My younger sister was using search engines and I don’t know what. After that, whenever we started our computer. XXX stuff gets installed on the desktop and the taskbar and the C drive.
When I open the Internet Explorer or sometimes it opens itself, this website would be shown......
[thumb=H]thewebsite11782_6098142.JPG[/thumb]
Once this website is shown, some sort of really quick pluggin message comes up and they lead us to some XXX sites. And things start downloading.
I tried the Internet Options, the security settings. I tried changing my homepage to blank, etc. But that search engine website above is always there when the IE opens up. I tried deleting all those XXX files but they keep coming back after IE opens up itself.
[thumb=H]internetoptions11782_3655882.JPG[/thumb]
I am not an IT pro. I don't know what to do. I have young kids using this PC.
Allah kay naam hai, please meri madad karo. :(
Also, I can’t do any Windows Update at all. {I thought doing some update would help.} They say it doesn’t install and to try again. I keep trying but no use.
Help!!!!!!!!
5Abi
March 3, 2005, 12:41pm
2
Re: Someone PLEASE PLEASE help!!!
lil human, try this first:
go to this page here, download Ad-Aware SE, and install it
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10045910.html?part=dl-ad-aware&subj=dl&tag=top5
before running the scan, close all IE windows.
Re: Someone PLEASE PLEASE help!!!
^ I tried the Adaware. Download it and it found 800+ entries. I tried deleting it but when it’s in process the screen first goes blue with 2 or 3 error message and it goes all black. (It seemed it freezed.)
I tried the whole thing 3 times already (scanned and tried deleting the entries it found) with the same result. When I get to the deleting part the result is the whole screen goes black. Have to restart the PC and come back to the same problem.
zer01
March 5, 2005, 2:41am
4
Re: Someone PLEASE PLEASE help!!!
Download SpyBot - Search n Destroy (http://www.safer-networking.org/en/mirrors/index.html ) and run it after installing. Would remove all unneeded stuff. If it still does’nt work download Hijackthis, (http://www.spychecker.com/program/hijackthis.html ) run it, save the logfile and post it here (or pm me). lets see what we can do for you.
edit: also consider using firefox as your default web browser
Re: Someone PLEASE PLEASE help!!!!!!!!!!!!!!!!!!!
Try running these applciatiosn in Safe mode as well. i.e, when your system is booting, keep pressing f8 keey, you will get a menu of choices, select Safe Mode out of it and run the applciation there as wel.
Re: Someone PLEASE PLEASE help!!!
Try spy bot as ze01 mentioned. It will clean up the stuff. For future keep both Adware and Spybot running on the system. And phuleez, stop using IE. It has been a year now since I have not clicked on IE icon. I even deleted all the shortcuts to it. I have Firefox and Maxthon installed and they both rock :k: No popups, no spyware and no adware at all. System runs with full resources and smoothly. Live cyberlife in peace.
Sinner
March 5, 2005, 7:27am
7
Re: Someone PLEASE PLEASE help!!!!!!!!!!!!!!!!!!!
enjoy the stuff ;) ... Can't suggest anything but try spywarez & addwarez
Re: Someone PLEASE PLEASE help!!!
Ah!!
I downloaded Spybot, scanned and deleted the entries it found (there’s just one left which I couldn’t delete even after numerous attempts of restarting the PC as instructed)
Bottomline, that thingie still pops up and the IE opens itself with Slimshield software :confused:
Maybe I'll try Hijackthis.
I myself always use Firefox to browse. Do I need to go somewhere to make it my default web browser. (Because IE opens up automatically when we switch on the PC)
I don’t like IE but use it because some things don’t open up on Firefox since Firefox prompts me to download the plugins which are required. I don’t wanna download the plugins because it will take up space. I can’t play games or watch animations on Firefox because I didn’t get those plugins.
So I use IE to play games (not me but the kids to be exact) or watch animation. By that I won’t have to download any plugins.
Now I guess I seriously need to think about getting rid of IE.
Trying to run in Safe Mode, um how will I be able to make it run back in Normal mode after I am done?
Maybe I'll get Maxthon as well.
Thanks a lot for you suggestions everyone really appreciate it.
When will this end. :bummer:
5Abi
March 6, 2005, 8:20am
9
Re: Someone PLEASE PLEASE help!!!
Ah!!
I downloaded Spybot, scanned and deleted the entries it found (there’s just one left which I couldn’t delete even after numerous attempts of restarting the PC as instructed)
Bottomline, that thingie still pops up and the IE opens itself with Slimshield software :confused:
now that you managed to remove the entrires using spybot, run Adware and see if it detects anything - then delete it. If that website still shows up in IR then run a hijackthis and put the log here and we will go from there.
Re: Someone PLEASE PLEASE help!!!
Yes, I did run Adware after that. Surprisingly this time it did manage to remove some entries but there were some left that weren’t deleted.
The thing still pops up though BUT I can change the default website now.
I’ll try the hijackthis.
Thanks alot
nomaan
March 7, 2005, 2:25am
11
Re: Someone PLEASE PLEASE help!!!!!!!!!!!!!!!!!!!
try the microsoft spyware program. it has a brownser hijack restore option ..
Re: Someone PLEASE PLEASE help!!!
This thing also springs up…
[thumb=H]spyware11782_8174423.JPG[/thumb]
I ran hijackthis…here’s the logfile. I have been running adaware and spybot but the problem is still there.
Logfile of HijackThis v1.97.7
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.passport.net/uilogin.srf?id=2 @msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXhttp://bar.mywebsearch.com/menusearch.html?p=ZSzeb029XXHK http://www.tinyOnline.com.hk http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://207.188.7.150/022cfcb4c60735fd0700/netzip/RdxIE6.cab http://www.freedomaudio.com/install/win/mv/freedominstaller.cab http://download.yahoo.com/dl/installs/yinst.cab http://dgl.microsoft.com/downloads/outc.cab http://fdl.msn.com/public/chat/msnchat45.cab http://gim.gupistan.com/vg/GSAG.CAB http://gim.gupshup.org/asim1/urdu/GSUrdu.CAB http://www.webcamnow.com/voice/voice.cab http://messenger.zone.msn.com/binary/MessengerStatsClient.cab http://messenger.zone.msn.com/binary/msgrchkr.cab http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/tc/filesharingctrl.cab http://messenger.zone.msn.com/binary/SolitaireShowdown.cab http://messenger.zone.msn.com/binary/MineSweeper.cab http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab http://download.games.yahoo.com/games/clients/y/potc_x.cab http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38029.1072106482 http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://fdl.msn.com/zone/datafiles/heartbeat.cab http://www.miniclip.com/bestfriends/retro64_loader.dll http://anu.popcap.com/games/popcaploader_v6.cab http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab http://iframedollars.biz/tb/loader2.ocx
So is there anything you guys would suggest?
Mal1k
March 13, 2005, 6:27am
13
Re: Someone PLEASE PLEASE help!!!!!!!!!!!!!!!!!!!
Format, format, format...no other solution, u'll just keep going round in circles. Backup ur data, clean fresh install, load firewall & anti virus & then proceed with normal activities
Re: Someone PLEASE PLEASE help!!!
^NOOOOOOOOOO!!!
OK my O.S. is OEM. I guess I have the recovery disk. Do you I just back up everything. Shut down. Start the PC and put the disk in and do as it instructs me to?
zer01
March 13, 2005, 1:33pm
15
Re: Someone PLEASE PLEASE help!!!
hmm, wheres the firewall huh??!! :bailan:
No need to format just remove the enteries below from your registry.
Start your computer in safe mode. (keep pressing F8 while booting and select safe mode)
Run HijackThis, click on scan and tick/check the enteries below and click on fix. (close all other windows before clicking on fix button)
Close HijackThis, rerun it again, click on scan again and see if there is any entery left from the list below, remove it by ticking and clicking on fix.
After removing the enteries start Spybot Search & Destroy, click Check for problems and remove any entry if found.
resart your computer in normal mode. run Hijackthis and post the log file here again.
Good Luck!!
here are the enteries to remove: (do it in safe mode, other wise it wont work properly)
http://login.passport.net/uilogin.srf?id=2 http://bar.mywebsearch.com/menusear…?p=ZSzeb029XXHK http://www.tinyOnline.com.hk to free some system memory you can also remove following from registary. Just check/tick them and click fix in hijack this.
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
I highly recommend you to use a Firewall with a combination of AV software as soon as posible. Alone an AV software wont save your computer. Also download **Advanced System Optimizer **from Sys-Tweak . It will help you to fix your registry and defrag it.
zer01
March 13, 2005, 1:44pm
16
Re: Someone PLEASE PLEASE help!!!!!!!!!!!!!!!!!!!
oh I forgot, After removing the entries, go to your control panel, click on Internet Options (dont call them by starting IE).
*.windupdates.com
now click on Restricted Sites (next to trusted sites) set the level to high and add the above four sites to the zone by clicking on sites button.
Re: Someone PLEASE PLEASE help!!!
Sorry for my late reply. I don’t use the PC these days.
Now I did as you said.
Firstly I’ll begin with the Internet Options. At the Trusted Site section, there are no sites there so I cannot remove any. At the Restricted Site Section, there’s no tool bar where I could set the setting to be high.
Also with regard to adding these sites to the restricted zone…
.windupdates.com
Erro message pops up for all these 4 sites that “The site you specified exists in another zone. Pls remove the site from the other zone before adding it in the current zone.”
Now what’s that suppose to mean?
I’ll be back with the logfile.
Re: Someone PLEASE PLEASE help!!!
Bottomline, the problem still exists after I went to safe mode and removed the entries that you mentioned, ran Spybot again. The dialler still dials and the thing still pops up.
The current logfile shows.
Logfile of HijackThis v1.97.7
Running processes:
F1 - win.ini: run=C:\PROGRA~1\NETVIG~1\NETVIG~1\DRIVER\cfosdw.exe@msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXhttp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://dgl.microsoft.com/downloads/outc.cab http://fdl.msn.com/public/chat/msnchat45.cab http://gim.gupistan.com/vg/GSAG.CAB http://gim.gupshup.org/asim1/urdu/GSUrdu.CAB http://www.webcamnow.com/voice/voice.cab http://messenger.zone.msn.com/binary/MessengerStatsClient.cab http://messenger.zone.msn.com/binary/msgrchkr.cab http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/tc/filesharingctrl.cab http://messenger.zone.msn.com/binary/SolitaireShowdown.cab http://messenger.zone.msn.com/binary/MineSweeper.cab http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab http://download.games.yahoo.com/games/clients/y/potc_x.cab http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38029.1072106482 http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://fdl.msn.com/zone/datafiles/heartbeat.cab http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
nos
March 19, 2005, 12:30pm
19
Re: Someone PLEASE PLEASE help!!!
Dude, I would format my PC if I were u … there is far toooo much crap on the system. Can’t bother to clean it one by one. I say you copy all your necesary documents to an external hard disk (if you have one) or back it up by other means. And yes, I suggest you scan all your documents before you create the backup and don’t bother copying any program installation files … most likely they will be corrupted as well.
good luck bro :k:
5Abi
March 19, 2005, 1:13pm
20
Re: Someone PLEASE PLEASE help!!!!!!!!!!!!!!!!!!!
lil human, about half of those .ex files that I see are either trojans, virus, trojan downloaders, spyware or malware.
What kinda of anti-virus do you use? Do you ever keep it updated? Do you ever scan you computer? See it wouldnt be this bad if you had done all this from time to time.
At this point, the best solution is to format that hard-disk completely. Dont even bother saving anything unless your life depends upon it. Reinstall windows. And please buy a reputable anti-virus software. Its the most importan software you will ever need when using a computer.
What should I do now?
