Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

OdFanMan.exe, "The Best Offer"


  • Please log in to reply
6 replies to this topic

#1 vierof

vierof

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:47 AM

Posted 14 September 2005 - 08:56 AM

I found "The Best Offers", "Related Sites Toolbar", "SelectRebates", "Web Fast Connect".
A few of them I removed manually and using antispy software.

I have used Ad-Aware, SpyBot, Spy Sweeper and other software including Microsoft's Beta 1 version and my hijackthis log file seems to be clean. But I was not able to remove "The Best Offer" :thumbsup:
In addition to this problems I constanly have the annoying popup window "Internet Explorer has encountered a problem and needs to close".
And when I am shutting down my computer I always see the message "OdFanMan.exe DLL initialization failed"

Need your help !!!
Thank you

BC AdBot (Login to Remove)

 


#2 vierof

vierof
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:47 AM

Posted 14 September 2005 - 11:36 AM

It seems, the "The Best Offers" belongs to the same "programs", as "ABetterInternet.Aurora". Because the Direct Revenue LLC ("The Best Offers" ) has the same phone number as Aurora Networks (Better Internet).

#3 jgweed

jgweed

  • Members
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:10:47 AM

Posted 14 September 2005 - 04:58 PM

Have you posted a HJT log for our volunteer team of experts to review? Many times their experience will find things you might have missed on your own. Please, though, be patient, as logs are taken in a first-posted, first-reviewed basis, and other members may be ahead of you in the queue.

See:
http://www.bleepingcomputer.com/forums/How...s-Log-t956.html

Regards,
John
Whereof one cannot speak, thereof one should be silent.

#4 olosan

olosan

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:47 AM

Posted 17 September 2005 - 10:03 AM

All-
I found "ajnkpkjwqw.exe" C:\Windows and these related files in C:\Windows\Prefetch
AJNKPKJWQW.EXE-2946924E.pf
BESTOF~2.EXE-2F8127DF.pf
BESTOF~4.EXE-0919AD4A.pf
BESTOFFERSUNINSTALL3.EXE-2D0864AC.pf
BESTOFFERSUNINSTALL.EXE-100C0258.pf

I ended the ajnkpkjwqw.exe process via Windows Task Manager and deleted the file.

I deleted all the above .pf files from the Prefetch directory and restarted the system.

There are no more dll initialization error dialogs or annoying browser pop-ups.

To remove the item from Add/Remove Programs
http://www.winguides.com/registry/display.php/110/
the key is bsto1 (or similar) - Check the display name property for "The Best..."
Olosan

Edited by olosan, 17 September 2005 - 11:28 AM.


#5 olosan

olosan

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:47 AM

Posted 18 September 2005 - 03:17 PM

All-
I found this on other computers with different exe names but the same malware.
The latest version of Spybot Search & Destroy will successfully remove it.

--
Olosan

#6 azndarkevildemon

azndarkevildemon

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:47 AM

Posted 20 September 2005 - 05:58 PM

i need help getting rid of this one too, when i turn on my computer and it appear from no where , and it keep popping up, i even tried ad-aware 6.0 , new version of spybot search and destory, and microsoft anti-spyware, i am really desprate to get rid of this spyware, can anyone please help me pelase

#7 Leurgy

Leurgy

    Voted most likely


  • Members
  • 3,831 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Collingwood, Ontario, Canada
  • Local time:10:47 AM

Posted 20 September 2005 - 06:50 PM

Hello azndarkevildemon and welcome to BC.

Its always best to start a New Topic rather than posting in someone else's thread as your post tends to get lost and will go unnoticed.

If you have already tried the methods you describe your best option is to post a HiJack This Log for our team to review. They will guide you through the process of removing this malware from your system.

See How to submit a Hijackthis Log and follow those instructions.

Please be patient and wait for a reply without responding until you hear from a team member. Subsequent posts in the thread you start with your HiJack Log will only move you back in the line as they are organized by date and time. Once a team member replies in your thread things will move along quickly.

When the only tool you own is a hammer, every problem begins to resemble a nail. Abraham Maslo

**** We use our powers for good, not evil ****

 Trying to remove your data from the web is like trying to remove pee from a swimming pool





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users