4,383 Posted Topics
 | helpme64, Hi! and welcome :). =============== When we're done cleaning off your system, i'd [b]recommend[/b] that you install all the [color=#ff0000][b][i]critical windows updates[/i][/b][/color] available from [b]Microsoft[/b], upto [i]service pack 1[/i]. This will help to make your system more secure and prevent many '[i]problems[/i]' from reoccuring in the future. =============== Go …  |
| | [b]First of all we have to remove Newdotnet,[/b] either from add/remove programs, or by going [url=http://www.newdotnet.com/#remove][u]here[/u][/url] and scrolling down to the uninstall tool. Please go [url=http://computercops.biz/postt106277.html][u]here[/u][/url] for the instructions on how to remove the Bube.d (aka Win32.Beavis) Removal [isrvs] infection. Please follow the removal instructions [b]exactly.[/b] Once done, repost a … |
| | Re: CoolWWW/ Looking at what you have posted, you do [b]not[/b] have the same problem :D. [b]Download [color=blue]HijackThis[/color] selfextracting zip version from [url=http://www.malwareremoval.com/downloads.html][u]here.[/u][/url][/b] Once downloaded, double click on the file & it will install into it's own, permanent folder. Start HJT & press the "Do a system scan and save a log … |
| | sanperry, Hi! and welcome to the Daniweb forums :). =============== Run [b]HiJackThis[/b] and click "[b][i]Scan[/i][/b]", then check(tick) the following, if present: [color=#9933cc][b] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://community.derbiz.com/[/url] [/b][/color] [color=#9933cc][b] R3 - Default URLSearchHook is missing [/b][/color] [color=#9933cc][b] O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitetro32.exe [/b][/color] Now, with all windows closed … |
| | gingerdrupp, Hi! and welcome to the Daniweb forums :). =============== Please go [url=http://virusscan.jotti.org/][u]here[/u][/url] and have this file scanned. C:\WINDOWS\[b]hh.exe[/b] =============== Go to [b]Add/Remove programs[/b] and remove(uninstall) the following, if present: [b][color=#ff0000]MyWebSearch[/color][/b] The above could appear anywhere within the entry. Be careful not to remove any [i]personal[/i] or [i]system[/i] software. =============== … |
| | Replied here; [url]http://www.daniweb.com/techtalkforums/thread19674.html[/url] Closing thread. |
| | The good thing about Opera's mail client is that virus' that arrive by email cannot execute. Is probably the same for other, non MS based browsers.  |
| | Try right clicking on the Tab for Nod on the bottom Taskbar and select maximise. |
| | This was written by Mosaic 1, a security expert on another forum. Follow instuctions exactly. At the moment there is no easy way. Get the latest CWShredder from this page. Do not run it yet: [url=http://www.computercops.biz/downloads-cat-14.html]CWShredder[/url] Download TheKillbox from this link: [url=http://download.broadbandmedic.com/VbStuff/KillBox.zip][u]here.[/u][/url] ------------------ Sign off the internet. Run CWShredder and …  |
| | [color=blue]Scan with hijackthis and tick the boxes next to all the following entries, then [b][color=red]close all browser and explorer windows,[/color][/b] and hit the "Fix checked" button.[/color] O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: …  |
| | Cloud unltd, Hi! and welcome to the Daniweb forums :). =============== Go to [url=http://www.trendmicro.com/en/home/us/enterprise.htm]www.trendmicro.com[/url], and then: 1. Click "[b][i]Free Online Scan[/i][/b]". 2. Click "[b][i]Scan now, it's free[/i][/b]". It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down: 1. Select all available drives. … |
| | megredy, Hi! and welcome to the Daniweb forums :). =============== Before we begin, let's move [b]HiJackThis[/b] to it's own folder; like [b]c:\HJT[/b]. When we're done '[i]cleaning[/i]' off your system, we're going to '[i]flush[/i]' the temporary folders which, with [b]HiJackThis[/b] [color=#ff0000][i]in it's current location, we'll lose both the program and the … |
| | rmz6471, Hi! and welcome to the Daniweb forums :). =============== When we're done cleaning off your system, i'd [b]recommend[/b] that you install all the [color=#ff0000][b][i]critical windows updates[/i][/b][/color] available from [b]Microsoft[/b], up to [i]service pack 1[/i]. This will help to make your system more secure and prevent many '[i]problems[/i]' from reoccuring … |
| | Either that, or on the top above where the tabs should be. |
| | Re: Changing ISP [color=red]!WARNING! BEFORE ATTEMPTING THIS REGISTRY EDIT, BACK UP YOUR REGISTRY!!![/color] 1. Open up Regedit (Start>Run>Regedit). 2. Navigate to this string: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main 3. Create a new string value (Right-click "Main" key folder, select New>String Value). 4. Rename the value "Window Title" without the quotes (Right-click value, choose Rename). 5. Right-click … |
| | mdnirish, Hi! and welcome to the Daniweb forums :). =============== Go to [url=http://www.trendmicro.com/en/home/us/enterprise.htm]www.trendmicro.com[/url], and then: 1. Click "[b][i]Free Online Scan[/i][/b]". 2. Click "[b][i]Scan now, it's free[/i][/b]". It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down: 1. Select all available drives. 2. … |
| | As dlh6213 stated, Please go [url=http://windowsupdate.microsoft.com/][u]here[/u][/url] & install ALL critical updates required for your system, including service pack 1a for both XP and IE6. Most malware is designed to attack unpatched XP systems - exploiting the available 'holes' - and can bypass third-party protection on an unpatched system. The most … |
 | [b]First of all we have to remove Newdotnet,[/b] either from add/remove programs, or by going [url=http://www.newdotnet.com/#remove][u]here[/u][/url] and scrolling down to the uninstall tool. [color=blue]Scan with hijackthis and tick the boxes next to all the following entries, then [b][color=red]close all browser and explorer windows[/color][/b] and hit the "Fix checked" button.[/color] R1 … |
 | Just a couple more things for you to do... =============== Now, let's open a [b]command prompt[/b] by going to the start menu and then select 'Run'. In the box that pops up type in 'cmd'. The command prompt will open. OR You can go to Start -> Programs -> Accessories … |
| | [b]Go [url=http://housecall.trendmicro.com/][u]here[/u][/url] to TrendMicro for an on-line scan & set it to autoclean for you. When it completes, post back the full filename of any files that cannot be cleaned or deleted. Try [URL=http://www.pandasoftware.com/activescan/com/activescan_principal.htm][u]this[/u][/URL] scan at Panda as well.[/b] [b]The scan here does not require an active X install, but … |
| | Hi. You are running hijackthis from a temporary folder, can you please download the self-extracting zip version from [url=http://www.malwareremoval.com/downloads.html]here.[/url] Uninstall the other version first, then manually delete the file. Or, just right click on your desktop and select New>Folder and name it hijackthis. Go to the C:\DOCUME~1\Nadia\LOCALS~1\Temp\[b]Temporary Directory 2 for … |
| | Re: LanFiltrator Here is a start for you [url]http://www.google.com.au/search?hl=en&q=LanFiltrator&btnG=Google+Search&meta=[/url] |
| | Hi and welcome. =============== Please go [url=http://virusscan.jotti.org/][u]here[/u][/url] and have this file scanned. C:\WINDOWS\[b]regedit.exe[/b] If it comes back bad, run hijackthis and; 1. Click "[b][i]Config...[/i][/b]" 2. Click "[b][i]Misc Tools[/i][/b]" 3. Click "[b][i]Open Process manager[/i][/b]" End process on it then delete it. This one too; C:\WINDOWS\system32\[b]AvidSDMService.exe[/b] =============== We need to see if … |
| | Have replied here; [url]http://www.daniweb.com/techtalkforums/showthread.php?t=22121[/url] Please keep to that thread :). (Unless this thread is regarding a second computer ;) |
| | Dave, Hi! and welcome to the Daniweb forums :). =============== Run [b]HiJackThis[/b] and click "[b][i]Scan[/i][/b]", then check(tick) the following, if present: [color=#9933cc][b] R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank [/b][/color] [color=#9933cc][b] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = [/b][/color] [color=#9933cc][b] R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = [/b][/color] [color=#9933cc][b] O3 - Toolbar: (no … |
| | You have a new strain of qoologic. Download rkfiles.zip [url]http://skads.org/special/rkfiles.zip[/url] Unzip the contents to a permanent folder. Reboot in Safe mode. Doubleclick rkfiles.bat It will scan for a while, so please be patient. Wait till the DOS window closes and reboot back to normal mode. Post the contents of C:\log.txt … |
| | Download the [url=http://www.bleepingcomputer.com/files/spyware/KillBox.zip][color=blue]Pocket KillBox[/color][/url] Unzip the file to your desktop. [color=red]Go offline until you have completed all the below.[/color] Run Pocket Killbox and paste the full file path of each of the below files in the box and click on Standard File Kill and End Explorer Shell While Killing File. … |
| | Hi. You are running hijackthis from a temporary folder, can you please download the self-extracting zip version from [url=http://www.malwareremoval.com/downloads.html]here.[/url] Uninstall the other version first, then manually delete the file. [color=blue]Scan with hijackthis and tick the boxes next to all the following entries, then [b][color=red]close all browser and explorer windows,[/color][/b] and … |
| | Re: Hi Right click on your desktop and go to properties. Select the web tab and place a check in any entries below the [b]My Current Home Page[/b] and delete them. [b]Download [color=blue]HijackThis[/color] [b]selfextracting[/b] zip version from [url=http://www.malwareremoval.com/downloads.html][u]here.[/u][/url][/b] Once downloaded, double click on the file & it will install into it's own, … |
| | Please go [url=http://virusscan.jotti.org/][u]here[/u][/url] and have the three letter exe files scanned. Example; C:\WINNT\Vud.exe C:\WINNT\Kta.exe C:\WINNT\system32\Kio.exe C:\WINNT\system32\Voj.exe C:\WINNT\system32\Mlo.exe C:\WINNT\system32\Jmf.exe I have not seen this before so hopefully the scan will tell us something. |
| | Hi Evan and welcome to Daniweb. =============== Run [b]HiJackThis[/b] and click "[b][i]Scan[/i][/b]", then check(tick) the following, if present: [color=#9933cc][b] O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file) [/b][/color] [color=#9933cc][b] O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE [/b][/color] [color=#9933cc][b] O4 - HKCU\..\Run: [\IEService.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe [/b][/color] [color=#9933cc][b] O4 - HKCU\..\Run: [\Pribi.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pribi\Pribi.exe … |
| | [URL=http://secunia.com/mozilla_products_arbitrary_memory_exposure_test/]Test your Firefox (or other browser) here.[/URL] Keystrokes made whilst using FF can apparently be seen because of this exploit. Change those passwords I would be doing if I used Internet banking with FF.  |
| | Re: Virus Problem [b]Download [color=blue]HijackThis[/color] [b]selfextracting[/b] zip version from [url=http://www.malwareremoval.com/downloads.html][u]here.[/u][/url][/b] Once downloaded, double click on the file & it will install into it's own, permanent folder. Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you … |
| | Here you go.......... =============== Go to [b]Add/Remove programs[/b] and remove(uninstall) the following, if present: [b][color=#ff0000]MyWebSearch[/color][/b] The above could appear anywhere within the entry. Be careful not to remove any [i]personal[/i] or [i]system[/i] software. =============== Now, let's open a [b]command prompt[/b] by going to the start menu and then select 'Run'. … |
| | [url]http://www.daniweb.com/techtalkforums/showthread.php?t=16131[/url] XP is still waiting for SP1 :). I have to log out very shortly, but do the following and I am sure one of our other helpers will chip in. 1. [b]Download and install [URL=http://www.lavasoftusa.com/software/adaware/][color=blue] Ad-Aware SE,[/color][/URL][/b] keeping the default options. [b]However, some of the settings will need to … |
| | Hi SarahH. =============== Download, then unzip to "[b]C:\HJT[/b]", the newest version of [url=http://www.spywareinfo.com/~merijn/files/hijackthis.zip]HiJackThis[/url]; [i]version 1.99.1[/i]. Then repost your log, either now, or after following the steps in the solution ([i]if provided in this post[/i]). [color=#ff0000][i]This version has features that might be more helpful in 'cleaning' up your system[/i][/color]. =============== Run … |
 | Yes, there is :). On the right hand side of the page there is a link called 'Download stand-alone version of CWShredder.' Click on that :D. I have merged your [b]three[/b] threads together and have already deleted one other. Please do not create any others for this problem. |
| | [b]Download [color=blue]HijackThis[/color] [b]selfextracting[/b] zip version from [url=http://www.malwareremoval.com/downloads.html][u]here.[/u][/url][/b] Once downloaded, double click on the file & it will install into it's own, permanent folder. Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you … |
| | anthndp, Hi! and welcome to the Daniweb forums. =============== Go to [url=http://www.trendmicro.com/en/home/us/enterprise.htm]www.trendmicro.com[/url], and then: 1. Click "[b][i]Free Online Scan[/i][/b]". 2. Click "[b][i]Scan now, it's free[/i][/b]". It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down: 1. Select all available drives. 2. Check(tick) … |
| | JC7, I agree :). |
| | Download [color=blue][b]CWShredder 2.14[/b][/color] from [url=http://www.intermute.com/products/cwshredder.html][u]here.[/u][/url] Download[/url] [url=http://www.derbilk.de/SpSeHjfix109.zip]'SpSeHjfix'[/url] to the desktop and then right click a blank part of the desktop and select new folder, call it spfix unzip the file into that folder. [color=red]Disconnect from the net and Close ALL OPEN PROGRAMS.[/color] Run 'SpSeHjfix'. and click on "Start Disinfection". When … |
| | You have a few things there that you do not want on your PC, but you are running hijackthis from a Temp folder. Right click on your desktop to create a new folder and name it hijackthis, then move the hijackthis.exe from C:\DOCUME~1\lobo\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\ to the new … |
| | BossWolf, Hi! and welcome to the Daniweb forums. =============== Download the [url=http://www.bleepingcomputer.com/files/spyware/KillBox.zip][color=blue]Pocket KillBox[/color][/url] Unzip the file to your desktop. [color=red]Go offline until you have completed all the below.[/color] Run Pocket Killbox and paste the full file path of the below file in the box and click on Standard File Kill … |
| | First of all could you click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', 'Lop.com', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run the [color=blue]Lop Remover[/color] … |
| | Hi. [b]Download [color=blue]HijackThis[/color] from [url=http://www.merijn.org/files/hijackthis_sfx.exe][u]here[/u][/url][/b] & it will install into it's own, permanent folder. If you have anything disabled in MsConfig, please re-enable it/them. Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop giving you … |
| | Re: CWS.hiddendll In addition to caperjack's direction's, can you also do the following; Download [color=blue][b]CWShredder 2.14[/b][/color] from [url=http://www.intermute.com/products/cwshredder.html][u]here.[/u][/url] Download [url=http://www.derbilk.de/SpSeHjfix112.zip]'SpSeHjfix'[/url] to the desktop and then right click a blank part of desktop & select new folder, call it spfix unzip the file into that folder [color=red]Disconnect from the net and Close ALL … |
| | Re: iSearch Spyware You are now running hijackthis directly from your C drive. Also not preferable. Create a folder where hijackthis is and then pop hijackthis.exe into it. It should then look like; C:\Hijackthis\HijackThis.exe |
 | Cup of Squirrel. =============== We'll need to unload [b]Spybot's Teatimer[/b] before we begin. To do this, right-click on the icon in the quick launch toolbar at the bottom of the screen, then select "[b][i]Exit[/i][/b]". =============== Go to [url=http://www.trendmicro.com/en/home/us/enterprise.htm]www.trendmicro.com[/url], and then: 1. Click "[b][i]Free Online Scan[/i][/b]". 2. Click "[b][i]Scan now, it's … |
| | gokou1628, Hi! and welcome to the Daniweb forums. =============== Run [b]HiJackThis[/b] and click "[b][i]Scan[/i][/b]", then check(tick) the following, if present: [color=#9933cc][b] O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm [/b][/color] [color=#9933cc][b] O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm [/b][/color] [color=#9933cc][b] O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} … |
| | mnh00002, Hi! and welcome to the Daniweb forums. =============== Run [b]HiJackThis[/b] and click "[b][i]Scan[/i][/b]", then check(tick) the following, if present: [color=#9933cc][b] N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Michael Harrison\Application Data\Mozilla\Profiles\default\m1oy61yy.slt\prefs.js) [/b][/color] [color=#9933cc][b] O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [url]http://a1540.g.akamai.net/7/1540/52...meInstaller.exe[/url] [/b][/color] [color=#9933cc][b] O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - [url]http://207.188.7.150/094196d0c135da...ip/RdxIE601.cab[/url] … |
The End.