Toolbar called quprstthoas on IE6

[BD]

Hi Group/s

I have been attacked by something that has installed a tool bar on IE6
called "quprstthoas" It can be disabled but only until logging on to the net
the next time whereupon it appears again.

On previous occasions I have had other toolbars install themselves eg.
hotbar, and they are usually gotten rid of through the "add or remove
programs' on the control panel.

This one has me beat - I can't even find a reference to quprstthoas on the
net - perhaps it gives itself a new name each time it infects IE.

Any help appreciated thanks - I am sick of looking at it - what a nerve some
of these people have.

TIA

Baz

[YoKenny]

Post by BD
Hi Group/s
I have been attacked by something that has installed a tool bar on
IE6 called "quprstthoas" It can be disabled but only until logging on
to the net the next time whereupon it appears again.
On previous occasions I have had other toolbars install themselves eg.
hotbar, and they are usually gotten rid of through the "add or remove
programs' on the control panel.
This one has me beat - I can't even find a reference to quprstthoas
on the net - perhaps it gives itself a new name each time it infects
IE.
Any help appreciated thanks - I am sick of looking at it - what a
nerve some of these people have.

Bloody browser hijacking parasites. They are morphing as fast as the
viruses.

Get Ad-Aware and SpyBot Search and Destroy. Update their reference files
through the on line update functions. Run AdAware first and get rid of
all that it finds. You may have to reboot and re-run to get rid of the
items found.

If it is still there then get HijackThis.
http://www.tomcoyote.org/hjt/

[BD]

No luck with Ad-Aware or SpyBot but HijackThis did the trick.

Thanx

Baz

[Bart Bailey]

Post by BD
No luck with Ad-Aware or SpyBot but HijackThis did the trick.
Thanx
Baz

That's a good utility.
just check all the BHO entries for "fixing"
so easy Figgs could do it ;-)

[YoKenny]

Post by BD
No luck with Ad-Aware or SpyBot but HijackThis did the trick.
Thanx
Baz

Great. You may want to get SpywareBlaster to stop these nasties from
installing. Don't forget update its reference file.
http://www.javacoolsoftware.com/spywareblaster.html

[Tim H.]

Post by BD
Hi Group/s
I have been attacked by something that has installed a tool bar on IE6
called "quprstthoas" It can be disabled but only until logging on to the net
the next time whereupon it appears again.
On previous occasions I have had other toolbars install themselves eg.
hotbar, and they are usually gotten rid of through the "add or remove
programs' on the control panel.

Here's how you do it:

Fire up regedit, then navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar

On the right pane you'll see several entries with hex notation. These
correspond to CLSIDs located in:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID

(also mirrored in:
HKEY_CLASSES_ROOT\CLSID)

It's tedious, but what you wanna do is trace each one to it's respective
entry. We can eliminate one:
{8E718888-423F-11D2-876E-00A0C9082467}

That's the one for "Radio."

Generally, when you click on the entry in CLSID, it'll say what it is in the
left pane. See something evil? Check cout InprocServer32 for it and you'll
find the DLL.

Once you obtain the DLL, track it down (open up the folder). Then, do
Start...Run and type in: regsvr32 /u

Then, you'll wanna drag the DLL from the window into the Run box and click
OK. If it works, it'll say "DllUnregister...succeeded."

Voila!

(Giving fingers a break....)

Hope that helps,

Tim

Post by BD
This one has me beat - I can't even find a reference to quprstthoas on the
net - perhaps it gives itself a new name each time it infects IE.
Any help appreciated thanks - I am sick of looking at it - what a nerve some
of these people have.
TIA
Baz