geebb.dll problem

[The Munster]

Keep getting a pop-up and having a problem getting shot of it ...

Scotty the Windows Watchdog is on patrol and has detected a new Internet Explorer Add-On has been installed on your system.
Do you approve the addition of this IE Helper ?
Press YES if this Internet Explorer Add-On is allowed.

geebb.dll
C:/WINDOWS/system32/geebb.dll

Tried Spybot, Scotty and System Restore to remove it and it still returns and pops up with annoying regularity.
Anybody know how I can rid this out of my system ?

[Stealth Hunter]

Ye be infected with the same **** I had last month! Huge .DLL assault on January 17th or the 18th (can't remember) that sent out toolbar additions to systems and spammed desktop pop-ups with a ton of crap about "SPYWARE DETECTED!" or "VIRUS DETECTED!" to try and get the infected user to buy various products. There's got to be some way that it's illegal to do that.

Either way, just search for the file, and remove it. Scan your system with something called Prevx CSI. If it finds any bad .DLL files, then remove them manually (or buy their product; I removed mine manually).

Oh, and if GEEBB.DLL has a message appear with "Access Denied", just use a program called Unlocker to remove it (right click, hit unlock, and you're done; just hit the delete key and you're gone). If it says no lock was returned on the file, then use the Unlocker delete button and it will be gone once you start your system again. Problem should be solved.

[sonar732]

Take a look here for ways to find out if your system has been hijacked.

[The Munster]

@ Stealth Hunter .. yeah, I'm now getting a dose of 'iffy' pop-ups asking if I have the symptons they describe and trying to get me to click the yes box [a lot of them are pretty agressive too] and they will 'fix' it.

@ sonar732 .. thanks for the link, a lot of food for thought there and will endeveaour to return the Computer back to normal [whatever that is !]

Also 700 odd 'TMP' [?] files have appeared in 'My Documents' that I can't move or delete = Very Worrying

[sonar732]

I would post your HijackThis report here so that we can see what type of spy/malware programs are taking control. My thought is that you have a browser hijack going on.

[Stealth Hunter]

Originally Posted by sonar732

I would post your HijackThis report here so that we can see what type of spy/malware programs are taking control. My thought is that you have a browser hijack going on.

http://www.google.com/search?sourcei...H:en&q=egodktf

That's the infection I had. Pretty simple to remove, though you must make sure you nail every bad/malicious .dll file.

[The Munster]

Don't seem to have the toolbar but getting nag messages [do I want to allow 'X' IE Helper onto my system], they are all dll files, the most persistent is geebb.dll. Have now tried Spybot and also Clean up my PC registry cleaner but Clean up states it's found 370 bad files and this trial version will only repair 200, 'click here for the full version' etc = usual story .. money money money
The problem seems to be with Internet Explorer [hi-jacked ?] but also cannot access My Documents from time to time.
Using Mozilla with no problems but don't know how safe it is in regards to passwords etc.

@sonar732 .. will send my log file in a PM to you if that is okay ?

[The Munster]

Sorted [fingers crossed] thanks to the link. Tried Vundo, it got rid of geebb and it's nasty pals
Re-installed a couple of things and installed a new antivirus [Avira was a pig to get rid of] as was 'fccbayw.dll' which took Vundo a couple of tries but thanks for the help and information.
Only niggle I have now is Google Desktop Search [which is on my system but never use] stating a new program might have replaced it so does look like a possible hi-jack attempt.

[sonar732]

Originally Posted by The Munster

Don't seem to have the toolbar but getting nag messages [do I want to allow 'X' IE Helper onto my system], they are all dll files, the most persistent is geebb.dll. Have now tried Spybot and also Clean up my PC registry cleaner but Clean up states it's found 370 bad files and this trial version will only repair 200, 'click here for the full version' etc = usual story .. money money money
The problem seems to be with Internet Explorer [hi-jacked ?] but also cannot access My Documents from time to time.
Using Mozilla with no problems but don't know how safe it is in regards to passwords etc.

@sonar732 .. will send my log file in a PM to you if that is okay ?

If you want, go ahead and pm it to me.

I would definately go with using Firefox as it's a good browser regarding security. If I remember right, you should be going into your 'system32' folder to delete the nasty .dll. Wait until you send me your HJT log as you can do worse damage if you delete the wrong item.

EDIT: I reread your post and realized that you fixed it. Sorry...a little early this morning.

Anyhow, make sure that you have all of your programs updated. I found this on the net and agree with it completely.

Please follow these simple steps in order to keep your computer clean and secure:

1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
   
   You can find instructions on how to enable and re-enable system restore here:
   
   Managing Windows Millenium System Restore
   
   or
   
   Windows XP System Restore Guide
   
   Re-enable system restore with the instructions from the tutorial above
2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
   1. From within Internet Explorer click on the Tools menu and then click on Options.
   2. Click once on the Security tab
   3. Click once on the Internet icon so it becomes highlighted.
   4. Click once on the Custom Level button.
      1. Change the Download signed ActiveX controls to Prompt
      2. Change the Download unsigned ActiveX controls to Disable
      3. Change the Initialize and script ActiveX controls not marked as safe to Disable
      4. Change the Installation of desktop items to Prompt
      5. Change the Launching programs and files in an IFRAME to Prompt
      6. Change the Navigate sub-frames across different domains to Prompt
      7. When all these settings have been made, click on the OK button.
      8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
   5. Next press the Apply button and then the OK to exit the Internet Properties page.
3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running. This alone can save you a lot of trouble with malware in the future.
   
   See this link for a listing of some online & their stand-alone antivirus programs:
   
   Virus, Spyware, and Malware Protection and Removal Resources
4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
   
   For a tutorial on Firewalls and a listing of some available ones see the link below:
   
   Understanding and Using Firewalls
6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer always has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & Hijacker protection on your computer alongside your virus protection. You should also scan your computer with this program on a regular basis just as you would an antivirus software.
   
   A tutorial on installing & using this product can be found here:
   
   Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
   
8. Install Ad-Aware – Download and install Ad-Aware. You should also scan your computer with this program on a regular basis just as you would an antivirus software in conjunction with Spybot.
   
   A tutorial on installing & using this product can be found here:
   
   Using Ad-aware to remove Spyware, Malware, & Hijackers from your Computer
9. Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
   
   A tutorial on installing & using this product can be found here:
   
   Using SpywareBlaster to protect your computer from Spyware and Malware
10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.