Webrebates tried to dig itself a nest in my PC

[Muse]

Happened yesterday, evidently, at 8:05 AM. Don't know where I was surfing, but today my Zonealarm asks me if I want to let Webrebates access the Internet. I say "No," and search my system and find a \Program Files\Web_rebates folder. Ran Adaware 6.0 and Spybot Search and Destroy and they were oblivious to it. Did a Google search and found a utility called Adware Away, that purports to root out Webrebates. Searched Anandtech and found nothing about Adware Away, and Googled it and found a couple of user reviews at Download.com. One guy likes it the other says "hell, no" and says it didn't even work. He says just stop it from running at Startup with msconfig and then delete everything you find on your system.

I disabled it from running with Startup Control Panel instead (gives me less trouble than msconfig), and found I couldn't delete the webrebates stuff because it was running. Stopped all the webrebates processes and still couldn't delete. Rebooted, stopped the processes and then deleted one key in my registry that referenced one of the webrebates EXEs. I then could delete the webrebates tree on my HD, and did. I'm sure that had nothing to do with what I deleted in the registry. Now things look OK.

 

[InlineFive]

Sounds like you might need a reformat. A bit discouraging that those two didn't detect it. Would it be possible to send a copy to the good people at Safer Networking?

 

[Muse]

Originally posted by: PorBleemo
Sounds like you might need a reformat. A bit discouraging that those two didn't detect it. Would it be possible to send a copy to the good people at Safer Networking?

AFAIK, everythings copasetic. No need to reformat, although it's been a while and I'm probably due pretty soon. Let's see - I installed Windows 2000 a bit over 10 months ago. I have nothing to send since I deleted every last vestage of this thing save for a few evidently innocuous registry entries.

 

[saxophonoia]

Did you search for webrebates in the registry or for something else? A user is having that same problem and I'm tired of Norton sending me an email saying it's found and deleted something from her computer.

 

[Muse]

Originally posted by: saxophonoia
Did you search for webrebates in the registry or for something else? A user is having that same problem and I'm tired of Norton sending me an email saying it's found and deleted something from her computer.

Hmm. I searched on a number of things. Probably the best thing to search on is "rebates"

Searching on "web" is useless, and they name one of the directories web_rebates, so "webrebates" isn't the best idea for a search. I'm not sure that deleting that one registry setting helped. Very possibly it didn't matter. However, closing down all the processes and deleting the directory tree, I think, was what got it. You could delete the registry stuff too, I figure. I've had no problems with it since the deletions.

 

[MtnMan]

A perfect example for all the people that say you don't need a software firewall if you have a NAT firewall. I haven't had that one come up, but ZoneAlarm periodically pops up to stop something that appears to have come out of nowhere.

 

[Muse]

Originally posted by: MtnMan
A perfect example for all the people that say you don't need a software firewall if you have a NAT firewall. I haven't had that one come up, but ZoneAlarm periodically pops up to stop something that appears to have come out of nowhere.

Yes, I wouldn't have known were it not for Zonealarm. I've seen a number of posts from people saying they prefer another free firewall, but I've been pretty OK with Zonealarm. The latest version (last time I checked) screwed up my VPN with my client's network, so I reinstalled a previous version. Things are running OK with that. Mostly, I find it very nice software.

 

[Ringthane]

I had the same program appear... I just checked after reading your post. It uninstalled using Add/Remove programs. It left behind a "webrebates1.exe" that was able to be deleted. Didn't find anything in the registry after the uninstall, but I should probably run a cleaner to verify.

There was even a readme.txt in the webrebates folder to explain the process. I will, however, download ZoneAlarm.