eXact Advertising has started using a "Service" in XP to reinstall itself. Ad-Aware and SpyBot do not detect the Service or the file being used. Ad-Aware does detect everything else though. It is recognised by the following HJT entries that resist all attempts at removal:

 


O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll

 

Removal Instructions:

 

Click Start>Run and type Services.msc then hit Ok. Scroll down and find the service called ISEXEng. When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Start-up Type to Disabled. Now hit Apply and then Ok and close any open windows.

Click here to download navifix.zip. Extract navifix.reg from the zip file and save it to the desktop.

Click here to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Do NOT run the program yet. 

Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

   O2 - BHO: (no name) - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll 
   O2 - BHO: (no name) - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll 
   O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll


When done, find and delete the following files if still there: 

   C:\WINDOWS\system32\nvms.dll 
   C:\WINDOWS\system32\mscb.dll 
   C:\WINDOWS\system32\msbe.dll 
   C:\WINDOWS\System32\angelex.exe 


Double-click the navifix.reg, when asked to merge say yes. Next, launch Ad-Aware, click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and check the new log.