Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Eblaster Help


  • Please log in to reply
9 replies to this topic

#1 FearsCry

FearsCry

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 13 June 2006 - 09:39 PM

the instructions on this website say in step 5. to Reboot and delete the following files:
rmashlex.dll
nvrcr32.dll
eblaster.exe
msrac32.exe
ebsetup.exe

I did everything, but I don't see where to delete these files...I can't find them anywhere.

I also looked at the thread that was from Jan, 13, 2005, so I do not know if there is something different i may need to do to get rid of this.

Mod Edit: Topic moved to a more appropriate forum - QM7

Edited by quietman7, 14 June 2006 - 07:57 AM.


BC AdBot (Login to Remove)

 


#2 Harry83

Harry83

  • Members
  • 257 posts
  • OFFLINE
  •  
  • Location:State College PA
  • Local time:05:46 PM

Posted 14 June 2006 - 12:07 AM

Okay so you're referring to this self help tutorial?

How to Remove eBlaster

You can search for the files by going to Start > Search. Then choose All Files and Folders.

Type in, or copy and paste, the names of the files to delete and search for them. This should find them for you. Then delete them. If nothing comes up, then they are no longer on your system.
--
Harry83
Posted Image
Liberating America From Spyware - 1 Computer at a time...

#3 FearsCry

FearsCry
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 14 June 2006 - 02:00 PM

I tried that tutorial, and nothing came up, but somehow it still keeps a log of everything, and im not sure why this is happening.

#4 Harry83

Harry83

  • Members
  • 257 posts
  • OFFLINE
  •  
  • Location:State College PA
  • Local time:05:46 PM

Posted 14 June 2006 - 02:53 PM

I'm not quite sure what you mean...what is keeping a log of everything? Do you mean, the related entry is still present n the HJT log, after doing steps 1-5 in the tutorial?

Are you still having problems with your computer?
--
Harry83
Posted Image
Liberating America From Spyware - 1 Computer at a time...

#5 FearsCry

FearsCry
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 14 June 2006 - 05:23 PM

When I go follow the tutorial and place the eblaster.reg and merge it, I reboot to find those five files, and I cannot find them. I made sure hidden folders and all folders including the system files and everything on the computer to be searched. Even after that i cannot find these files, but i know its somewhere on the computer because my norton asks to scan spyware.eblaster. I must of done something wrong.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,108 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:46 PM

Posted 14 June 2006 - 06:25 PM

Is this entry gone from your hijackthis log?
O21 - SSODL: XmLdrLocation - {0C887F38-5178-43DA-B9F0-B856141FCDA4} - C:\WINDOWS\System32\nvrcr32.dll

I'm not sure how your searching for these files so lets double check for them as follows:

Use Windows Search feature to locate them. To do this, go to Start -> Search -> All files and folders -> More advanced options

Checkmark these options:
- "Search system folders"
- "Search hidden files and folders"
- "Search subfolders"

Then search for each of those file(s).

If your still not finding anything, then lets try these online Virus scans:
[Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Install ActiveX component.]
Trend Micro Housecall Scan
Panda ActiveScan [ActiveScan Panda does not remove adware/spyware but will autoclean for viruses & worms.]
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 FearsCry

FearsCry
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 14 June 2006 - 08:53 PM

I'm not sure how to configure the hijackthis right to get a scan for that because i looked through the scan it just gave me, and i did not see a code like on the surface, it may be in another file, im not sure. You may have to tell me how to configure hijackthis, so i may see that properly. I just did the panda scan, and nothing came up about eblaster, but i got a norton alert again saying spyware.eblaster detected. I go to scan it and says risks/spyware found, and it removes it, but it comes back everytime, and i do not think it is off the computer.

#8 Harry83

Harry83

  • Members
  • 257 posts
  • OFFLINE
  •  
  • Location:State College PA
  • Local time:05:46 PM

Posted 15 June 2006 - 03:20 AM

The setup directions are found at the following link:

Prep Guide for Posting HJT Logs

Go to that link and skip down to step 9. Follow those directions on setting up HJT very carefully, but skip the part about posting the log to the HJT forum (for now anyways...)

Make sure that you have HJT in its own folder.

When you run HJT, click on Do a system scan and save a log file. A window will appear with the results. Look through the results to see if the entry that Quietman mentioned is still in there:

O21 - SSODL: XmLdrLocation - {0C887F38-5178-43DA-B9F0-B856141FCDA4} - C:\WINDOWS\System32\nvrcr32.dll

Please note that nvrcr32.dll could be replaced with rmashlex.dll. Tell us if the entries are there or not.

Try restarting your computer into Safe Mode and running the Norton scan, since it seems to keep finding something.
b]Reboot into safe mode:[/b]
Restart the computer
Immediately begin tapping the key.
Use the arrow keys to highlight Safe Mode and press the key.

After you run the Norton scan, reboot back to normal mode.

BTW are you having any symptoms on your computer other than Norton saying it has found something??
--
Harry83
Posted Image
Liberating America From Spyware - 1 Computer at a time...

#9 FearsCry

FearsCry
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 15 June 2006 - 02:11 PM

O21 - SSODL: Vidurzap - {D8CA8F79-CD2E-46BA-83D7-F07871F408D9} - C:\WINDOWS\system32\endapole.dll


I found a O21 file, but not what you showed, so i think this is not the right one. I was searching through the reg with the code of the O21 you gave me, and nothing came up, so i searched for eblaster and something did come up. File name 000 Type Reg_EZ Data Eblaster. Do i delete that or keep it there? Im also going to safe mode norton scan right now too, so i'll tell you if anything comes up. Only problem i have is spyware.eblaster comes up more than once a day on my computer, and i knows it on my computer somewhere.

#10 Harry83

Harry83

  • Members
  • 257 posts
  • OFFLINE
  •  
  • Location:State College PA
  • Local time:05:46 PM

Posted 15 June 2006 - 04:02 PM

Please let me know how the Norton scan goes in safe mode and we'll see if that solves your problem...

I would also like to check out this entry:

O21 - SSODL: Vidurzap - {D8CA8F79-CD2E-46BA-83D7-F07871F408D9} - C:\WINDOWS\system32\endapole.dll

I don't know what that is and I can't find any information about it. You may have a new variant, or it could be something new. Since HJT whitelists the most common 021 entries used by Explorer and Windows this entry is probably malicious or unknown.

Go to Jotti's Malware Scan
Click the browse button and locate this file:
C:\WINDOWS\system32\endapole.dll
Click Open, then click the Submit button.

When it gives you the result, copy and paste it here.

You may have to submit a HJT log, but we will see what happens with this first.

Edited by Harry83, 15 June 2006 - 04:18 PM.

--
Harry83
Posted Image
Liberating America From Spyware - 1 Computer at a time...




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users