Printable View
When I go to www.yahoo.com or www.google.com it comes up with a white screen that says TEST!TEST!TEST!
I ran my virus scanner with no hits. What's up? Also if I type in the word chevelle in the address space where www..... would go I get the page cannot be found. I'm really suppose to get hits on all sites with the word chevelle in it. Help!!
Mark
Sounds like you been invaded.
Download, immediately update, then run first Ad-aware and delete all items it finds, and next Spybot Search and Destroy. With spybot, delete all the items it shows in red. The others are optional.
After you've done both of those, download HijackThis and follow the instructions to run it and generate a log file. DO NOT change anything. Post a copy of the log file so the security gurus can look for remaining bad stuff.
I'm feeling lazy so no links but a google search for ad-aware download, spybot download, hijackthis download will give you links to get each of the apps.
Ad-aware and Spybot will be useless until you update so gotta do that before you run them.
Spyware/malware isn't virus so AV apps just ignore them.
windows update first? I have. But
There is a problem with this Microsoft patch. Cumulative Security Update for Internet Explorer 6 SP1 (KB824145). I had to do a restore to the day before my download date. After the load when I do a right mouse click on Start and select Explorer, a left click on My Documents, My Network Places or My Computer it doesn’t take me there but just turns green from blue. Once I do a restore back before the patch it’s ok. Anyone else have this problem? I have Win me running.
Same with
Cumulative Security Update for Internet Explorer 6 Service Pack 1 (KB832894)
@copo
Newt didn't say windows update what he said is updating the Adaware and spy bot programs. The reason he said this is because when you download these programs the 'virus definition files' (rather the trojan definition files) they have is an older version and hence useless so you need to update those programs first from inside the programs before running it. Try this before updating windows and let us know what happened.
Is it safe to delete registry stuff that Adaware finds?
It is usually safe to delete all the stuff found by adaware. No one reported any problem what so ever. So I will suggest you delete everything found by adaware.
Let us know how it go
Thx, I'll tackle it after work. When I left work I had this running http://www.pandasoftware.com/home/
Last night I ran Etrust InoculateIT virus software and will run it again with an option change, all it found was C:\WINDOWS\ALL\USERS\...VIDEO.ASX was detected in CR718863-A Machine unknown File Status ||A
Can't make out what was after File Status, the funny symbols.
Hi Copo
Newt has given you good advice.
Spybot Search&destroy can be found here:
http://www.safer-networking.org/inde...&page=download
and Adaware here:
http://lavasoft.element5.com/software/adaware/
Download the programs and check for updates before using them.
Thx, much appreciated.
Can I have Adaware and Spybot on the PC together when I run each separately? They don't interfere with each other like 2 different Virus detector Programs running on the same PC do they?
I was running Panda checker 1st this am and haven't seen the results yet.
When I get home I'll check for any updates before running spybot and Adaware. Then I'll try my Etrust InoculateIT virus software after changing some scan options. Then I'll run Hijackthis for the PC that's infected ...thx in advance for your help.
BTW Panda never ended after 8 hrs, what a POC.
Merged the threads. Train
Use both programs, but not at the same time. One will find what the other didn't and vice versa.
Let us know how you get on.
Hi COPO
I appreciate your thanks but please don't double post, stick to your original post.
Merged the threads. Train
Fixed guys!!! Thx
I ran adaware first and uploaded new patches and scanned and removed the files and did the same with Spybot. Just running Adaware did not fix my problem, it wasn't until I ran Spybot that all was fixed up to browse the Internet again and do searches.
For my adaware should I have option Scan My Hosts File On or OFF? Is the Host my Internet Provider?
Here are my Spybot report http://www.cardomain.com/memberpage/528630/5
Is the IP address for the search engines here the hijacker 69.93.33.159 ? Cause when I tried to use the search engines yesterday it came back with TEST! repeated 3 times.
Now here is my Hijackthis report if someone can tell me what to remove. My first guess would be the IP address I mentioned above ---> O1 - Hosts: 69.93.33.159 yahoo.com.
Logfile of HijackThis v1.97.7
Scan saved at 7:53:42 PM, on 4/15/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\INOTASK.EXE
C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\INORT9X.EXE
C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\INORPC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOGWAT95.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\REALMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ZAFILES\ZONE LABS\ZONEALARM\ZAPRO.EXE
C:\TEMP\HIJACKTHIS.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.broadband.rogers.com/
O1 - Hosts: 69.93.33.159 yahoo.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {87EAE153-EE10-4E96-B920-93CFE9B64808} - C:\WINDOWS\SYSTEM\QLBLUAA.DLL
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Program Files\FerretSoft\WebFerret\FerretBand.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LogWatch] C:\WINDOWS\LogWat95.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST\ANTIVI~1\REALMON.EXE
O4 - HKLM\..\Run: [system32.dll] C:\WINDOWS\system\systeminit.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MiniLog] C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [InoTask] C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
O4 - HKLM\..\RunServices: [InoRT] C:\Program Files\CA\eTrust\Antivirus\InoRT9x.exe
O4 - HKLM\..\RunServices: [InoRPC] C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\zafiles\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://cs2.chat.yahoo.com/v43/yacscom.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {8842C6C0-E428-11D5-A74F-0008C7DA2EA8} (prjRogersMail.ctlMail) - http://www.rogershelp.com/addemail.cab
O16 - DPF: {6D655755-EB1B-11D5-A74F-0008C7DA2EA8} (prjRemMail.ctlRemMail) - http://www.rogershelp.com/remmail.cab
O16 - DPF: {2CDA4FA9-4A2B-4925-8EB4-61BDDE935A84} (OutlookVerification.vOutlook) - http://www.rogershelp.com/smtp/voutlook.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.82.221.103/30a238b56ba5f9...tzip/RdxIE.cab
O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...862.2939351852
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Te...loads/outc.cab
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/247b0e9b912680f...p/RdxIE601.cab
O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.logitech.com/compan.../bin/imvid.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O19 - User stylesheet: (file missing)
With regard to Spybot Search&Destroy remember to click the immunise button.
Sorry to say but there is more to do. The following entry is a Coolwebsearch infection.
O4 - HKLM\..\Run: [system32.dll] C:\WINDOWS\system\systeminit.exe
Check here http://www.sysinfo.org/startuplist.p...e&count=&type=
Download CWShredder from http://209.133.47.200/~merijn/files/CWShredder.exe & run it. Select the fix button & it will get rid of everything related to CoolWebSearch. Close ALL other programs & windows, including IE, before running CWShredder.
Reboot after doing this & post another log please.