Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Help! AdClicker-BA.dll in pokapoka 76...

Oct 21, 2005 1:57PM PDT

How do I get a file (C:WINDOWSetbpokapoka76.exe) which is infected with the AdClicker-BA.dll trojan to delete for good. I have tried everything - with McAfee poping up with a warning about it, it's driving me nuts. It says it can't clean, delete or quarantine it. Anyone able to help?

Lyn
(Windows XP)

Discussion is locked

- Collapse -
Lyn
Oct 21, 2005 5:57PM PDT

Try to run antispyware and antitrojan scanners:
Ewido - http://www.ewido.net
Spybot S&D, Ad-aware SE, Microsoft Antispyware
http://www.lavasoftusa.com/support/download/
http://www.safer-networking.org/en/mirrors/index.html
http://www.microsoft.com/spyware
because not all antivirus program can detect trojan and spyware.

The information on what is done by that trojan is in http://vil.mcafeesecurity.com/vil/content/v_128721.htm
http://www.sophos.com/virusinfo/analyses/trojelitebars.html

Note that it says:
Newer variants add process hiding capability and is more resistant to deletion. A thread may be spawned to continually detect certain anti-spyware installations in the registry. It would also hook onto other running system and user processes to continually monitor the registry to ensure that it would be executed during system startup.

If the antitrojan or antispyware can't help you in getting rid of the said trojan, do this:

Download HijackThis from http://www.spywareinfo.com/~merijn/files/HijackThis.exe

It is important that you run HijackThis.exe in its own folder so the backup files that HijackThis creates will not be accidentally deleted.

Open 'My Computer', then double-click to open C:\ (or the drive letter that your Windows is installed on)
In the menu bar, click File-->New-->Folder.
That will create a folder named New Folder, which you can rename to ''HJT'' or ''HijackThis''. Now you have C:\HJT\ or C:\HijackThis\ folder. Put your HijackThis.exe there, and double click to run it.

Click 'Scan' button. Click 'Save log' button. Save the 'hijackthis.log' in your desktop. Copy and paste the content of 'hijackthis.log' and post the log file in any forums that offers HijackThis analysis.

You can find those forums in http://asap.maddoktor2.com/

Post only in one (1) forum.

- Collapse -
See also this - LQfix
Oct 21, 2005 6:01PM PDT
http://www.dslreports.com/forum/remark,14451579
"LQfix is used for the latest variants of Elitebar including the pokapoka strains.
You can download it here:
users.pandora.be/bluepatchy/miekiemoes/tools/LQfix.exe
You can download it to your desktop
Double-click LQfix.exe and click install.
Leave the default settings. If you change them, the fix will fail.
Make sure 'Launch LQfix' is checked. After clicking finish in the install, the fix will start.
Follow the prompts on the screen. Your system will reboot afterwards.
Your system may take longer than usual to start up this one time; please be patient."
- Collapse -
THANKS!
Oct 22, 2005 9:01AM PDT

It worked! Thanks loads!
Lynn

- Collapse -
(NT) (NT) You're welcome! We're happy to help.
Oct 22, 2005 3:45PM PDT
- Collapse -
I am having the same problem BUT....
Oct 27, 2005 1:13AM PDT

I have this pokapoka thing on my PC at home - the problem is that I can no longer connect to the internet because that pokapoka76.exe program is somehow messed up - after about 20 minutes it gives me the message that pokapoka.exe is exp tech difficulties and needs to shut down then it freezes the computer

I am going to try to run my adaware program again - i was running it yesterday and the PC froze half way through - i then rasn it under safe mode, turned the PC off and restarted and it was still there running as a process -

Everytime I tried to end the pokapoka.exe process it would start right back up again

Does anyone have any other suggestions since I can't get on the internet to DL the suggestions you gave Lyn

- Collapse -
Can you download the
Oct 27, 2005 1:28AM PDT

fix that was posted onto a floppy on a good computer maybe and then install it on the infected one?