Ezula Top Text Pain!!

[abbydearfish]

Hi all, does anyone know how to get rid of ezulatoptext?I've tried everything, I downloaded a program ezulatoptext remover;it said ezula was removed.But everytime I open a folder or program it shows up in my internet cleanup program.I can't find it anywhere in my computer, so if anyone can help I'd appreciate it.Thanks abbydearfish

[kylethedarkn]

Download HiJackThis from here .

Make a new folder called HJT in the C: directory(C:\HJT) Extract the zip contents to that folder. Run HJT and select the scan option. After it finishes scanning there should be a save log button. Once clicked it should open up a notepad file with the log. Copy and Paste the contents of the note pad file in your next reply.

[abbydearfish]

Download HiJackThis from here .

Make a new folder called HJT in the C: directory(C:\HJT) Extract the zip contents to that folder. Run HJT and select the scan option. After it finishes scanning there should be a save log button. Once clicked it should open up a notepad file with the log. Copy and Paste the contents of the note pad file in your next reply.

THIS IS WHAT WAS ON HIJACK THIS.
Logfile of HijackThis v1.99.1
Scan saved at 5:38:12 PM, on 6/30/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Common Files\STOPzilla!\szserver.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Aladdin Systems\Internet Cleanup\icserv.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\wwSecure.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\PROGRA~1\iolo\SYSTEM~1\SysMech6.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\SpyZooka24\spyzooka.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\dave1\Desktop\my documents\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dogpile.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dogpile.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: ICHlprObj Class - {1f0c8547-2639-4c91-b8aa-c7eca24c3163} - C:\Program Files\Aladdin Systems\Internet Cleanup\ic3hlpr.dll
O2 - BHO: PopupFilter Class - {1F2E844B-8211-46ff-8262-772F03295CF4} - C:\Program Files\Aladdin Systems\Internet Cleanup\PopFiltr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostart
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [Search and Recover Disk Image Service] "C:\Program Files\iolo\System Mechanic Professional 6\Search and Recover\DiskImageService.exe"
O4 - HKCU\..\Run: [SpyZooka] C:\Program Files\SpyZooka24\SpyZookaLdr.exe
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "dave1"
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: IC 3.0 - {bba9a1cb-c90a-4912-8f01-dfa51a2b4102} - C:\Program Files\Aladdin Systems\Internet Cleanup\ic3hlpr.dll
O20 - Winlogon Notify: STOPzilla - C:\WINNT\SYSTEM32\IS3WLHandler.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: icservice - Aladdin Systems, Inc. - C:\Program Files\Aladdin Systems\Internet Cleanup\icserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINNT\system32\lxcecoms.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Files\rnamfler\naofsvc.exe (file missing)
O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\szserver.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINNT\system32\wwSecure.exe

[kylethedarkn]

There's nothing in your log that indicates that ezula is on your computer, but I did find a couple things. Run HJT and check the following.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
Close all other window and click fix checked.

Also try running ewido security suite. You can download it from here .

• Install ewido security suite


• When installing, under "Additional Options" uncheck..
  • Install background guard
  
  
  • Install scan via context menu
  
  


• Launch ewido, there should be an icon on your desktop, double-click it.


• The program will now open to the main screen.


• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.


• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click Update.
  
  
  • Then click on Start Update.
  
  


• The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display "Update successful"


• Click on Scanner


• Click on Complete System Scan and the scan will begin.


• You will be prompted to clean the first infection.


• Select "Perform action on all infections", then proceed.


• Once the scan has completed, there will be a button located on the bottom of the screen named Save report


• Click Save report.


• Save the report .txt file to your desktop or a location where you can find it easily.

Post the Ewido log with the new HJT log.

[abbydearfish]

I ran hijack this and deleted the two selections you stated.I ran ewido as directed (printed off instructions and followed them) opened up a folder to check,then ran internet cleanup by alladin systems and it showed ezula top text.ewido showed nothing.I really appreciate your tips,I've never seen a virus or spyware as hard to get rid of as ezula.

[kylethedarkn]

Well are you sure Top Text is on your computer. If it is you might see black text highlighted with yellow and underlined. If you don't see these than the internet cleanup thing might just have a problem. also you can check in add/remove program for the following and uninstall them.
TopText, TopText ILookup, HotText, or ContextPro
These may not exist so if they don't don't worry.