[EP_X0FF]

How do I stop the hooking :lol:

http://www.kernelmode.info/forum/viewto ... 741#p16741

Thanks I did try these steps, all successfully except the very last one (delete .DLL)

Regarding cacls I got: "Successfully processed %path of dll%", rebooted. Nulled APPINIT_DLLs - OK, reset perms using cacls again - OK. But then the .DLL still failed to delete. And this is all after both eType Manager and IBUpdaterService services were stopped and deleted. Processes killed.

Then you did something wrong. The same scenario works here.

[thisisu]

Thanks guys, going to experiment some more :)

[thisisu]

Then you did something wrong. The same scenario works here.

Yes I must have. It's working for me now. Sorry for the confusion.

[thisisu]

Newest one is called: Veoh Manager

http://www.bleepingcomputer.com/forums/ ... p__2914463

I suspect this is related, perhaps the source:

Code: Select all

2012-08-21 08:44 4686848 ----a-w- c:\program files\Veoh Networks\VeohWebPlayer\VeohWebPlayer.exe

Same modifications to the system though.

[thisisu]

Another one is: "SearchAlgo Manager"

http://windowfin.com/bbs/board.php?bo_t ... r_id=77321

[thisisu]

Another one is: Sidekick Manager
http://windowsvc.com/bbs/board.php?bo_t ... r_id=37457

I'm wanting to add full protection versus this type of adware in my program and would like you guys opinion. It definitely requires at least one reboot to remove IAT hooks set in place as previously mentioned by others in thread.

Do you think I should set a routine to perform if:
Bad service related to infection is detected as running
or
Bad DLL is loaded in modules but service is not running.

I'm thinking bad DLL is better but would like your opinions on which way is safest/best. :)

Thanks!

[thisisu]

I went the module .DLL route
Short video with success: http://www.youtube.com/watch?v=ubG5Lq-JPb8
Still need to test on Vista, 7, and 8.

[Blaze]

Two more bProtector Adware, just for fun.

Attached.

[Blaze]

More. Includes Babylon, Browser Manager, Data Manager etc....

[Blaze]

...continued from above post. Includes Browser Manager, iLivid, Searchqu, Yontoo etc...