Jump to content


Photo

How i got rid of Res://C\windows\ylcmx.dll/sp.html


  • Please log in to reply
4 replies to this topic

#1 lance49726

lance49726

    Member

  • New Member
  • Pip
  • 4 posts

Posted 24 June 2004 - 09:29 PM

See the pinned topic http://www.spywarein...?showtopic=8847 for our instructions. cnm

I thought i would let you know how i got rid of Res://C:\windows\ylcmx.dll/sp.html#27063 spyware that hijacked my home page. 1st i did everything in the FAQ in this fourm it only helped 1 time when i reconnected to the internet the 2nd time the "home search" page came back. so what i did was remove everthing with "ylcmx" in the registry, note that when the spyware came back it changed its name from"ylcmx.dll" to "vjvrn.dll" then to "hlcvx". Do everything in the FAQ hijack removal, then i removed a icon named ATLPA32 also CHOICE from C:/windows or C:/windows/system32 i forget which, i had to remove the ATLPA32 icon from the safe mode. If you hover your mouse pointer over the icons it will tell you when it was created which be around the time you got hijacked. Reboot and it was gone and didnt come back.

Edited by cnm, 28 June 2004 - 09:10 AM.


#2 lance49726

lance49726

    Member

  • New Member
  • Pip
  • 4 posts

Posted 28 June 2004 - 02:20 AM

I thought i would let you know how i got rid of Res://C:\windows\ylcmx.dll/sp.html#27063 spyware that hijacked my home page. 1st i did everything in the FAQ in this fourm it only helped 1 time when i reconnected to the internet the 2nd time the "home search" page came back. so what i did was remove everthing with "ylcmx" in the registry, note that when the spyware came back it changed its name from"ylcmx.dll" to "vjvrn.dll" then to "hlcvx". Do everything in the FAQ hijack removal, then i removed a icon named ATLPA32 also CHOICE from C:/windows or C:/windows/system32 i forget which, i had to remove the ATLPA32 icon from the safe mode. If you hover your mouse pointer over the icons it will tell you when it was created which be around the time you got hijacked. Reboot and it was gone and didnt come back.

All i'am saying is this is how i got rid of it after doing everything in http://www.spywarein...jacked/#removal and it did not work,i redone the above removal and when i went in C:/windows and C:/windows/system32 is where i found those icons that was created at the same time i got hyjacked. the names would be different for the various infection.

#3 lance49726

lance49726

    Member

  • New Member
  • Pip
  • 4 posts

Posted 28 June 2004 - 02:29 AM

All i'am saying is this is how i got rid of it after doing everything in http://www.spywarein...jacked/#removal and it did not work,i redone the above removal and when i went in C:/windows and C:/windows/system32 is where i found those icons that was created at the same time i got hyjacked. the names would be different for the various infection.

#4 Tuxedo Jack

Tuxedo Jack

    Creator of TuxPE, a Cat5-o'-9-Tails, Etherkillers, and more

  • Expert
  • PipPipPipPipPip
  • 1,757 posts

Posted 28 June 2004 - 07:40 AM

Mods, please merge this thread with the other thread he made about this, then lock them.

cnm, you may wish to deal with this in private.
Signature file is under revision. This will be back shortly.

#5 cnm

cnm

    Mother Lion of SWI

  • Administrators
  • PipPipPipPipPip
  • 25,317 posts

Posted 28 June 2004 - 09:12 AM

Please see the pinned topic http://www.spywarein...?showtopic=8847

lance49726 - as noted in the pinned topic, Ad-Aware with the latest update takes care of it except for a few leftovers to be fixed with HijackThis.

Please do not post multiple threads about the same thing, and do read the pinned topics.

Microsoft MVP Windows Security 2005-2006
How camest thou in this pickle? -- William Shakespeare:(1564-1616)
The various helper groups here
UNITE





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button