 GameGuy369 : Thanks for the attacks. But besides all that, we are actually usually very good at removing everything to perfection and keeping our customers happy. I dont know about other places, but we do very weel in customer satisfaction. This was the only time we had this problem and the guy who has the disk needed for bypassing the proxy is on vacation and we wanted her system done before then. We hoped someone had some manual instructions for removal. Thanks though.]]> http://www.dslreports.com/forum/remark,14446779 Mon, 26 Sep 2005 15:37:32 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14446430 King Edward : I used the uninstaller jack b See Profile uploaded several weeks ago on a friend's computer after several days messing with it. I'll have to say it works.
I think "Bestoftheinternet" was bundled with PC Tuneup or some similarly-named software.]]> http://www.dslreports.com/forum/remark,14446430 Mon, 26 Sep 2005 14:45:47 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14446067 garys_2k : Excellent points. We are talking about a contractor that has a delivery deadline, and it's likely this problem will need some R&D to figure out.]]> http://www.dslreports.com/forum/remark,14446067 Mon, 26 Sep 2005 13:47:56 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14445899 B :
Agreed on principle, but (a) he or she was in a hurry, and (b) the ones that bother supplying an uninstaller usually seem to work.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14445899 Mon, 26 Sep 2005 13:17:41 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14445879 garys_2k : I don't know, it just seems to me that there ought to be a better way to remove this than running more of the spyware company's stuff on your machine. Would it REALLY uninstall it, would it leave some active component, or new component, behind?

Rather than try to get around the firewall to reach that site there should be a way of cleaning it off using safe mode, regedit or booting Knoppix (or some combination). I hate to see anyone running known-malware providers' software for any reason.

Edit because I couldn't spell "component" a little while ago.]]> http://www.dslreports.com/forum/remark,14445879 Mon, 26 Sep 2005 13:15:01 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14445759 aquias0 : Well...I guess that answers one of the questions I get from time to time...and I now know a company not to recommend (I refuse to work on co-workers systems, hence they ask for recommendations).

No offense meant to you Game. But B is correct, there should be an escalation procedure to get you around the proxy for this file. Additionally, you should be able to recommend the "best" tools. But, money talks and you guys are forced to tow the corporate line...understandable...just...sad.]]> http://www.dslreports.com/forum/remark,14445759 Mon, 26 Sep 2005 13:00:23 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14438332 Dr Tweak :
said by B See Profile :

Nah, don't blame the geek wannabes for that. People buy their HP or Dell and see NAV bundled on their desktop. Six months later the trial has expired, but they don't know/don't care until the machine slows down to a turgid mess of malware.

Finally they drag it in to these poor saps and demand that everything get fixed in an hour. Not a fun job, particularly if you're new at it.

Blame KAV, if you want, for not being as aggressive enough in its marketing so as to make itself present on the default Dell and HP et al. shipments. I bet if they undercut NAV by a few dollars and included a full year or two of updates they could make some headway.

Then again, for all I know McAfee and Norton pay Dell for the privilege of installing that trial software and lassoing in new suckers.

-- B
I'm not blaming the end user, I'm blaming the guy people pay a lot of money to. The guy that is supposed to be the expert and fix their computer..... the guy that sells them Norton. I see it all the time, a new client I acquired about 4 months ago had a franchise company like Geeks on Call work on their computers in the past (within the past year) and sell them Norton 2004. They have 4 workstations, one had 187 viruses, another 67, another 3 and the last had 8. All of these workstations had Norton 2004 up to date and setup by a "professional". I sold them KAV and it found what I said, this company receives hundreds of emails daily and KAV on average catches 10-20 viruses daily, many of which are from their own people at other locations with their own company..... all of which use SAV 10.

The same company set their wireless up with only 64bit encryption, they now have WPA2 that I set up.

These so called "computer experts" for these companies like Geeks on Call, The Geek Squad etc. have never impressed me with anything I have seen...... but I guess it's actually a good thing because they ultimately make me money.

:(:D]]> http://www.dslreports.com/forum/remark,14438332 Sun, 25 Sep 2005 09:22:55 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14437960 GameGuy369 : Exactly. I run a Kaspersky on my home machine and so do most of the Geek Squad guys. None of our personal computers ever have problems. However, we are forced to push this type of software anyway.]]> http://www.dslreports.com/forum/remark,14437960 Sun, 25 Sep 2005 05:54:47 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14437361 B :
Nah, don't blame the geek wannabes for that. People buy their HP or Dell and see NAV bundled on their desktop. Six months later the trial has expired, but they don't know/don't care until the machine slows down to a turgid mess of malware.

Finally they drag it in to these poor saps and demand that everything get fixed in an hour. Not a fun job, particularly if you're new at it.

Blame KAV, if you want, for not being as aggressive enough in its marketing so as to make itself present on the default Dell and HP et al. shipments. I bet if they undercut NAV by a few dollars and included a full year or two of updates they could make some headway.

Then again, for all I know McAfee and Norton pay Dell for the privilege of installing that trial software and lassoing in new suckers.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14437361 Sun, 25 Sep 2005 01:05:42 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14436664 Dr Tweak : Stop using Norton AV for your clients and use Kaspersky and it will fix these kinds of things.

I'm not being a smartass, I'm being serious. I have my own computer business and come behind you guys and Geeks on Call all the time and you have setup and sold Norton, I remove it and install Kaspersky and it almost always finds many pieces of malware.

For instance, last night a client brought me a pc that Geeks on Call worked on just a few months ago, they sold them Norton 2005 and set it up for them. Kaspersky removed 378 pieces of malware from this pc that Norton never caught.

;)]]> http://www.dslreports.com/forum/remark,14436664 Sat, 24 Sep 2005 23:04:06 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14436645 TeMerc :
said by Mo-ness :

"Close all 3rd-party firewalls, such as Norton Antivirus or McAfee Firewall. These might interfere with Best Offers Uninstall connecting to the Internet. You can always turn these programs back on later."
Yeah, that's what we don't want, anything from them to connect to the internet. They can't be trusted, especially since they allow their product to be third party installed, without consent, via exploits as is usually the case with ABI.

Go to a forum and have the items removed by an experienced malware remover, stay away from anything these types of companies make. ]]> http://www.dslreports.com/forum/remark,14436645 Sat, 24 Sep 2005 23:01:31 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14436393 anon : had the same problum -- to get rid of the crazy pop up from the best offers you have to scroll to the bottom of their page an click contact , than you will be led to a page that you have to download their uninstaller which I did but still was there --- I did it again but before i ran the uninstaller I did a control/alt/delete and made sure it wasn't in the processes tab also I ran msconfig and checked to remove it. than I ran their uninstaller and rebooted after that I ran a register clean program and finally the dam thing was gone and hasn't been back yet this has been 3 weeks so far hope it helps ]]> http://www.dslreports.com/forum/remark,14436393 Sat, 24 Sep 2005 22:17:02 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14435743 anon : »uninstall.bestoffersnetworks.com···inst.exe

you have to download the uninstaller file and save to your desktop. "Close all 3rd-party firewalls, such as Norton Antivirus or McAfee Firewall. These might interfere with Best Offers Uninstall connecting to the Internet. You can always turn these programs back on later."
Follow the Uninstall Wizard instructions.

When you see the 'Uninstall Complete' message, before doing anything else, re-start your computer. ]]> http://www.dslreports.com/forum/remark,14435743 Sat, 24 Sep 2005 20:20:11 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14415127 TeMerc : 'TheBestOffers' is a Direct-Revenue variant combo Aurora\Nail infection.

If your unlucky, you also have Epolvy as well. Need to fix Epolvy first, then Aurora.

I removed TBO manually in regedit to get it off the Add\Remove panel, and it stayed gone.

Also see the following page from Webhelper about the uninstaller:
»www.webhelper4u.com/

Good luck.]]> http://www.dslreports.com/forum/remark,14415127 Wed, 21 Sep 2005 19:23:35 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14414919 jack b : Here is the uninstall exe file linked from B's post above.

YMMV.
TBONUninst.zip 153,184 bytes
]]> http://www.dslreports.com/forum/remark,14414919 Wed, 21 Sep 2005 18:51:21 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14413674 GameGuy369 : Still doesn't work. Stupid proxy. Thanks for the help though. I wouldnt ask for anyone to download it for me. Thanks!]]> http://www.dslreports.com/forum/remark,14413674 Wed, 21 Sep 2005 16:05:10 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14413638 B :
Well, I can get to that page and find the link for the file, but no way would I run such a thing myself.

Perhaps your proxy is stupid and you can use the IP address directly; never mind I can't get that to work either. Anyway, the direct link is »uninstall.bestoffersnetworks.com···inst.exe and there don't seem to be any mirrors anywhere.

Sorry -- you could run out to a web cafe or something. But again, isn't there some kind of escalation procedure at your place for this sort of thing?

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14413638 Wed, 21 Sep 2005 16:00:29 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14413604 GameGuy369 : Yes. That is something I considered. Problem is our precinct is running a 48 hour turnaround and this system is done completely once we get that removed. I was hoping there was an another way. The link it gives is www.bestoffersnetworks.com/uninstall. Can you tell me if it works for you so I know if it really is just blocked? Thanks for any assistance.]]> http://www.dslreports.com/forum/remark,14413604 Wed, 21 Sep 2005 15:53:54 EDT Re: "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14413575 B :
said by GameGuy369 See Profile :

Hi there. I work for the Geek Squad and we have a computer that has the "The Best Offers" spyware which is not detected by spybot, adaware, housecall, ewido, and many other scanners, but it exists and does cause pop-ups. When you go into control panel and use the uninstall method to remove it, it says you need to use a tool of theirs, which unfortunately because it is a spyware website, our network blocks access to that page. Has anyone else worked with this spyware before and know how to remove it? Thanks!
Now this is funny. Although I do enjoy your commercials.

Have you considered simply downloading the uninstaller from a machine outside your network? (Put it on CD or USB RAM disk, etc.) Or moving the machine outside your network? Or taking the hard drive home? Or changing your network's proxy temporarily? Or just asking your manager? I mean, you guys get paid for this, right?

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,14413575 Wed, 21 Sep 2005 15:50:29 EDT "The Best Offers" Spyware Removal http://www.dslreports.com/forum/remark,14413546 GameGuy369 : Hi there. I work for the Geek Squad and we have a computer that has the "The Best Offers" spyware which is not detected by spybot, adaware, housecall, ewido, and many other scanners, but it exists and does cause pop-ups. When you go into control panel and use the uninstall method to remove it, it says you need to use a tool of theirs, which unfortunately because it is a spyware website, our network blocks access to that page. Has anyone else worked with this spyware before and know how to remove it? Thanks!]]> http://www.dslreports.com/forum/remark,14413546 Wed, 21 Sep 2005 15:46:56 EDT