Spybot found this

From what I can see, you need to find a bookmark in Firefox that links to spywareinfo.com and delete it yourself. Read this:

http://forums.techguy.org/general-security/797430-solved-spybot-finds-spywareinfo-trafficz.html

I'll check it out more thoroughly tomorrow and see if I have the problem also and what is causing it.

It's not on my system, so I can't replicate the problem. Did you read the solution found in the link I gave you above? You can do a search and look for anything that might have spywareinfo or merijn in the link. You may have to hover over each link in your bookmarks to find it if search doesn't find it for you. The actual name of the link is not necessarily the link itself. You also need to look into all the other accounts on your computer (wife, children, grandchildren).

If you don't find it this way, run spybot in the Administrator account (not the owner account) in safe mode and try to remove it with spybot in that account and see if rerunning spybot will find it again.

You can also expand the information spybot gives you, take a screen shot and post it here. However, try the above steps first, and if all else fails, then do this.

wcturner wrote:

Repa,

1) I updated firefox to new ver. 3.6.2 and hoped that maybe the problem might be eliminated, but, it still exists. I copied the path and was gonna try a search, by going thru Start menu, but, I didn't see any way to search bookmarks. You mentioned expanding spybot information, but, I don't know how?

Click on the + mark beside the error message and that shows you all the information that spybot has available on the event it found.

I was hoping I could search the bookmarks. I don't suppose there's a way to do that?

Start > Search > For files or folders > All files and folders and then search on spywareinfo, and then search on merijn and delete any links you find that originate in C:\Documents and Settings.......

2) Is this avirus, or what?

No, it's a bookmark that if you click on it, it will take you to a site where you will get viruses or malware. The site was taken over by bad people.

If you can't find the bookmarks by what I've said above, go into safe mode and run spybot in the Administrator account (not the Owner (your) account). Have it delete what it finds, and see if that gets rid of your problem.

Repa,
My search of spywareinfo, pulled up nothing, but, merijn, found 2 entries. I deleted both. Then I ran another Spybot scan, and it still has those 2 bookmarks on my system.

Now, I'll have to go into Safe Mode, as you described, and I'll post that when completed.

I'll try my screenshot of spybot results. Can't get it to work in this edit. I'll try another post.

Are you sure the same bookmarks you manually deleted are back? Did you actually go in and check, or are they something you missed?

I read somewhere that spybot doesn't delete the bookmarks for some reason.

In your Firefox browswer, go to Bookmarks > Organize Bookmarks. That will open the the bookmarks Library.

In the upper right hand part of your screen is a "Search" text box where you can start typing words to search. Start typing merijn and watch what appears in the large pane on the right. Bookmarks will appear and some will start disappearing as you continue to type until what you are searching for is the only one or ones you see containing a reference to merijn. You can delete what you find from right there by right clicking and select delete. Do the same with spywareinfo. Do this for each user account on your system.

Once you have found all references to merijn and spywareinfo and have deleted them, empty your recycle bin and run ccleaner. When you run ccleaner, also run the "Issues" option (just below the cleaner icon in the left column) to clean your registry of any entries not deleted that might be referring to these deleted bookmark entries as well. Reboot, and then check by the above procedure to see that the bookmarks are still gone. Then run spybot to see if if finds anything else.

To be sure you get everything, you may need to do the above in safe mode in the Administrator account if the above procedure doesn't get everything in normal mode.

Did you do the search while logged in to each one of the user accounts on your machine, including your wife's account and granddaughter's?

You do exactly the same thing in Safe Mode as in normal mode. The browser will open, but won't connect to the internet unless you go into safe mode with networking, which you don't need to do. Also, try looking for a bookmark that reads downloads.html and if you find such a bookmark, right-click on it and click properties and see if the link address contains that sypwareinfo.com and merijn. If it does, delete it. Also, do the Spybot scan in safe mode after searching manually to see what spybot finds, and delete anything it finds.

wcturner wrote:

Repa,

2) In safe mode, I don't know how to log into each account to do the search in Bookmarks, since there's no Welcome page in safe mode. At least I've never seen one.?

When safe mode comes up, you will be given a choice of accounts to log into. It will be obvious.

3) While in safe mode, should I also try >Start> Search>then type those items into box?

Yes

4) I need to add that one of the scans in spybot, it said that the bookmarks, were in both my accounts, Owner, & my Limited, but, didn't say what the bookmarks were, or how to locate them.

Try to follow the instructions I gave you and see what happens.

Sounds like you got rid of what you needed to get rid of. Without being there and seeing exactly what you did, I don't have an explanation to your question. Sounds like you are ok, so don't worry about it.

Today, in Safe Mode, I did the searches again. Nothing found.

Still in safe mode, I ran a Spybot scan. This time, no threats were found.

Is there any explanation for the Spywareinfo.TrafficZ found the other day in normal mode, and a clean bill of health today?

Haven't got a clue, WC.

wcturner wrote:

So when you run Spybot in normal mode, do you still get the exact same message that you posted above, word for word? Do you have a Fixefox bookmark folder named Downloads.html? Does a search on Downloads.html bring up anything?

Repa wrote:

wcturner wrote:

So when you run Spybot in normal mode, do you still get the exact same message that you posted above, word for word? I'm pretty sure that is the same message that I deleted yesterday. But, I'm assuming it was the same, but, since I'm not looking at it right now, I could not be 100% sure.


Do you have a Fixefox bookmark folder named Downloads.html? Does a search on Downloads.html bring up anything?

I'm not aware of a Firefox bookmark folder. And, a search on Downloads.html hasn't ever found anything.