Explore topic-wise InterviewSolutions in .

You're mixing two PROBLEMS.

Quote

this just started a few months ago and no-one knows how to get rid of it

It is also affecting sound and different things

Hi,

I was wondering if anyone MIGHT be ABLE to help me here. I KEEP getting these cookies things from the trend Micro PC-Cillin and are set to be deleted automatically. It's just that i want to know where they come from. I've googled them but am not satisfied with my finding. so i thought i might want to drop off here and get some help from experts.

The cookies i've been getting are

cookies_225
cookies_1198
cookies_1638
cookies_3235
cookies_1020

Your ideas will be appreciated.

Thank you in advanceOpen them and look inside?

If you're going through that much TROUBLE to identify cookies, you might as well manually accept and deny them like I do...

will someobody please HELP me out?!?!?!  i just turned on my computer today and a popup said that i have 12 viruses on my computer and it says i should click on the bubble and download an antispyware program.  and it says my system configuration is not safe.  my background has been changed to something that says "Warning! Spyware threat detected on your PC!"

the problem is i downloaded the program and now it says i have to pay $50 to use it!  i decided not to buy it but the *censored* bubble pops up every minute!  i already have norton antivirus but its messed up so i tried uninstalling it but when i RESTART my computer the program is still installed and the same exact THING happens all over again.  i cant change my background or anyting else under display properties and i cant change any settings on my computer either!  

how the *censored* do i fix this!

i WOULD like an answer really soon if possible becuase my computer is getting slower and i think i am getting more and more viruses the longer i wait.What's the name of the antispyware program,... SpyFalcon?its callled antispyware soldier.


how do get rid of it and fix my problem?Download / update / run:

CRAP Cleaner
http://www.filehippo.com/download_ccleaner/


Spybot
http://www.tucows.com/preview/310138


Ewido
http://www.majorgeeks.com/Ewido_security_suite_d4677.html


Adaware
http://www.download.com/3000-2144-10045910.html

Alan <><  i had that too. do what was said and scan in safwe mode with system restore offA brief description from a site that lists rogue spyware apps turned up the following:

AntiSpyware Soldier        antispywaresoldier.com           aggressive, deceptive advertising, stealth installations (1, 2, 3); false positives work as goad to purchase [A: 8-21-06 / U: 8-21-06]

patio.  8-)uninstall the program before the scans

Have a read here, especially the first few.

http://www.google.com/search?hl=en&lr=&q=malware+with+instant+messagingA friend informed me that my ex-husband is spying remotely on my computer usage via an "undetectable" spyware program. He seems to think it was something called SniperSpy? I use SpywareDoctor to scan my computer daily and also CCleaner to keep my computer cleared of old junk. I have not found anything called SniperSpy or any other spyware thus far... but could it be there lurking and "undetectable" After much research on spyware programs like this, I am confused about a related issue: keylogging, IM malware, etc... raised a question in my not-so-computer-savvy brain...

I use a laptop for home and work usage and gain wireless INTERNET access via wireless network both at home and at work. My home network, I am not so worried about, but can  someone at my work place view what I am doing on my computer via spy-programs on the network, or does this stuff have to obe downloaded directly onto my computer? Recently, a colleague had personal information about me that they WOULD have no way of knowing other than bugging my home phone or accessing my computer!!! Made me wonder about this stuff and how to protect myself. Price not being an option, I would like to know how to make sure my computer is secure wherever I may be.

Thanx in advance for any possible help  First off Welcome Aboard MAIA,

It's best to start a new thread with your problem so things don't get too confused.
DLoad and run Spyware Doctor which is a free program designed to sniff out keyloggers especially.
After that update all your other protection programs and run the scans one at a time.
If you feel you don't have enough protection post back for suggestions.
Most are free and well WORTH having, but you have to remember to use them on a regular basis for them to be effective...

patio.  8-)

This Quake program installed itself on my pc from a download on a crack site and now I'm GETTING this message saying 'your computer is infected with a back door virus this trojan aloows the user to PERFORM malicious actions against your computer'.

I ran SB SEARCH and DESTROY and adaware, both of which said they had deleted it, yet i'm still getting this message.

How SERIOUS is this? What should I do to rid it?Download AVG Free, disable system restore and scan in safe mode.also dl smitfaud

and ewido

Quote

Do you have the latest Windows updates?

Your Hijackthis log is full of nasties, the above method is a cleaner way to remove them all.
[highlight]Come back with a fresh HJT log after you have done the cleaning as described.[/highlight]
(Don't skip any steps or change the order)

Yes
Keep it handy. I WOULD recommend backing up any important DATA and using it here, but a lot of folks will be along, no doubt, to assist you in recovering this FUBAR'ed installation. Sometimes you can, sometimes you can't...Barring a repair install you can try the FOLLOWING to recover that wonked up .dll...

Go to Start / Run and type in sfc /scannow and hit Enter.

Have your CD handy as it will ASK for it. Do not interrupt the process, let it run til it's finished.

patio.  8-)

Did you try looking for the installer and removing it? It may be SOMEWHERE in a temporary folder.spybot might helpHJT log.
You need to read the posts in here and absorb what is said, we don't just post links to scanning programs hoping they will fix your problems. Quote

HJT log.
You need to read the posts in here and absorb what is said, we don't just post links to scanning programs hoping they will fix your problems.

HJT log.
You need to read the posts in here and absorb what is said, we don't just post links to scanning programs hoping they will fix your problems.

There is a fix for the Windows Installer at MS's web site...

then what do i do?
change the load thing so cds boot firstcan you please take me through how i do that?
press f2 yell let you get to a screen then U shhand but use your gogle buttoiould i cant remember exactly how off hand but use ur google buttonive gone through it but i cant find anyhting in there to change the boot sequence any more help??i just did it all you do is rapidly press f2 right when u start the computer go to boot sequence and change the order


im running XP HOMEI just can not LOCATE the bott up sequencce ive tried everyting? wehat does the screen look like?
its bluee.. well i got to go to bedI think we have now proven that you need to gather up your legal Windows CD and take it to a shop.

Clearly we can not get you started, and even if we could you would be stuck again very soon.

Some situations can not be fixed with a forum. This is ONE of them.

Every ten minutes "norton" (that is what we have)keeps popping up saying that they caught this.  I would like to know what it means and this intruder who and what is it.
Details:      

Attempted Intrusion "MSRPC SrvSvc NetApi Buffer Overflow (2)" against your machine was detected and blocked.
Intruder: 216.95.1.60(1377).
Risk Level: High.
Protocol: TCP.
ATTACKED IP: TOWNSHIP-EAXE5D(216.95.155.124).
Attacked Port: netbios-ssn(139).
Many more details are needed. Norton Antivirus only? Norton Internet Security also? See below.

some one is tring to nuke your firewall so they can get in It's probably a worm rather than an attacker that singled you out. Some PC in Hamilton, Ontario is most likely infected with the Wargbot worm (or something similar) and it was trying to spread onto your computer, luckily your firewall/IDS (Norton) blocked it.Sorry about that but we have the whole norton package for the year.  This message is been coming up almost every 10 min. for the past month and who would be trying to nuke the firewall.  We are on a network Is there a way i can find out if it is an intruder and where and who they are?Check your routers log files to see where it is coming from. You can also BLOCK ports 135-139 in the router to prevent any more intrusions. This should not interfere with the internal network using those ports but will prevent any traffic going to or from the internet on them.There should be a setting in your firewall to turn off the notifications.You should look into buying a hardware firewall such as a router.Hi - I have looked at your post, and it is clear what has happened:

The intrusion type was a buffer overflow, which can be serious.
A buffer overflow is the process of trying to put more data in a certain memory location that is too small for that data to go - therefore causing a crash of the computer or program.
If this is done successfully, the attacker can gain access to the computer.

I have knowlege of buffer overflows as I program them to test sofware for security holes and it is most likely that the attacker (which i believe was a person and not a bot) has programmed the exploit in C language.

This can be serious so I suggest that you report it to your ISP or whoever has CONTROL over the network.
(also report it to norton by means of contact).

hope it works out ok! Quote

some one is tring to nuke your firewall so they can get in

I have been having problems logging on to the net alot recently, re-booting seems to help for a little while, but not long, so I ran a HijackThis and alot of entry's around 16 on make me wonder about them, I have run the usual spyware/trojan stuff, I know the drill, can someone take a look at my hijackthis files and tell me if they SEE any problems there? I did CHECK the files at http://hjt.networktechs.com/parse.php but that site is a little vague on what needs to be removed....
I'm on WINDOWS XP Pro SP2 Intel Pentium II 256 Mb RAM
Download, INSTALL, update and run in safe mode respectively:

AVG Free
Adaware SE
Windows Defender
Spybot S&D
with system restore off

What? People following instructions? A novel idea!  Patio... I went to the link you GAVE me before.. but then the .dat file you advised, I have not got/downloaded it... (because this month my days are pretty hectic....occupied... "sounds stupid"...still....

so... again.. I have been noticing one more change with my computer, as I insert my USB, the computer itself starts downloading or copying.... the files.. it never used HAPPEN before...

its bugger killing..... right now, I am scanning the computer with a malicious SOFTWARE I just downloaded from Microsoft updates.... I will see how it goes... meanwhile please keep advising me... Quote

Perhaps a good format and REINSTALL would solve ALL of these and probably more problems.

Recently INSTALLED AVG 7.1 professional version on my PC after reisnstalling the OS (98).

After that whenever I click the AVG icon on my desktop to start AVG to scan my PC for virus, I am always getting the message
" A required DLL file MSVCP60.DLL was not found"

What's the problem?Try downloading the dll file to your C:\Windows\System folder

Good luckuninstall reinstall AVGGrab a fresh DLoad and re-install it...packets go missing sometimes.I looked for the dll on google and i found one... if you want me to email it to you my email is
[email protected]

Once you get the DLL:
You have to put this file in System32 folder, if you dont know how to do this go to:
1. My Computer
2. Double click on your hard drive [C:]
3. Go into your WINDOWS folder
4. Scroll down until you see the System32 folder
5. Just drag and drop the DLL file into this folder...(System32)

If you have any problems or other missing dll's email us and we will copy the files for you.
-Hale's Computer Service
Visit us!
www.halescomputerservice.vze.comi won't trust it from the internet a fresh dl and reinstall will doOn top of that unless you're REALLY interested in *censored* and phoney Rolex watches a Forum is probably not a good place to post your e-mail address...And if you looked like you were selling ANYTHING from that website that post would also have been deleted, FYI.   Quote

Grab a fresh DLoad and re-install it...packets go missing sometimes.

k my pc been actin up lately prob from the porn sites to be honest,but before i begin i use avira anti virus,spybot and sygate firewall, k when i click to connect to the internet it connects and makes all the noise andall the sudden it says request is not supported,all devices are plugged in but the request is not supported,so i have to restart my pc and then it works,and another problem i had was my sound it goes on and off,just like my internet connection,now thanks alot guys and i HOPE this makes sense,i havent ran a virus scan yet i was just seeing what u guys thought.go to another computer and DL ewido adaware.. if you cant on your computer do it on your computer...


and what os do you have?? is WINDOWS up to date??

when did this start happening

unlovedwarrior Quote

k my pc been actin up lately prob from the porn sites to be honest,but before i begin i use avira anti virus,spybot and sygate firewall, k when i click to connect to the internet it connects and makes all the noise andall the sudden it says request is not supported,all devices are plugged in but the request is not supported,so i have to restart my pc and then it works,and another problem i had was my sound it goes on and off,just like my internet connection,now thanks alot guys and [highlight]i hope this makes sense[/highlight],i havent ran a virus scan yet i was just seeing what u guys thought.

Quote

Mainly becuase i would prefer to find the problem and find a fix for it without having to format and lose everything, just seems a bit lazy to me.

Quote

Me personally i would boot into safemode and delete anything that relates to Rhianna just to be safe.

She's not even that good...

Quote

Mainly becuase i would prefer to find the problem and find a fix for it without having to format and lose everything, just seems a bit lazy to me.

I don't know about that, but sometimes a good format and reinstall is quicker, and is a guaranteed fix, for a while.

I think reformatting is a bit overkill in this situation, though.

lol but its up to the OWNER

Quote

lol but its up to the owner

And what their time is worth. Ours is free, so I suspect that's why some of the threads do drag on.......

There's a lot to be said for both cleaning and reformatting, you can always do both.
That way you gain some knowledge in both areas.

I also believe that manual cleaning by deletion of files and or removal of entries with HJT does not necessarily complete the job properly.
I even have my doubts about so called cleaning programs.

You only have to uninstall a program then check your registry and program files to see what crap is left over from legitimate programs.

It's probably Windows XP on one CD and SP 1 or 2 on CD 2.. I have that as well, except that mine are copies. So we 'll never know I suppose.

Ah well, I can live with that. Quote

You say that when you go to Run and type msconfig you get an error. I was under the impression that you lost the RUN prompt? Well either way applying the NoRun fix won't hurt anything. About the reg file, it sounds like it is still a txt file. You probably have Windows set to hide file extensions for known file types, which means it's probably actually named fix.reg.txt. You can open any folder and go to Tools > Folder Options > View and UNcheck "Hide extensions for known file types" then click Apply. Then you can make sure it is actually named fix.reg it should look like this if reg files are correctly associated:



Here is an updated version that will also fix MSConfig if it is still present in the correct path:

Code: [Select]Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE]
="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe"
I will also attach a copy of the reg file to this post in case you don't feel like messing with the hide extensions setting. Just unzip the reg file to the desktop and either double-click it or right click it and choose Merge. Then after it has been imported successfully, reboot.

Your HJT log looks clean.

- JPH

it sounds like it is still a txt file

You probably have Windows set to hide file extensions for known file types

Can you open regedit?

JPH where did you learn this stuff??

OK, I've attached a fix. Just import it the same way you did the last one.

Quote

JPH where did you learn this stuff??

--> www.vmodeling.com  

Awesome dude.....You did it. Thanks again, mang. You rock. [smiley=beer.gif]

Hi all
I had some spyware problems a few days ago but I think I've eradicated them
Can SOMEONE just take a quick look at my attached HijackThis log file and tell me if I'm still infected or not?
ThanksI don't see any infections.  [smiley=thumbsup.gif]

You can fix this:

O23 - Service: PTT - Unknown owner - C:\DOCUME~1\test\LOCALS~1\Temp\PTT.exe (file missing)

The other "file missing" entry refers to msgrapp.dll (MSN Messenger Module) which is often mislabeled by HJT as being missing so you can probably just ignore that. If you want to though you can go to C:\Program Files\MSNMessenger and see if it's there or not, if not you can fix that entry too.

- JPHOK cool
ThanksNo PROBLEM.  [HIGHLIGHT]  hijackthis_030.zip [/highlight]     <<<


** absorb the sarcasm-please! **

Too many problems to list. I am running XP and have used Adaware and Registry Mechanic.
Here is my Hijackthis file. Can someone please review it and offer some assistance?
Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 1:44:11 PM, on 10/23/2006
Platform: WINDOWS XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?id=2&svc=mail&cbid=24325&msppjph=1&tw=0&fs=1&fsa=1&fsat=1296000&_lang=EN&lc=1033
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - EXTRA context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160335230497
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetMeeting Remote Desktop SHARING (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe (file missing)

From what i can tell your protection package leaves a few blanks...
I see Windows Defender.
And you mentioned you ran AdAware and Reg Mechanic...
DLoad install and add these to your arsenal:
AVG Free.
Spybot Search and Destroy.
Ewido Free.

Update each of them. Run the scans in SafeMode with System Restore turned off and let us know the results...

patio.  8-) Quote

Too many problems to list.

ok my uncles computer is ACTING werid or i should say one process is acting werid.
its the?? well i cant find it on the hijack this log i TOOK. but the process only acts up when he or some one goes to log off. then it will say the process is trying to stop, then the computer will lock up on the person. i tried googleing the process but the google lord doesnt give me an answer so im thinking its spyware. it says its from my aunts account but she barely gets on that computer. ive done all of the scans the usual way(spybot adaware, avg both of them) its an upgrade xp home from me. so im thinking that it might just be a mess up from the upgrade. but here is the hjt log

oh i removed norton after i did the log scan and installed avg.

TIA

unlovedwarriorYou know the drill by now...
More Info.

How can we assist if we don't even know the name of the offending process ? ?

im trying to get ahold of him to get the name again.. as soon as i get the name you will tooif you think its spyware, go straight to Spybot S&D, its really useful, besides, TRY Ashampoo anti-spyware, Spybot is free but Ashampoo , u can get for a 30day trial ... try it...

Good luck........ Quote

ok my uncles computer is acting werid or i should say one process is acting werid.
its the?? well i cant find it on the hijack this log i took. but the process only acts up when he or some one goes to log off. then it will say the process is trying to stop, then the computer will lock up on the person. i tried googleing the process but the google lord doesnt give me an answer so im thinking its spyware. it says its from my aunts account but she barely gets on that computer. ive done all of the scans the usual way[highlight](spybot adaware, avg both of them)[/highlight] its an upgrade xp home from me. so im thinking that it might just be a mess up from the upgrade. but here is the hjt log

oh i removed norton after i did the log scan and installed avg.

TIA

unlovedwarrior

I just ran VBA32 in safe mode and it FOUND:

AdWare.Win32.Dm.n in the location D:\j386\Apps\App07888\luregwmi.exe

TR.Spy.Banco.FR.2.C in the location C:\WINDOWS\system32\SMTP.ocx

Is it safe to delete these?
What else do I need to do to keep my computer safe?

Thanks!dont open anything that you dont trust WITHOUT scanning it first.I hate to say this but I'd reformat and start again. *OUCH!*
I wouldn't save anything that he has sent you.
Then go and change every password you have ever used.
Even if you rid your computer of everything he sent you, he still knows too much already. Quote

[highlight]I hate to say this but I'd reformat and start again. [/highlight]*OUCH!*
I wouldn't save anything that he has sent you.
Then go and change every password you have ever used.
Even if you rid your computer of everything he sent you, he still knows too much already.

my o/s  is windows  x home edition.my norton antivirus program  is about to expire plus increase in price.   do you recommend avg is it compatable with windows, I concern about anything that free.what do you recommend :-?AVG works fine, in fact your computer will run much better without Norton.
HINT: Check back here for Norton removal INSTRUCTIONS, I think Patio has them. thanks for the  info. now how do i remove norton from my system . Open Control Panel / Add-Remove Programs  / scroll down to NAV / change-remove.

Make sure you have the Norton cd handy, if necessary.

Alan <><  

Sometimes Norton is a stubborn litte dude and doesn't want to go away.  Here is a tool from Norton to remove the leftovers if Add-Remove programs doesn't do it.

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

Alan <><  DLoad and run the tool below...
 
Norton Removal Tool
 
1) USE Add Remove Programs first and un-install Norton...
2) From Windows Explorer search for any FOLDERS named Norton and Symantec and delete them...
3)DLoad and install ERUNT and have it make a backup of your registry...
4) Open regedit and type Norton in the search bar. Delete all entries it finds. F3 takes you to the next i      instance of Norton. Continue til you have reached the end of the registry...
5)Repeat the above process using Symantec instead in the search field. Delete any Symantec keys it finds...
6)Now run the Norton Removal tool you DLoaded...
7)Empty the recycle bin...
8)Go to My Computer and right clik the C: drive and select Properties and run disk cleanup...
9)Re-boot and run disk defrag....
 
There you're done !
 
See how easy Symantec makes it for you to dump their product ? ?
 
Quote

DLoad and run the tool below...
 
Norton Removal Tool
 
1) Use Add Remove Programs first and un-install Norton...
2) From Windows Explorer search for any folders named Norton and Symantec and delete them...
3)DLoad and install ERUNT and have it make a backup of your registry...
4) Open regedit and type Norton in the search bar. Delete all entries it finds. F3 takes you to the next i      instance of Norton. Continue til you have reached the end of the registry...
5)Repeat the above process using Symantec instead in the search field. Delete any Symantec keys it finds...
6)Now run the Norton Removal tool you DLoaded...
7)Empty the recycle bin...
8)Go to My Computer and right clik the C: drive and select Properties and run disk cleanup...
9)Re-boot and run disk defrag....
 
There you're done !
 
See how easy Symantec makes it for you to dump their product ? ?
 

my o/s  is windows  x home edition.my norton antivirus program  is about to expire plus increase in price.   do you recommend avg is it compatable with windows, I concern about anything that free.what do you recommend :-?

Hi

I got nailed by about 12 BHO's and one is a VERY annoying pop up called antispyware
soldier. I tried BHO Demon and NORTON and neither of the two are working. I also tried a program "hijack this " to remove the BHO's- The thing is, is that when the programs delete the BHO they reinstall themselves.
I tried also to delete them in the registry and the same thing happens- they come right back. I'm told there is a program somewhere that's reinstalling the BHO. Where MIGHT i look for it to delete it? I'm tempted to format the MACHINE if I can't figure this out.

Tks
JEff blimpguy ....... Is it possible that when you ran hijackthis....that you missed something...... how about POSTING a logfile and let us look at it .

dl65  rename the hijackthis to hjt2k6 to make sure NOTHING is hiding from youYou will need smitfraudfix, here's a very good link...

http://www.bleepingcomputer.com/forums/topic69874.htmlFED- Can I send you a case of beer ? Smitfraud nailed every BHO in the registry and did it amazingly fast. Does the guy who wrote the software have a site to donate to? I was going to post a logfile, but it was huge. I ran it again after smitfraud and it was cut in half. Thanks guys for the help, I dreaded the possibility of my laptop being in the shop for a week.

JeffThat guy from bleepingcomputer (Grinler) sure does a good job, rather than plagiarise him I pay him tribute by sending people to his threads. [smiley=thumbup.gif]
I'm glad you're up & running. Quote

FED- Can I send you a case of beer ? Smitfraud nailed every BHO in the registry and did it amazingly fast. [highlight]Does the guy who wrote the software have a site to donate to?[/highlight] I was going to post a logfile, but it was huge. I ran it again after smitfraud and it was cut in half. Thanks guys for the help, I dreaded the possibility of my laptop being in the shop for a week.

Jeff

How to remove WINFIXER...

HTTP://www.bleepingcomputer.com/forums/topic18610.html

Don't FORGET the Ewido ONLINE scan.

hi me again this thing is pissing me off!!this icon KEEPS saying crotical SYSTEM falure and whan i click on it it takes me to a website!How can i get rid of it?Its not in my program LIST HELP!!i just got my computer back from getting fixed.See the replies to your other post. It is not fixed.

I'm at work and suspect that a virus is terminating the wireless connection on one computer.  There was no AV program to begin with.  (big nono I know)  The connection is good because I am on the same network right now.  How do I fix this if I can't get online?

comp specs:  Dell Optiplex GX260
XP PRO  Service Pack2 (2002), Pentium 4 1.80 Ghz, 256 Mb RAMDownload it on a different computer then copy the file to the problem computer.what's the most efficient WAY of doing that?  I started with floppies, but AVG FREE is pretty big, and have already gone through 5, should I continue this way?USB memory stick.
I can't remember how big AVG is but I believe it to be less than 10MBs or so.
Floppies hold 1.4MBs.Can you start in Safe Mode + NETWORKING on the problem computer?ok thanks alot.  I'll update and let you know what happens.

Hello,

I've got an internal ERROR on my ad - watch event log, and a message that says if I want to correct this error, to import a NEW SITES file. Can anyone please tell me How to import a new sites file. THANK youJust remove the PROGRAM and reinstall it. Quicker and easier.

I think my windows 98 IBM APTIVA has a "zombie". If not is some other KIND of virus. This used to be my only computer and I have had problems with it proccessing in the middle of the night or when it had been left idle for more than a few hours - not consistant. Usualy I would find that the computer would freeze after I would start to use it again, reboot and things would return to normal. Over the years I have replaced the hard drive ( from a bigfoot 6GB to a Maxtor 32GB) and the probem quieted down but never fully went away. I got crazy over this past summer and I decided to restore windows and erase all the junk. So I saved all the files I wanted and burned them to a CD. After reinstalling windows the computer refused to install the CD ROM drive ( the driver is on the recovery CD and I have never had a probem with the CD ROM before). After scouting local repair shops we decided it would be cheaper to buy a refurb computer. So we took the Maxtor hard drive and installed it as a secondary drive in the refurb Windows 2000 NT and reformated it. I have not had a problem with the refurb computer.  We put the Bigfoot back into the APTIVA and it booted right up and the CD ROM worked after I reinstalled windows from the CD.  Now it's baaaaaack to proccessing all the time again.  I still have dial up account and when  I tryed  to connect to the internet with the APTIVA it is so bogged down it won't even load a website ( like a home page).  AVG came with the refurb WIN 2000 NT so I burned the files to a CD and intalled it on the APTIVA and it found nothing ( granted I can't connect the APTIVA to the internet and update it). Same story with Ghost Surf ( spyware) and Spybot S&D.  Im WORKING on a way to get the updated files on to the APTIVA. It seams that every time I get close to finding the infected files something else will go wrong. One week it was the printer driver that was forgotten, now it's the display and it looks as if it's running in safe mode ( but it's not).  So my first concern is how do I get rid of the bug on the APTIVA?  After it's cleaned I plan to never take the APTIVA online again. My second concern is if the virus, bug, zombe whatever could still be on the Maxtor drive and infect my NEWER WIN 2000 NT computer.
Currently I have and use on both systems:  Firefox and Thunderbird, Ghost Surf 2005, Sygate Personel Firewall PRO, Spybot Search and Destroy, AVG Free Edition.
Today I booted the APTIVA into DOS and ran Scandisk. It made a few repairs but it  did not fix the problem.
Thanks in advance for your help.  Aptivas are older machines so it could be hardware or software. I would first start by checking the hard drive with the free diagnostics download from the Maxtor web site. Next test the RAM with a free download from www.memtest86.com  Both are free and just take a little time.

If all check out OK, then save the files and format the drive and reload Windows again. Do not reintroduce the files you saved and do not connect to the Internet. If the problem PERSISTS it is a hardware fault.

On a new Dell laptop, I get (on startup) an error message "The instruction at ...... referenced location ....... .  The memory at this location could not be 'read' " (SOMETIMES it says 'written'.)  The application program is MsDetct, part of McAfee Spam KILLER.  Dell technical support says it is a software problem, not a problem with a memory chip.  Their diagnostic program PASSES all the memory tests.

So I try to contact McAfee technical support with a question.  WHOO, boy!  They are tighter than King Tut's TOMB.  No way to contact them.

Any helpful suggestions from ANYONE would be appreciated.

HalI would try the free download at www.memtest86.com. If that passes, then I would ignore the McAffee and probably delete it. It's probably just a 3 month trial anyway.

I  have a problem that  some  VIRUS files can't kill by the antivirus software,when I try to kill it all by myself  ,and then  the screen JUMP a tip  to TELL you not to kill the virus!who can tell me the way to cut these files !Thank you!What have you USED to run the kill?This should be good...Don't run the kill yet, we need to keep this alive.

Do you know the name of the virus wang?Where's Raptor when I need him?

Quote

Glad to see your back Proph.

Sorry,about the bad exchange friend.  

http://www.ats.cornell.edu/helpdesk/win/nav/uninstallnav.html

Quote

That's why we refer to it as the Norton Virus.  

yes yes now don't get me wrong , I am not saying it fixes problems.... but it does not actively try and destroy ur pc...

I'm new to the forum and I have a problem or two.  I am clicking on a hyperlink that should take me to a site where I can sign up to possibly mystery shop ( I can hear the groans.  Just trying it out).  Anyway, when the hyperlink is clicked, I am sent to the proper URL, but the site onlyy lists places where I can spend money on products or services RELATED to mystery shopping.  I know it might be that the site owners intended to send me there, but I don't think that is the CASE.  I'm waiting on contact from them in response to my question to that effect.  I believe the URL is somehow being renamed (tho not in the address line of my browser).  Is this possible.  The URL   IS  the correct URL that I'm clicking on.  If it HELPS, the URL is http://www.mysteryshoppinginfo.com/subshops.html.  Through reading the information at the beginning of the forums, and some info on the virus thread, I downloaded ccleaner and used it.  It found two registry problems.  One said Registry Key   Hkey_local_machine\software\altnet.
The other was HKEY_USERS-1-5-21-220523388-115176313-682003330-1004\software\microsoft\InternetExplorer\Main\FeatureControl\FEATURE_
LOCALMACHINE_LOCKDOWN\iexplorer.exe!=w=1.  Do I need to go into registry and delete these or are they harmless or even usefu even tho ccleaner presented them as an intrusion (my interpretation).  I'll present my hardware here
 
Compaq Presario R3000
Windows XP   svc pack 2
80 gig hard drive
Firefox browser
384 mb of ram
Thanks for any help. Very frustrating being redirected (if that's what it turns out to be)hi and welcome to the forum. i got the email reply from the forum on this topic but i was busy this weekend but what PROTECTIONS do you have? AV ANTISPYWARE etc? what's the address the you get sent to that you think is getting redirected?


unlovedwarriorThanks.  I run AVAST, SpywareBlaster, and AVG 7.5.  The site where I'm directed to is

http://www.mysteryshoppinginfo.com/subshops.html.  Again, I think this in not the site

where I should be directed, but I have a request in to join a forum with the company.  

Someone there should at least be able to tell me what I SHOULD be seeing.  Is there a

way to tell if the site is masquerading as the site I should be going to (the URL is

correct.  Thanks
i get redirected there so its something dealing with the site.. they might be redirecting so contact themThanks for your help.  I'll see what's up.It's not exactly a re-direct it's a spoof and they are responsible.Did you get SpywareBlaster directly from the Javacool website?  There is a rogue anti-spyware product taking advantage of the Javacool product name.  The rogue tool is downloaded from www[dot]spywareblaster[dot]com.  Check out spywarewarrior.com for more info.

what SCANS have u done? what protections do you have? when did this start happening?? did you do the scans in safe mode with SYSTEM restore off

spybot

adaware

avg anti-spyware

and UR AV scan

Ccleaner

unlovedwarrior

Hey there,

I'm thinking of getting a new/different Antivirus program.  I use to have Avast and from then to now I have AVG.  Is there another (free) antivirus program out there that's good and worth going for?  BitDefender sounds interesting, has anyone used it?

Later.JacobRichards111 ...... Why do you want to stop using AVG ?
I'm a little surprised to hear that you are looking for something else ........
Are you using the new version 7.5 or the older ONE ?

dl65  It's...............  hm, yup the old one lol.

I like AVG, I just wanted to try and see the other anti virus programs.  You know, Experiement with new ones.  The only programs I've used are Avast and AVG, wanted to see what else is out there.

 ...What IS out there?If you want to experiment take a look at Prevx1 and go for a wander through their site while you're there.
http://www.prevx.com/Slightly off topic:

I just dwnloaded the new AVG and it doesn't seem to have overwritten the previous one. Should I DELETE it? I'm a bit worried it al might go when the 'free trial period' ends.unistall the old one and install the new oneAs of JAN 15 AVG will no longer be free......You didn't read the who thing:

 GRISOFT is announcing a new version of the AVG Anti-Virus Free EDITION. This new 7.5 version with improved performance and full compatibility with the latest Windows Vista version is available. Users that are using AVG Free 7.1 will be provided with a specific dialog, within the next few weeks, with the opportunity to choose the right option fulfilling their needs. [highlight]AVG Free 7.1 version will be discontinued on 15th of Jan 2007.[/highlight]For an online scan, www.trend.com has never let me down yet.

how do i NAVIGATE to see if the FIREWALL is turned on w/ MS windows XP compaq pc?  thanksGo to Control Panel and OPEN Windows Firewall.It's near the henway.

everytime i run my zonealarm antivirus/spyware i pick this up but can't remove this.  Does ANYONE know of a way i can get this off my system.

ThanksYou have to use your Google BUTTON to remove it:

http://www.google.com/search?hl=en&q=win32.mersting.b+trojan


&LT;--------------------I've tried that. NONE of those sites really give a good explanation on how to remove it.Run your SCAN(s) in safe mode with system restore turned off.try AVG antispyware free like how JPH sugggested

I just got Phantasy Star Universe and it came with GameGuard. However, I just found out that GG is a form of malware and possibly a trojin. I do not want this, I really want to get rid of it and I don't think deleting the GG folder in the PSU folder is going to help anything. I don't want to be stuck with this and I need some help, badly.I guess it disabled your google button too.

http://www.google.com/search?hl=en&q=delete+gameguard


<------------------Where did you find out that it could possibly be Malware / Trojan.
This other website seems to say otherwise:
http://eng.nprotect.com/nprotect_gameguard.htm


Chris Quote

Where did you find out that it could possibly be Malware / Trojan.
This other website seems to say otherwise:
http://eng.nprotect.com/nprotect_gameguard.htm


Chris

Personally i wouldn't trust wikipedia to define cat to me...

But that's just me.

because anyone can put an article on there and say they are a specialist in that field....

Quote

because anyone can put an article on there and say they are a specialist in that field....

Kind of like here.  

dude, u should go read ur installation terms, and if there's nothing that says u give permission to install gameguard on ur pc; go call the company!

Since AVG is not going to be free ANYMORE, anyone know of any free anti-virus software?It is still free. AVG 7.1 support ends in January, but version 7.5 is available and free. Read the whole web page after drinking some coffee. Quote

Not free ?? how come ??

Let's try to have a spam free forum for a while guys. Make the extra effort so I don't have to.  

microsoft has a phone number for pc security help (866.727.2338). i was on hold over 30 minutes & gave up.  i tried to find out how to SEND microsof t an email or get online support for Windows Defender, but couldn't navigate thru microsoft's  website to their email address nor their online support specific to windows defender---can anyone send me this specific info?

i've been getting the following message w/ windows defender:
windows defender encountered an error: 0x80508012.  An unexpectted problem is preventing the program from scanning your computer for unwanted software.  Try to scan your computer again.

any idea how to figure out this problem?

ALSO getting messages about virtual memory too low---i removed a bunch of stuff from the pc which only has 256 mb of ram, & c drive total size is 7.85gb w/ 1.05 gb free space.  any other suggestions?  thanks!!!!!!!!!!!!!!!!!!Re: the Defender error, I suggest you look at some of the results of a Google search: http://www.google.com/search?hl=en&q=error%3A+0x80508012&btnG=Google+Search

Re: virtual memory: right CLICK on My Computer, select Properties, select the Advanced tab, click on Settings (under Performance), select the Advanced tab, and see what your settings are for virtual memory.XP on 256 MG of RAM is the bare minimum...consider adding some RAM to that system.soybean, i checked my virtual memory & there is 192 mb total paging file size for all drives---do I need to change this, & if so, change to what?  

i heard a suggestion to download CCleaner to free up more space on my computer--is this a good idea?  

also saw "Reminder" on bottom toolbar when I opened pc this afternoon.  I don't know what it is a reminder for as I could not view any properties so I closed it.  Could this be a computer viur or spyware?  thanks, dede Quote

XP on 256 MG of RAM is the bare minimum...consider adding some RAM to that system.

soybean, i checked my virtual memory & there is 192 mb total paging file size for all drives---do I need to change this, & if so, change to what?  

i heard a suggestion to download CCleaner to free up more space on my computer--is this a good idea?  

also saw "Reminder" on bottom toolbar when I opened pc this afternoon.  I don't know what it is a reminder for as I could not view any properties so I closed it.  Could this be a computer viur or spyware?  thanks, dede

mikewithaprob:  any suggestions how i can get my virtual memory to a gigabyte?

I have been having problems with my internet lately and my ISP TOLD me to run a VIRUS scan. To make a long story short I ended up using Microsoft Windows Malicious Software Removal Tool (I know its a huge name for it). It said there is a Malware on my computer by the name of "Backdoor:/win32/hackdef.L". So I run the Norton full system scan and now I have figured out that Norton sucks a big one! So anyhow I need to know at how to get rid of this so my comp will stop acting weird. Also I am looking for a better Antivirus/Firewall program so I can quit buying the Norton trash! Thanks to all in adv!!


P.s. My comp specs, System:              Comp:
                                Win Xp Pro          INTEL P3
                                Ver. 2002            500mhz
                                Service Pack 2     512 RAMEwido Online Scan now called AVG Antispyware should remove it for you.
Come back when you're clean.look into AVG free 7.5Alright I have done the online scan and I also removed Norton Virus off my comp. Thanks fed for your advice! Also is AVG a good anti-virus? Or is there something better? I have had some problems in the past with AVG.Works for me. What was your issue with it?Whatever you are using has DISABLED your spell checker. Quote

What you mea Norton is crap whut version do you use 1999 , Norton knows what the actual virus or trojan is -----AVG cant even tell the difrennce between WPESPY.DLL and a trojan thas sad,Norton knows that WPESPY.DLL is a program and not always used for haking.

Quote

What you mea Norton is crap whut version do you use 1999 , Norton knows what the actual virus or trojan is -----AVG cant even tell the difrennce between WPESPY.DLL and a trojan thas sad,Norton knows that WPESPY.DLL is a program and not always used for haking.

Man you really have a grudge against AVG. But Norton sucks, i mean i suck at PC's but even i know Norton is clumsy. It slows down your P.C, makes loadsa false positives, and costs a fortune for something that AVG CAN do for free!


Chris

Last week a file ended up on my computer from my roomate's computer.  Does anyone know how this would have happened?  We have an unsecured wireless network.  Something similar happened to a friend of mine last year, where files from his computer ended up on his roomate's, but I don't know how.  I wanted to secure both computers so it won't happen again.  Any information would be greatly appreciated so I can solve the problem, if POSSIBLE, and put her MIND at ease.  By any chance , are both of these computers set up on a network to share a common Printer and file share ?

Is the network yours ?


DL65  no they are not networked together other than the internet network...

This is a good freeware just LIKE AVG Anti -virus.

Have you OTHERS tried it?

http://free.grisoft.com/doc/20/lng/us/tpl/v5Been runnin it for almost 2 years...formerly known as Ewido.

Good Stuff.

A client I support keeps having troubles with Norton 2006 on his system giving him a 1814 ERROR code for Live Updates. When selecting to manually run a live update it comes up as No Connection to Internet, yet he is ONLINE via Broadband.

I uninstalled NAV2006 and reinstalled, and it seemed to go away, but then came back.

I then followed the steps at Symantec for this error, but it's still there. It will take updates via downloading the defininitions from Symantecs site and executing to run the def update. Also the system is clean of any viruses and behaves normal otherwise.... Any suggestions???

I'm thinking it might be a registry problem since he upgraded from Nav2003 to 2006, and maybe an orphan entry is there still for 2003 when he had dial-up via AOL.

Maybe a full rebuild is needed, but he doesnt know where his system restore CD's are for his eMachine and it doesnt have a D partition with the restore set there, so I'd like to fix this without having to rebuild if at all possible...

How did you un-install Norton's ? ?Uninstalled through add/remove programs in CONTROL panel.Check the Norton site for the latest version of LiveUpdate. There might be a CONFLICT with that software that reinstalling LiveUpdate will fix. I've seen this happen before and (thus far) it worked successfully.Thanks...I'll give it a try

If I have a virus is it possible this is why I am not able to log onto the INTERNET. :-?  I had two motherboards replaced and then I couldn't log onto internet.  I then was told that I have a virus.  I could log in before the motherboards were replaced.  I'm not sure if replacing the motherboard can bring in a virus. :-/  When I tried my dial-up CONNECTION it said there was no dial tone.  I went through my provider and there was no problem on their end--all my other computers are able to log in on the same phone line but my laptop isn't able.Check that the phone line is plugged into the RIGHT modem socket.

Download, unzip, install and run Everest HOME Edition
Everest

Select Computer>Summary from the left hand screen.
Right click in the right hand screen & select Copy All
Paste the DETAILS in here.Replacing the motherboard and not reinstalling Windows can cause a lot of problems as well. Is that what you did?

I have been running SPY SWEEPER and continue to get that displayed each time.  My computer is running very slow and think that it is the cause please helpdl

avg anti-spyware


adaware


spybot


Ccleaner


uninstall the program


turn off SYSTEM restore

reboot in safe mode

what antivirus and FIREWALL  do u have??

do full scans
unlovedwarrior
What e-mail client are you currently running ? ? ?

Try re-installing it after you have BACKED up your data...

I have a problem, I keep getting a pop-ups from the bar at the bottom of the screen, they come from  fashing yellow triangular ICONS (just like the exclimation triangle in the smiles) in the right corner. They are advertising all SORTS of spyware, antivirus ect, they are called virusbusters and antivirmis, what can do to delete them.

Do me a FAVOUR?
DOWNLOAD & run RogueRemover from http://www.malwarebytes.org/
It's a very small download and will only take you a minute to try.Afterwards DLoad and run a little ditty called Shoot The Messenger which ENABLES you to disable or turn on messenger service.

What protection programs do you run on that machine ? ?

By default Zone Alarm installs as Internet zone on stealth mode and TRUSTED zone Med (sharing) zone. As it WOULD SEEM to off better security with both in stealth mode, what would be the PROBLEMS with having the Trusted zone in High (stealth) mode?You wouldn't be able to access shared folders, PRINTERS etc, and no one else on the network would be able to see your computer or access shard folders, printers etc.

I am switching from dial up to broadband and have the below security. Is there any other programs that it would be wise to INSTALL for this purpose?

AVG 7.5
AVG antispyware
Cyber Hawk
Spybot
Spyware Blaster
Spyware Terminator
Ad-Aware
RemoveIt
WIN Patrol
Zone Alarm
 
and use Advance Windows Care2 and CCleaner.
All the above are updated daily and run daily.
 
Quote

I am switching from dial up to broadband and have the below security. Is there any other programs that it would be wise to install for this purpose?

AVG 7.5
AVG antispyware
[highlight]Cyber Hawk [/highlight]
Spybot
Spyware Blaster
Spyware Terminator
Ad-Aware
[highlight]RemoveIt [/highlight]
[highlight]Win Patrol[/highlight]
Zone Alarm
 
and use [highlight]Advance Windows Care2 [/highlight]and CCleaner.
All the above are updated daily and run daily.
 

Quote

Spyware Terminator

im looking into that one

I'll help you out.
Crawler, the company behind ST had CONFIRMED links wirth IBIS who, in turn were the vendors of the infamous Wintools, Websearch and Huntbar.
However, Crawler has ceased all affilliations with malware vendors and appear to now be respectable.
That doesn't mean to say that TS is effective at what it claims to be because, simply put, it isn't.

Yesterday I made the unfortunate mistake of opening a bad exe and I got flooded with trojans and things like Virus-Busters and WinAntiVirus Pro ect.
I took care of most of that stuff with some info on another site but now I am busy battling these horrendous pop-ups from heavy.com, STOPzilla, and searching for anything on google is a joke, you find the site you want to go to and clicking on it just prompts ANOTHER lesser search site trying to find what you want but sending you to shopping sites and basically sending me in circles.
I also cant check my mail so I had to download mozilla just for that.

I did a scan with Hijack this and this is what I came up with.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\{3CAE5751-07D4-1033-0330-060221060001}\Update.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\SSTEM3~1\winspool.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\W?nSxS\c?rss.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\FlashGet\flashget.exe
C:\Downloads\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=gzcDwIZ4YTF_Mt9gXDLfJSh4VbU
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: (no name) - {F41D3F47-8AFF-8E7A-8FAD-A428E0753197} - C:\WINDOWS\system32\rjudpk.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - C:\WINDOWS\system32\axxrtvdx.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6mons.dll
O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {E025A7B7-ED73-4E0F-B8ED-7129381E0E50} - C:\WINDOWS\system32\jkhfg.dll (file missing)
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O2 - BHO: (no name) - {F41D3F47-8AFF-8E7A-8FAD-A428E0753197} - C:\WINDOWS\system32\rjudpk.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\system32\SSTEM3~1\winspool.exe" -vt tzt
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\I used both Ad-Aware and SPYBOT S&D and they continuously found new spyware, I had also went into safemode and ran both of the spyware protectors. It seemed like the spyware just reinstalled itself onto the pc right after Adaware and Spybot had gotten RID of them.

And Ive been using Norton Anti-Virus to get rid of the Trojans ect.
Also to answer your question why these things were even allowed onto the pc in the first place is because Norton was myseriously disabled "no idea on that one" and the second I turned it on it spotted the Trojans and deleted them.

So you say I should get rid of Winspool C?rss.exe and these ipv6mons.dll and rjudpk.dll?
I wont until you confirm this. Once fixed/deleted I will redo a scan with Norton, Adaware and Spybot. Quote

I used both Ad-Aware and Spybot S&D and they continuously found new spyware, I had also went into safemode and ran both of the spyware protectors. It seemed like the spyware just reinstalled itself onto the pc right after Adaware and Spybot had gotten rid of them.

And Ive been using Norton Anti-Virus to get rid of the Trojans ect.
Also to answer your question why these things were even allowed onto the pc in the first place is because Norton was myseriously disabled "no idea on that one" and the second I turned it on it spotted the Trojans and deleted them.

So you say I should get rid of Winspool C?rss.exe and these ipv6mons.dll and rjudpk.dll?
I wont until you confirm this. Once fixed/deleted I will redo a scan with Norton, Adaware and Spybot.

Hi everyone,

I'm relatively knowledgeable about computers but I've come across a problem that I cannot for the life of me solve.  I've searched these forums and have found no solution.

It all started when I dropped a 1,000 PAGE book on my keyboard.  A few days later I noticed my computer seems to alt-tab randomly.  This is, of course, annoying beyond words.  At first, it only did it when I hadn't used the keyboard in a while, but the situation deteriorated over a month or two to the point where I would be typing a sentence and *poof* alt-tab.  Also, if I'm playing a game (mostly Final Fantasy 11), sometimes I'll be typing something and it'll "lag" -- I'll press keys... ....... ... ......... ... THEN what I typed will appear.

At first I thought it was spyware or something, but I got the idea to change keyboards.  Still does it... not nearly as much or as bad but it still does it. I have (and keep updated) PC-Cillin and Webroot Spysweeper but both come up blank when I do full scans.  This is really annoying me as I can't play most of the games I have because it'll alt-tab and as most of us know, most games shy away from alt-tab support (Half-Life 2 comes readily to mind).

Any help would be much appreciated.  Thanks!hows the keyboard connected?

try USING

avg anti-spyware

adaware

spybot

Ccleaner ( USE the issues scan to clean up ur register just make sure to back up when it asks to)


unlovedwarrior Quote

hows the keyboard connected?