MSConfig won't run
I noticed my "Auto Protect" with NAV was not enabled.
Upon trying to enable it, I received and error message.
To make a long process short, I have had to uninstall and
reintall ny Norton IS. I have attempted to I tried
running "msconfig" to select start-up services upon
reinstallation however, I receive the message
"Another Prodgram is using msconfig"
I have no other programs running.
Thanx for any help
Michelle Tag: home page hijacked Tag: 55771
home page hijacked
my home page keeps getting hijacked to
res://lxtow.dll/index.html#96676 its a search page
got no idea why ???? i keep changing ,but it keeps going
back to this, the only pop up's i get are from a company
called only the best , does anyone know now to resolve
this ????? thanks Tag: home page hijacked Tag: 55769
Share Experience Posting
Hello,
I'm not sure if this is the appropriate place to post
this. I received an email stating "Advisory - A user is
attempting to share opinions and experiences about you in
our online community. " It then provides a link and
explains "Anonymous users post Experience Requests at
this website. An Experience Request is simply an
indication of a user's interest in sharing the
experiences that he or she has had with a particular
individual or business. Each Experience Request has one
subject (an individual or business), and the subject is
identified in the Experience Request."The email is from
supportdepartment@sharingexperience.biz.
Does anybody know what this is about?! I'm tempted to
respond to the posting on the web page but I'm afraid
it's a setup of some sort... any ideas would be welcome. Tag: home page hijacked Tag: 55763
Why webmail is less secure than OE?
e.g. Hotmail is less secure than using OE to email? Why? the server is less
secure? Tag: home page hijacked Tag: 55753
digital signature and the web-based hotmail
Why doesn't the web-based hotmail added with the digital signature option?
We can't use digital signature when login to the www.hotmail.com? Is the
webmail more secure than OE? Tag: home page hijacked Tag: 55746
Trojan/virus effects
For the past two days I tried to get rid of several pesky viruses/trojans
that apparently messed up my machine and kept returning on reboot.
I'm running XP and turned off System Restore, then rebooted in Safe Mode,
then ran my AV program, and deleted the "Trojano" worm and a few other
viruses, like the "DyfucDldr" variety.
I think I'm now virus, trojan, worm, and adware-free, but the damage seems
to have been done:
First, I can't open programs from my desktop, like IE or Ad-Aware, or Real
Audio. The system just hangs and the hourglass icon stares at me.
CTL-ALT-DEL doesn't work...it either freezes the computer or I get an error
message saying there is something wrong with the program and asking me to
send a report to Microsoft.
Second, there is no audio on the computer anymore. The files for all of the
Windows sounds are missing -- there is no C:/WINDOWS/MEDIA folder anymore.
Instead, in Control Panel, the icons for each sound show a path that begins
with "%System Root%" and I get a message that the file can't be located.
The same is true of all the other program sounds, for Real Audio, my
anti-virus alerts, etc. (I checked and nothing is muted.)
Finally, I noticed the Startup list after running "msconfig" shows a couple
strange ".exe" files, for example, "Nye42.exe". This box is checked like
all the others, and it says the location is in the C:/Windows folder, but I
did a search for it and there is no such file found on my computer. I
unchecked this from the Startup list, but the two problems noted above still
exist.
I'm afraid whatever got me really got me good and I have no idea how to
recover from this.
Any suggestions would be appreciated. I've done a web search (on my other
computer) and reviewed the bulletin board threads. I think I've done
everything I've read to get rid of the nasties, I just don't know how to
restore the system to an operational mode.
I am thinking of restoring the "System Restore" function and going back a
month or so before I got whacked to do a System Restore at that point.
Hopefully that will restore the sounds and functionality. It may also
restore the viruses, but I may be able to delete them this time before they
do permanent damage.
I'd appreciate anyone's thoughts on what I can do or whether my plan even
makes sense.
Thanks in advance for your help. Tag: home page hijacked Tag: 55745
security concern about using proxy
I use proxy setting to browse webs in my IE. if I login the hotmail account
and send the non-encrypted email,is there the risk that the content of email
be captured by the proxy? Tag: home page hijacked Tag: 55744
Is this OK?
I installed Sygate Personal Firewall. Now it asks me the
following: Win32Kernel core component (KERNEL32DLL) is
trying to broadcast an ICMP Type 10 (Router Solicitation)
packet to (224.0.0.2). Do you want to allow this program
to access the network?
When I look up the properties of this application it says
it is a Microsoft program. My question is do I allow it
access or is it some type of spyware?
I hope someone can help answer this.
Thank you
Cheryl Tag: home page hijacked Tag: 55738
Annoying webpages
Some webpages keep loading up on IE. They ask me to
install programs that are obviously malicious. This is
off a clean install of XP. I was wondering if these
webpages are as a result of spyware or such.
If I get IE just to block the pages, it just crashes.
Anybody got any solutions? Tag: home page hijacked Tag: 55725
undeliverable Hot Mail
Received from Service Manager;;undeliverable mail.with my
e-mail address and an unknown name as sender. Tag: home page hijacked Tag: 55724
question about cable and ad-aware
Hi-simple question. My sister is switching to cable from her dialup-she has
the free version of ad-aware from lavasoft- Are there any changes she needs
to make at this point or does it not matter what type of connection one
uses- Your help is appreciated.
--
Thanks so very much for your help-! ! ! ! Tag: home page hijacked Tag: 55718
Hi Jacking
I need to know how to stop "Home Search" from hi jacking
my home page. It also comes up
as "hysnn.dll/index.html#12802". I've tried Add & Remove
Programs and going into the registry but can't get it out
of my system. Could someome PLEASE help me with this.
Thanks for your time,
rdb8899@hotmail.com Tag: home page hijacked Tag: 55717
UPDATE: Internet Attack Slowing Down
SOURCE:
http://www.informationweek.com/story/showArticle.jhtml?
articleID=22102178
A major Internet attack that installs hacker tools on
users' systems is subsiding, security experts say. But
more copycat attacks are possible in the days ahead.
By George V. Hulme
A widespread attack that targeted major E-commerce sites
and secretly planted hacker tools on the computers of
Internet surfers is subsiding, security experts say.
Security experts estimate that thousands of Web sites were
compromised in the past week. The attack, which may have
begun as early as Sunday, didn't attract much attention
until late Thursday evening when it was identified by
Internet security firms.
Most of the Web sites known to have been infected have
been cleaned, security analysts say. Also, Internet
service providers have blocked access to, or "black-
holed," the Russian server that was planting the hacker
tools on user PCs.
Alfred Huger, senior director of engineering for Internet
security firm Symantec Corp., says Web sites running
Microsoft's Internet Information Services software version
5.0 were attacked and infected with a malicious JavaScript
application. When Web surfers visited affected sites,
their computers were subsequently infected through
multiple vulnerabilities in Internet Explorer.
Once a Web surfer's system was attacked by the malicious
JavaScript application, the surfer's computer was
connected to a server located in Russia and infected with
hacker tools such as backdoors and keystroke loggers,
which could be used to take control of the user's system
or steal confidential information.
While patches are available for most of the Internet
Explorer vulnerabilities used in the attack, no patch is
available for one of the flaws, commonly known as the
ADODB vulnerability.
It's still unclear how the attackers managed to
successfully compromise Web servers running Microsoft's
IIS software, security experts say. "It's something we're
looking into," Huger says.
It's possible, but unlikely, that systems running
Microsoft IIS 5.0 software could have been attacked by
a "zero-day" vulnerability, which is a new software flaw
that's unknown and unpatched by software vendors, says
Marcus Sachs, director, of The SANS Institute's Internet
Storm Center. "That's the worst-case scenario," he says.
Other possibilities include Web servers that
administrators believed to have been patched but were not,
or Web servers that could have been attacked through
vulnerabilities unrelated to IIS 5.0.
Security experts warn that future attacks are
possible. "Others may attempt copycat attacks, especially
if there is a zero-day attack in IIS," Sachs says.
Major antivirus companies have updated their software to
spot the malicious code downloaded to end-user systems in
this attack.
Microsoft is urging Web-site operators running Windows
2000 Server and IIS to apply a patch found in Microsoft
Security Bulletin MS04-011.
Microsoft has published a Web site with more information
about this attack and the IIS and Internet Explorer
vulnerabilities; it's located at
www.microsoft.com/security/incident/download_ject.mspx. Tag: home page hijacked Tag: 55714
Internet virus may target financial data
Last Updated Fri, 25 Jun 2004 15:41:58
NEW YORK - Security experts are tracking a mysterious new
internet virus that may help hackers steal personal data,
including credit card information.
The user's computer is infected with malicious code placed
on normally trustworthy websites that use Microsoft's
Internet Information Server (IIS).
The infection is not substantially interfering with
internet traffic, but there are concerns of it spreading
because work is still under way to isolate the problem and
find defences against it.
Some experts suggest hackers are actually loading
computers with software that allows pop-up ads and use the
infected machine to spread unsolicited e-mail.
The virus is being spread by hundreds, and possibly
thousands, of infected websites. The "malware" code
redirects browsers to Russian-based web servers.
The infection appears to take advantage of three separate
flaws in Microsoft products. Microsoft says it patched two
of those flaws in April, but the company has not had time
to fix the third problem.
Experts recommend users update the antivirus software on
their computers to immunize them against infected sites.
Windows users should also turn up security settings on
Microsoft's Internet Explorer browsers to the highest
levels.
SOURCE:
http://www.cbc.ca/stories/2004/06/25/world/internet_virus04
0625 Tag: home page hijacked Tag: 55713
PC Users Warned of Infected Web Sites
By Brian Krebs
washingtonpost.com Staff Writer
Friday, June 25, 2004; 3:30 PM
Computer security experts and the federal government are
warning Internet users to take extra precautions when
browsing the Web after an Internet attack seeded Web sites
with programs that hackers can use to steal personal
information.
The attack is more dangerous than most, according to the
government's US-CERT cybersecurity center, because it
affects even computers that are running updated antivirus
and firewall software. Infection is possible just by
visiting affected Web sites, according to US-CERT, a
division of the U.S. Department of Homeland Security.
The attackers, whose identities are unknown, targeted a
flaw in Web sites powered by Microsoft's Internet
Information Server (IIS). The sites hit by the attack were
programmed to redirect the Explorer browser to another Web
site that contains code that hackers use to record what
people type on their keyboards -- including data such as
passwords, credit card and Social Security numbers. The
code then e-mails that information back to the attackers.
Computers that run Microsoft's Internet Explorer browsers
are vulnerable to infection, according to US-CERT. The
CERT alert said Internet Explorer users can protect
themselves by turning off the "javascript" function in
their browsers. Javascript is a computer language often
used in building Web sites. The attack takes advantage of
two recently discovered security flaws in Internet
Explorer. Microsoft released a patch in April to fix one
of the security holes; the company is still working on a
patch for the other flaw, which security researchers
publicly detailed less than two weeks ago.
CERT recommends that Internet Explorer users consider
different browsers such as Mozilla Firefox, Netscape
Communicator or Opera. For people who continue to use
Internet Explorer, CERT and Microsoft recommend setting
the browser's security setting to "high."
Among the several Web sites hit were kbb.com, the Internet
address of the Kelley Blue Book automobile pricing guide,
and MinervaHealth, a health care financing company based
in Jackson, Wyo.
Robyn Eckard, a spokeswoman for the Irvine, Calif.-based
Kelley Blue Book, said the company learned about the
problem late Wednesday after Web site visitors said their
antivirus software tipped them off to the code. Eckard
said Kelley Blue Book removed the malicious code from its
site by late Thursday afternoon.
Jennifer Scharff, vice president of marketing for the
company MinervaHealth, said some of the company's clients
reported the problem on Thursday. The company has since
fixed its site, she said. Scharff said no more than 50
visitors browsed the Web site during the time it was
serving up the hostile code.
In addition, at least one auction page on the eBay online
auction site contained a photograph that links to an
infected Web site, said Johannes Ullrich, chief technology
officer for the Bethesda, Md.-based SANS Institute's
Internet Storm Center.
Ken Dunham, malicious code manager for Reston, Va.-based
security company iDefense, said the attack bears the
trademark signatures of the Hangup Group, a Russian hacker
organization thought to be responsible for unleashing the
recent "Korgo" worms. Korgo worms allow hackers to read
what people are typing on their computers and scours
infected PCs for other financial information.
According to SANS, most large Internet service providers
stopped forwarding Internet traffic to the Russian Web
site that hosts the "keylogging" software.
FBI spokesman Joe Parris declined to say whether the
agency is investigating this particular attack. But Parris
said hackers commonly use similar Trojan horse
techniques. "We work closely with Microsoft in
investigating matters of this type and always follow up on
any information provided by industry," he said.
Dunham and other security experts said they expect this
kind of attack to become more widespread in coming weeks
and months.
"These guys have the tools, techniques and motivation to
launch highly sophisticated attacks that are very
difficult for consumers to protect themselves against," he
said. "Whoever is responsible has just seen how well this
attack works, and other (hacker groups) are almost surely
going to take notice."
Stephen Toulouse, a security program manager at Microsoft,
said the company does not believe the attack is
widespread. "Nonetheless, we view this is a very real
threat, with serious significance in terms of the
potential impact on our customers," he said.
Toulouse said the company is gathering information on the
attack and will hand it over to the FBI.
Security experts said it is not yet clear which Microsoft
vulnerability the attackers used to commandeer the Web
sites. Ullrich said the culprit is a flaw in the way IIS
processes secure login pages for Web sites that require
users to enter a username and password. Microsoft released
a patch for that flaw in April in a massive bundle of
security fixes.
Toulouse said that the proprietors for the majority of
sites affected by the attack failed to install the
patches.
SOURCE: http://www.washingtonpost.com/wp-
dyn/articles/A5524-2004Jun25.html Tag: home page hijacked Tag: 55712
THANX 4 NOTHIN MICROISSOFT
Web Virus May Be Stealing Financial Data
Jun 25, 1:52 PM (ET)
By ANICK JESDANUN
NEW YORK (AP) - A mysterious Internet virus being spread
Friday by hundreds and possibly thousands of infected Web
sites may be aimed at stealing credit card and other
valuable information, security experts warned.
The infection appears to take advantage of three separate
flaws with Microsoft Corp. (MSFT) products. Microsoft said
software updates to fix two of them had been released in
April, BUT THE THIRD FLAW WAS NEWLY DISCOVERED AND HAD NO
PATCH TO FIX IT YET.
Experts said the infection, detected by Microsoft on
Thursday, was unusually broad but wasn't substantially
interfering with Internet traffic.
Security experts at Microsoft and elsewhere worked Friday
to pin down how the infection spreads across Web sites. It
appears to target at least one recent version of Microsoft
software for operating Web sites - called Internet
Information Server.
The infection makes subtle changes to the Web site so
visitors get a piece of code that's designed to retrieve
from a Russian Web site software that records a person's
keystrokes and can send data back, experts say. Such
software "Trojan horses" are routinely used to fish for
credit card numbers, bank accounts, passwords and the like.
Now that the code is out, other hackers are likely to
adapt it to distribute software for spamming and for
launching broad Internet attacks against popular Web
sites, said Alfred Huger, senior director of engineering
at security company Symantec Corp. (SYMC)
"Users should be aware that any Web site, even those that
may be trusted by the user, may be affected by this
activity and thus contain potentially malicious code," the
U.S. Computer Emergency Readiness Team warned in an
Internet alert.
Stephen Toulouse, a security program manager at Microsoft,
recommended that computer owners obtain the latest
security updates for Microsoft products and their anti-
virus and firewall programs.
Because one flaw has yet to be fixed, he said, users
should also turn up security settings on Microsoft's
Internet Explorer browsers to the highest levels.
Security experts noted that users can avoid the exploit by
using alternative browsers such as Mozilla and Opera.
Users could also turn off the "Javascript" feature on
their Microsoft browsers, though doing so cripple
functions on some sites.
The infection does not affect Macintosh versions of
Internet Explorer. Tag: home page hijacked Tag: 55706
Contract work in delhi
This is a multi-part message in MIME format.
------=_NextPart_000_007E_01C45B0C.3E5C2D60
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,=20
We have contract project/work in delhi and we are looking for "Subject =
Matter Experts" in the following areas.=20
-------------------------------
Knowledge of the following fields:=20
- TCP/IP stack, especially Layer 2 and 3=20
- VPN, IPSEC=20
- Routing theory=20
- Routing protocols - OSPF, RIP, IGRP=20
- Unix networking utilities - netstat, ifconfig, arp, tcpdump, etc.=20
- RADIUS,LDAP=20
- Checkpoint=20
- HIgh availability technologies like- VRRP,- IP clustering=20
--------------------------------
Please email your profile and contact the below email for more =
information.
Regards=20
pvsp@ulmail.net
------=_NextPart_000_007E_01C45B0C.3E5C2D60
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV>
<P><FONT face=3DArial size=3D2>Hi, </FONT></P>
<P><FONT face=3DArial size=3D2>We have contract project/work in delhi =
and we are=20
looking for "Subject Matter Experts" in the following areas. </FONT></P>
<P><FONT face=3DArial =
size=3D2>-------------------------------<BR>Knowledge of the=20
following fields: <BR>- TCP/IP stack, especially Layer 2 and 3 <BR>- =
VPN, IPSEC=20
<BR>- Routing theory <BR>- Routing protocols - OSPF, RIP, IGRP <BR>- =
Unix=20
networking utilities - netstat, ifconfig, arp, tcpdump, etc. <BR>- =
RADIUS,LDAP=20
<BR>- Checkpoint <BR>- HIgh availability technologies like- VRRP,- IP =
clustering=20
</FONT></P>
<P><FONT face=3DArial =
size=3D2>--------------------------------</FONT></P>
<P><FONT face=3DArial size=3D2>Please email your profile and contact the =
below email=20
for more information.</FONT></P>
<P><FONT face=3DArial size=3D2>Regards </FONT></P>
<P><FONT face=3DArial size=3D2><A=20
href=3D"mailto:pvsp@ulmail.net">pvsp@ulmail.net</A></FONT></P>
<P><FONT face=3DArial size=3D2></FONT> </P>
<P><FONT face=3DArial size=3D2></FONT> </P></DIV></BODY></HTML>
------=_NextPart_000_007E_01C45B0C.3E5C2D60-- Tag: home page hijacked Tag: 55699
Internet Explorer Pop-Up
This address takes over my "blank" setting on my "home"
designation.
It comes up as; res://gdqmj.dll/index.html#96676.
Have deleted it many times in system 32, but it keeps
coming back.
Not only does it assign itself as my home page, but also
causes numerous pop-ups such as: "looking-for" (Home
Search, SearchExtender, Shopping Wizard, etc.).
Any solutions would be appreciated Tag: home page hijacked Tag: 55696
Internet Explorer hijacked??
I'm running WinXP Pro with IE version 6.0.2800.1106.xpsp2.030422-1633. All available critical updates have been installed for XP and IE. My problem is every so often when I click a hyperlink (from any app) or open IE, it opens to either a casino site or a porn site. I have Ad-Aware with the latest updates and I run Norton AV 9.05.15, but something seems to have slipped through the cracks any way.
Does anyone know how I can detect and remove whatever it is that is taking over my pc?
Thanks. Tag: home page hijacked Tag: 55695
multiple explorer windows open randomly?
Anyone remember the problem that causes Explorer to open a
multiple # of windows randomly when booting up on XP?
I've seen it before and can't remember the
cause...thinking virus? Tag: home page hijacked Tag: 55689
Event log access rights on Windows 2003
Hello,
I have a COM object which allows an asp page reading a user defined event
log (the account used to access the event log is the connected user's one.)
When I store the page on IIS on a W2000 server, I can use it whathever user
account I use.
But if I store the page on IIS on w Windows 2003 server I get on error
(Access denied) when I open the asp page with a user that does not belong to
Domain Admins group.
I want to know if there is a difference (in a security point of view)
between IIS on Windows 2003 and IIS on Windows 2000.
Thank you. Tag: home page hijacked Tag: 55688
Detecting number of processors
I want to add "number of processors" to my license control system. I know I
can use Environment.GetEnvironmentVariable() to check for the environment
variable NUMBER_OF_PROCESSORS, but I do not know how easy this might be to
fake. Would I be better off using a Win32 sdk call to GetSystemInfo? Is
there a better way? Which is more reliable? Which is more portable?
Thanks! Tag: home page hijacked Tag: 55680
Critical Update for Outlook Express
I am running XP Pro SP1 and Outlook 2k SP3 (don't use OE). However,
whenever I run Windows Update it tells me that I need to download a
patch for Outlook Express (Cumulative Security Update for Outlook
Express 6 Service Pack 1 (KB837009)
Do I need it?
Edward
--
The reading group's reading group:
http://www.bookgroup.org.uk Tag: home page hijacked Tag: 55679
Cat's Claw
When on the internet, if closing a window, the IE crashes
a window with the message "An unauthorised attempt to
close Cat's Claw was ignored"
The computer must then be re-booted.
I cannot find any reference to this on the computer or on
the internet - Microsoft, AVG, Norman, Symantec.
Can anyone help as this is getting to be really annoying. Tag: home page hijacked Tag: 55677
can't install winPatrol
I have a Gateway 400 notebook with XP.
When I try and install winPatrol I get an error message
saying the InstallShield had a problem.
Does anyone know how to install winPatrol in this
configuration?
Thanks,
Bob Blum Tag: home page hijacked Tag: 55672
Instant Access now on computer - how do we remove?
In the past two days, an Instant Access shortcut appeared
on our desktop and tries to dial up the internet. We
cannot remove it using Add/Remove application without
going to the porn site it defaults to. Any advice? Tag: home page hijacked Tag: 55666
patch.exe
I have received an email from security@microsoft.com with
a patch.exe file. I have been getting an error message
when I logon to my computer but I'm not sure the message
came from Microsoft. Any hints or tips on what I should
do? Tag: home page hijacked Tag: 55665
Browser Hijackers
This is a most insidious website:
res://mshp.dll/index.html#37049
I have spent hours of my time trying to stop this website
from hijacking my homepage. Have downloaded Spybot Search
and Destroy, Spyblaster, NoAdware6 - and nothing seems to
work. Does anybody have any suggestions on how to stop
this website from hijacking my hompage; and also, would
love to find out who is personally responsible for this
website and where it originates. I would pay this person
a visit - in the flesh. If you have any thoughts about
how to get rid of this website, please email Al at
apt@sev.org Thanks.
al Tag: home page hijacked Tag: 55661
RDC schedule
i want to schedule Remote Desktop to start & stop at certain times.
i.e. shut it down at 8pm. start it up at 9am every day. does anyone know
the cmd command to run from batch file? Tag: home page hijacked Tag: 55660
Attachments in email
Is there any way I can view my attachments. I'm taking an
online class and I receive emails with attatchments. BUt
Outlook express deletes the attachement before I can read
it. This is the message attached to the email "OE removed
the following unsafe attachments in your email. But it is
safe and I need to see it.
HELP!!!! Tag: home page hijacked Tag: 55653
Something Hosed?
Whenever I'm on the net (both Explorer and Outlook
Express), my system (XP) keeps wanting to invoke the
Install Shield and load Excel (which I already have
loaded). What file/files control this? Thanks in
advance. ED Tag: home page hijacked Tag: 55652
Hope this may be of some help to those with coolwebsearch issues
Yesterday while surfing I noticed my modem clicking. I don't use the =
modem for Internet connection I only use it for FAX service. Anyway I =
knew something was wrong. In the Task Manager Windows 2000 this file =
was running:
dale.exe
This file has no Version tab in properties and thus is suspect. It is =
27KB about the size of the NETSKY virus and variants. It has an =
accompanying dll called 2.01.00.dll. The name is not important here. =
It is a self-registering dll so yiou can remove its information from the =
registry using this command in command prompt in the folder where it =
resides (%SYSTEMROOT%\system32\services)
regsvr32 /u 2.01.00.dll <ENTER> | OK <OK>
That should be the very first step. Once that is done you can End the =
Process of dale.exe in the Task Manager. But there is still a long way =
to go before you've cleaned out this coolwebsearch hijack.
Next get Merlin's CWShredder. That will fix the Windows Media Player 9 =
whose executable is replaced by this worm. Also the other files in the =
above services folder (which you should not have there) are:
crontab.ini
keywords.ini
sl.ini
titles.ini
wmplayer.exe (the worm)
You will also find the above executable called in the Registry in these =
keys:
HKCR\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
(remove the call to the executable on right)
Also it infests win.ini. CWShredder will find that and take care of it.
Still not done.
At this point you have to make sure that your dllcache is replenished =
with bona fide files. This is a smart worm and the developers have gone =
to great lengths to make sure you overlook something. To replensish the =
dllcache you insert your Windows 2000 (in my case) CD-ROM go to the =
command prompt and type:
sfc /purgecache /scannow
The last switch is only necessary in Windows 2000 Professional.
Now you have a new dllcache and you should be able to fire up the other =
Spyware catchers you have:
Adaware 6
BHODemon
HijackThis
Rebooting during this process when significant changes are made should =
get everything back to normal. Oh I forgot. You also have to reinstall =
Windows Media Player 9. If you are in XP I'm not sure what to do =
here...
And one last caveat. If you are using Windows 2000 SP3 then sfc will =
break your system. You need to get qfecheck.exe and determine with that =
what Hotfixes you need to reapply. Watch out for HTML Help breaking and =
you might need to reinstall Windows Messaging if you use it.
HTM someone.
--=20
George Hester
__________________________________ Tag: home page hijacked Tag: 55637
email scanning norton not scanning/ zonealarm2 fault?
On Mon, 14 Jun 2004 12:47:17 -0700, "Lz"
<anonymous@discussions.microsoft.com> wrote:
>I have norton 2004 - which i bought in march.
>When sending email it used to scan outgoing and incoming
>email. However now it does not..
>It still says that auto- protect is enabled and i did
>the 'Eicar test txt file' and nav worked straight away
>saying it was a high risk file and delete it immediately.
>so why is it not scanning email or finding virus
>attachments in my email like it used too?
>i have done various online scans to check i dont have a
>virus (just incase my antivirus was not working properly)
>I have no viruses.
>
>has nav changed the way it works?
>i used express live update daily.
>When i used help and support (automatic)in
>norton/symantec website
>it says that i am running a older version of live
update -
> i only bought it a few months ago! then it asks me to
>download the new live update but the page doesnt load (i
>have 600k broadband).
>
>can anyone help me?
>thanks
reply /answer:
Sorry no I can't - I have the same problem.
I have noticed that as from about 2 wks ago Norton is no
longer
scanning my email either (Norton 2003 in my case). It
says it IS
scanning the email but it appears to be telling porkies
because the
little scan window no longer shows and for the first time
in ages I
have started receiving attachments from people I don't
know (I can't
be sure they're viruses because I am not opening them to
find out, but
it is odd).
I've even tried completely re-installing Norton but the
situation
remains unchanged.
The only thing I changed recently which might conceivably
have an
impact is that I updated my ZoneAlarm firewall to the
latest version.
This version monitors suspicious email code itself
(although not
viruses) AND monitors the AV software to make sure it is
behaving
itself and is up to date. Could this be causing some
sort of
invisible conflict?
LiveUpdate still works and complete system scans appear
to show the
system remains uninfected. Adaware has done it's
customary spring
clean of dodgy data miners etc but basically also drawn a
blank on
anything seriously amiss.
. Tag: home page hijacked Tag: 55634
spy ware
I get the little "eye" icon on my lower tool bar. Last
week I was infested with the spam of the world trying to
get me to purchase a spy blocker. It caused everything to
go bonkers. I had to finally restore my hard drive. Is
there anything I can do to block this from my pc without
purchasing a program. If not please recommend one that is
a valid and trustworthy company.
thanks Tag: home page hijacked Tag: 55633
some one has hacked into my account
some one has hacked in to my account and put horrid stuff about me and also has changed my password and secret question. I would like to get on to my old account and delet the nasty stuff but i dont now how? I also now who did it. Tag: home page hijacked Tag: 55630
Power users group
I have two issues.
I have laptops in the field running windows 2000. We use
them for diagnostics on forklifts. The first problem is
how do I change the security of the power users group to
allow hardware to auto install when they plug the
diagnostic cables into the usb port?
The second problem is when I plug the cable in(it is a
serial to usb adapter)it finds a com port. The com port
it finds is usually higher than 2. The diagnostic
software needs com 1 or 2. I can go into device manager
and change this setting, but next time the cable is
plugged into the usb port it happens again. I don't want
my users going into device manager and playing around.
Would appreciate any help into this matter.
Stephen Tag: home page hijacked Tag: 55627
administrator password
A temp has been into our office and changed the admin
password, we have tried everything to logon but we cant.
the guest account is switched off, and we dont know how
to bypass, we cannot get hold of the temp!! Tag: home page hijacked Tag: 55617
nuisance sites
i am having problems with adult sex box which keeps
popping up and trying to disconnect my connection to
connect to its 1 pound a minute site.i have never opened
this site or downloaded any software for this.can you help
meplease so i can stop this garble on my comp.i am only
user so is it possible some automatically dialer is
searching for random ip{such as mine}to send this illegal
programe to me.???
how can i block this alltogether.
thanks a lot Tag: home page hijacked Tag: 55613
False links in web pages loaded in IE
Dear all,
I have a dll in system32 : tqwtg.dll which is continously
reseting my home page - I tried to delete it - each time I
launch the IE will come again.
While loading any page in IE some words in the page become
links to www.search-what.net.
Please help !!!
thank you,
Silvia Tag: home page hijacked Tag: 55612
Networking issue
Question:
My assignment is to download critical updates to an
intranet that has 100 client workstations and 7 servers
without Internet connectivity due to security
classification issues. My organization uses SUS to
download updates from the Internet but, unable to upload
updates to their workstations due to policy restrictions.
I've tried burning the updates to a CD and uploading it to
the intranet, but it didn't work. I've done some research
on the issue but didn't have any success in solving the
problem. Can you please give me any tips on how to fix
this problem? ASAP Tag: home page hijacked Tag: 55605
virus
My home page keeps reverting to about:blank and I am
unable to run Trend Virus scanner. How do I fix this
virus!? Tag: home page hijacked Tag: 55602
virus
My home page keeps reverting to about:blank and I am
unable to run Trend Virus scanner. How do I fix this
virus!? Tag: home page hijacked Tag: 55601
malware/spyware
I ran a program called spyferret and it told me I have 2 incidences of
malware Bingofun and one Alexa related spyware. Now I ran adaware with
latest refs and spybot with all latest files but they report nothing, who do
I trust? Tag: home page hijacked Tag: 55600
MBSA
Hi All,
Does anyone know if it's possible to change the default
output folder in the Baseline Analyzer tool while running
a scan with the command line version?
Also, is it possible to change the default folder that
the gui version looks at when you chose to view a report.
Any help would be grate!
Regards,
Dunc. Tag: home page hijacked Tag: 55598
How to issue Computercert for computers in nontrusted forest?
Hi!
I have two forests (on production and one test).
In the well secured production environment I have a offline RootCA and a Enterprise Issuing Sub CA.
All works fine in the production environment...
BUT now I would like to give a computer in the test-forest a computer-cert to be able to make an IPsec connection to one machine in the production-forest.
I do not find any way to make a computer-cert manually in the web nor GUI at the Enterprise CA server.
Can anybody help me?
Is it possible, and if not how do I do it? Tag: home page hijacked Tag: 55597
Logon Passwords
I have an XP home machine on which the user has added a password in order to allow logon to the PC. The administrator and guest accounts are both switched off and the user is on leave and unavailabe for several weeks. My question is "how can i bypass the password prompt on the welcome screen in order to allow other users to access this machine?" Thanks Tag: home page hijacked Tag: 55595
deleted files, where are they stored?
I really do not understand it, I am running a program called tuneup
utilities 2004 and I am looking for deleted files. It tells me that I have
14000 deleted files what puzzles me is where are they all stored and if I
want to pemanently delete them how do I do it? Tag: home page hijacked Tag: 55594
Some question about WinXP users?
Hi I am Jamil I have some question about Windows XP. 1st
let me tell you about my system. In my system I have
three users
NAME MEMBER OF PASSWORD
Administrator Administrator Yes
Jam Administrator Yes
Friend Users No
Now I want some help from you
1. I don't want to let Friend to turn of computer.
2. I have some folders in D: drive (I have two
partitions and system is in C: drive) I don't want to
Friend use those folders. Or can I stop Friend to use all
D: drive?
3. I have some programs in my system like Yahoo!
Messenger, ACD See, Office and other I don't want to
Friend use those programs.
I thing this is enough for now thanks for help bye Tag: home page hijacked Tag: 55592
I have picked up the same problem as niv of today's date.
In my case Web address is ahbnr.dll/index.html#35759 using IE6.
Any help would be appreciated