"adm.exe" spyware removal help needed

[ClickBuster]

OK, here're a few things I would do to.

1. I would log off and start Windows in Safe mode + Networking

2. Run regedit and check for strange things in:
HKLM > Software > Microsoft > Windows > Current Version > Run
HKLU > Software > Microsoft > Windows > Current Version > Run

3. Check C:\WINNT\win.ini for a [load] or run=something. If I see something like that pointing to a suspicious .exe I remove the line and try to delete the file

4. Go to C:\WINNT\system32\ and sort the files by date (newest on top) and delete all strange .exes and similar (things like asdzx123.exe usually)

5. Go to http://www.definitivesolutions.com/bhodemon.htm and download BHODemon - tricky simple tool that cleans/blocks IE toolbars - much better than any spyware out there, when it comes to hidden IE toolbars.

6. Go to http://www.pandasoftware.com/products/activescan.htm. On the right side you'll see "Free online virus scan". Use this to check your system, just in case.

If you think that you're ready to go, reboot the system in normal mode.

I hope this helps

[f69j69b]

hi dareutwo
I had something like that once check your dns

Fred

[plateman]

mostly when trying to get rid of these things you gotta prep for it first..

turn off system restore, start in safe mode and run about 6 or so programs...

dareutwo the way I figured some of it out was after I ran hijackthis and I read the log, anything that looked like it shouldn't be there I would google it.. also I found a site that told you what most .exe and dll were and if they were scum or not... another good program is ewido,

another thing you probably know is that once you get infected with spyware and tojens there are very good spyware sites out there that has steps to follow to get rid of the shit...

like my last bout with the stuff I had I completely got rid of the shit, but a few days later I noticed when going on certain sites I would get redirected, so I did some research and didnt find anything, so I ran everything again and reread my hijack log and found some strange ip's in it.. and when I checked were the ip's were from I knew it was crap and I deleted them and never again had anymore redirects, and no spyware program would take that stuff out...