Tried everything to delete spyware file - help!

Question

I have tried to remove the following file: c:\windows\system32\Canada.exe which I believe is spyware.I have used Msconfig to empty the startup folder as well as spyware scanning with Sunbelt. When I reboot this Canada.exe file still comes up in my startup folder! I am receiving pop ups and when logging into my daughter’s account (I have windows XP), I received the blue screen of death.  Please help!

ky331 · Answer

You can try the following:   Simultaneously hit the 3 keys:   Ctrl   Alt   Del Click on TASK LIST Click on PROCESSES carefully check the list to see if  it contains any of  the following:        CANADA.EXE        HOT_CANADA.EXE        GO IN.EXE for each of these, if you find them, click/highlight them, and click on END PROCESS.   Repeat the above, until all three (if found) are gone   then, search your drive for each of these files that you actually found, and delete them: (START / FIND / Files or Folders / Named ... fill in the name.... click on find now... highlight the file, and hit DELETE)   repeat search until all are gone.   reboot your system, and see what, if anything, the results are.   note:   if you want to be extra-cautious, just in case you want to get-back to where you were, rather than deleting the files, you can re-name them to something non-executable, for example, canada.bad   so the file will be available to you, if for some reason, you still wanted/needed it

joe53 · Answer

Hi: There is a dialler by that name- instructions for its manual removal can be found at Pest Patrol which might be of some assistance.

cynna · Answer

I am having the same problems with Canada.exe.  I have an icon that shows up on my desktop each time I boot up my computer that says 'ClickMe' and it's a green icon.  It then starts up a command window asking me if I want to dial out at $2.99 a cost for the call.  I have tried to remove that icon and remove canada.exe that it is associated with.  I have deleted it, I have renamed it, I have taken it out of the startup in msconfig, I have used numerous spyware removal programs that do not detect it at all.  I don't know what to do now, I have tried to search on the internet and I get all the same things....remove it by deleting it, however it comes back each time I restart my computer.  If someone could tell me how to delete this permanently, I would greatly appreciate it.  Thanks.

RoHe · Answer

Download hijackthis (free) from http://www.merijn.org/downloads.html
Run hijackthis and save the log to a .txt file. Then go to Dell's "Special Interest -HiJack This" forum and post the entire log there. The experts may be able to help you kill that canade.exe infection.

Ron

Pint Fro · Answer

I have the same problem. how long does it take for someone to answer a post (usually)?

zbestwun2001 · Answer

Paitence is a virtue

RoHe · Answer

If you're really desperate and haven't received a response to your hijackthis log from forum members, you could try the automated analysis of hijackthis logs at http://www.hijackthis.de/

Just copy and paste the entire log into the box (or browse to the log file you saved on your PC) and click Analyze. The problem with this automated analysis tool is that it marks everything not already listed in its database as an 'unknown' or 'potentially harmful' item. So it might red flag a legitimate item and you need to be sure of what you're doing before removing things from the registry.

And always set a new Restore Point before you do any registry editing.

BTW: Have you tried the procedure given here to remove canada.exe?
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453067358
Make sure when you search for the listed files to delete, you include system and hidden files. If the items don't show up in Task Manager, download and install free Process Explorer from www.sysinternals.com This app frequently reveals things not shown by Task Manager and you can kill them from there before deleting.

If none of that works, try running System File Check. It's possible this pest has renamed itself as a standard XP file so it's 'hidden' from view.

Click start>run
type in: SFC /scannow
(put one space between SFC and /)

SFC will check that every system file is correct and if not will replace it either from a backup copy on your hard drive or from the XP CD. SFC takes a while, so as somebody else said "patience...".

Ron

Message Edited by RoHe on 04-05-2005 08:20 PM

DELL-Chris M · Answer

All, The data provided by http://www.hijackthis.de/ is sometimes incorrect about what is good or bad. Be very careful if you use this.

gaspet · Answer

I tried everything you tried without success on my friend's computer. The next time what I will try is to create a dummy file in the system32 directory call Canada.exe. I will mark the file as hidden and read only. I will also revoke everyone rights to it. This way, when the program will try to recreate itself it should not able to do it. Of course prior to do this I will disconnect from the Internet and end the canada.exe process in task manager and delete the faulty file.

Let me know if it works for you

Message Edited by gaspet on 04-07-2005 08:15 PM

Message Edited by gaspet on 04-08-2005 08:17 AM

msil217 · Answer

I wonder if it's Cool web search related? If it is, you could try CWS shredder.

HERE

But hopefully those at the hijack this forum can help.

If you get rid of your spyware, download, update, and use spyware blaster.

gaspet · Answer

This is what I have found on the bullgard website:     OK, I think I figured it out..... Im running zone alarm pro, ad-aware and norton anti virus 2005 as well as using registry cleaner but your right this pop up just wont go away....   Now I think I figured it out cause it stopped popping up.... go to the website http://www.ads1.searchmiracle.com/ and scroll to the very bottom of the page. There is an uninstall link....click on it and run it. This should fix the problem...   This company also seems to run the pop-up that you are reffering to: ads1.revenue.net I tried going to this site but it will not open....but the searchmiracle.com is the same company and so by uninstalling from their webpage it wll fix it all (at least thats what I think cause it finally stopped popping up....the bloody thing never stopped and it was interferring with the use of my other programs   Hope this helps.:)

Pint Fro · Answer

Good luck with ur problem. Message Edited by Pint Fro on 04-08-2005 06:37 PM

cynna · Answer

OMG IT WORKED!!!!  Thank you, I've been having this problem going on two weeks now and going to that site and using the uninstall worked!!!!  YIPPEEEEEEEEEEEEEEE

cynna · Answer

Well I tried what you suggested:  creating a dummy file in the system 32 directory called Canada.exe, marked it as hidden etc.....well it's an empty file still but clickme still loads up even though I delete it each time.  So somewhere it's picking that up and no spyware or adware removal program can find the source it seems.  Anyone know anything about this and how to get rid of it???   thanks

Virus & Spyware

Tried everything to delete spyware file - help!

Was this post helpful?