Deleting Troublesome Adware

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I don't know if this is the right group.  If not, please direct me
somewhere.  I have Windows XP and am running Norton Internet Security
(Antivirus plus additional features, including extended threats).  If
I run a full virus scan, it detects various adware programs and offers
to delete them.  However, they can't be deleted.  I have attempted to
delete them by dragging their icons to the Norton Protected Recycle
Bin, and am told that they can't be deleted.  

A few days ago I had more of these adware programs that didn't want to
be deleted.  I was able to delete some of them by going to the Control
Panel Add/Remove Programs and uninstalling them.  (Bullseye Network is
troublesome because it insists on my answering a long series of
questions about why I want to delete it, and I assume that it is
sending those back to its supplier, which makes me think it is not
only adware but commercial spyware.)  I now have two remaining adware
programs that I am still trying to delete.  I have tried locating
entries for them in the Registry and deleting the Registry entries,
but still can't delete them.  

The names of the two adware threats that won't go away are:
2_0_1browserhelper2.dll and salm.exe.  Does anyone have any advice on
how to get rid of them?

     - -    Bob McClenon

Re: Deleting Troublesome Adware

On Thu, 25 Nov 2004 18:11:24 GMT, Robert McClenon

Quoted text here. Click to load it

Someone sent me an email reply, and advised me to see whether either
of the adware programs was currently active by opening the Windows
Task Manager and seeing whether either of them was a process that
could be terminated.  I followed that advice, and saw that something
called salm.exe was indeed running.  I terminated it, and then was
able to drag it to the Recycle Bin.  Perhaps 2_0_1browserhelper2.dll
is being opened by another process, but it isn't obvious to me what
process that would be.  

For an adware application to load itself automatically on startup
sounds like virus-like behavior.  It might be useful for Symantec to
update their removal instructions to state that it may be necessary to
terminate a process first, or to provide what registry keys need to be
deleted in order to prevent the process from loading itself.

I then did a new scan for viruses, and had four remaining adware
threats.  One is of course 2_0_1browserhelper2.dll.  Another was
salm.exe, but that turns out to be because the scan scans the contents
of the Recycle Bin.  The other two are compressed files within files
in the Internet Explorer cache.  That is, it appears that web pages
that either my daughter or I were viewing contained concealed adware,
and explains how all of the adware got onto my machine.  (My
18-year-old daughter followed links.)  I assume that they will go away
if I empty the cache.

Does anyone have any further advice on deleting

     - -    Bob McClenon

Re: Deleting Troublesome Adware

Robert McClenon wrote:
Quoted text here. Click to load it

First Google hit for "2_0_1browserhelper2.dll"...

-- Lassi

Re: Deleting Troublesome Adware

On Sat, 27 Nov 2004 00:30:54 +0200, Lassi Hippelšinen

Quoted text here. Click to load it

Thank you.  I tried it, but I didn't find any of the registry entries.

     - -   Bob McClenon

Re: Deleting Troublesome Adware

On Sat, 27 Nov 2004 18:18:05 GMT, Robert McClenon <*email_address_deleted*>

Quoted text here. Click to load it


For spyware, running the Windows Uninstaller, and manually deleting registry
entries, is a waste of time.  HijackThis, and expert advice, is essential.

Start by downloading each of the following free tools:
AdAware <
CWShredder <
HijackThis <
LSP-Fix <
WinsockXPFix <
Spybot S&D <
Stinger <
TrendMicro Engine <
TrendMicro Signatures <
TrendMicro Instructions <

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there.  Create a separate folder for the two TrendMicro files,
such as C:\TrendMicro - copy the downloaded files there (unzipped if necessary).
AdAware, CWShredder, and Spybot S&D have install routines - run them.  The other
downloaded programs can be copied into, and run from, any convenient folder.

First, run Stinger.  Have it remove any problems found.

Next, close all Internet Explorer and Outlook windows, and run CWShredder.  Have
it fix all problems found.

Next, disable System Restore.
Boot your computer into Safe Mode.
Run C:\TrendMicro\  Delete any infectors found.  Reboot your
computer, and re enable System Restore.

Next, run AdAware.  First update it ("Check for updates now"), configure for
full scan (< ), then
scan.  When scanning finishes, remove all Critical Objects found.

Next, run Spybot S&D.  First update it ("Search for updates"), then run a scan
("Check for problems").  Trust Spybot, and delete everything ("Fix Problems")
that is displayed in Red.

Then, run HijackThis ("Scan").  Do NOT make any changes immediately.  Save the
HJT Log.

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <
Net-Integration: <
Spyware Info: <
Spyware Warrior: <
Tom Coyote: <

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Paranoia comes from experience - and is not necessarily a bad thing.

Re: Deleting Troublesome Adware

Quoted text here. Click to load it
Quoted text here. Click to load it

I will refer back to your post any time that I have a problem with
spyware again.  I did remove the spyware this time.  What I did was to
restart Windows, then open the Task Manager and cancel all of the
processes that I didn't recognize, and then drag the spyware/adware to
the Recycle Bin, and then empty the Recycle Bin, and then restart
Windows.  That seems to have worked.

Thank you for your advice.

     - -   Bob McClenon

Re: Deleting Troublesome Adware

On Sun, 28 Nov 2004 15:32:29 GMT, Robert McClenon

Quoted text here. Click to load it

<various snips>

Another program which works for me is TDS3 from

You may also want to look out a firewall which does integrity checking
and warns you about things trying to infiltrate your PC.   Tiny
Personal Firewall is good value, it works fine with XP on my PC.
Please remove "nospam" from mailto address
when replying

Site Timeline