Adware/Virus Warning!!!

General non-WoD related discussion

Moderators: Siobhan, Sebastian, Drocket

Adware/Virus Warning!!!

Postby Azalin4savioR on Thu Jun 17, 2004 10:25 pm

Ok to let you all know and maybe get some help if someone knows how to fix this here is whats going on.

Im running a machine with Windows XP Professional, (fixed) so that it can recieve the latest updates.

I have Norton Anti-Virus 2004 Professional, registered not cracked or anything and fully updated.

The newest most up to date version of Ad-Aware.

About 2 days ago I notced that when I opened Internet Explorer this stupid search page, I forget the exact name kept comming up instead of my usual home page.

Well I figured its ad-ware so I ran Ad-Aware, the program found nothing. It was just a search page so I didnt worry to much about it.

Last night and today I noticed ALOT of lag compared to normal and when i checked the other computers in the house they werent even remotely lagging so I decided to delve a little deeper into the situation.

Again Ad-Aware found nothing, and I did a cntl-alt-del and noticed a few programs running with odd names like ackd32.exe which I located, shut down and deleted because I know stuff like that isnt supposed to be there.

(I try to keep track of whats installed and what its called when its running for situations like this)

I also checked my start up list to see what programs are starting up with my computer and low and behold there were several there that shouldnt have so I unchecked them, then searched them out and deleted them as well.

Still have the problem, still Ad-Aware finds nothing.

Then I realize hey, Norton finds adware sometimes lets see what it says. As I turn on Norton I realize that though the icon is in the desktop, the Auto-Detect & Email Scanning parts have been disabled and refuse to re-activate. I run a scan of my entire system, which is 3 harddrives total. Out of the main C drive I find 47 adware programs installed, all with wierd names like ackd32 and netpm, as well as various dll, dat and pf files assocated with them. I delete what I can, rename the others and reboot while unconnected to the net so that I can delete the others that I couldnt because they were running.

I deleted all my cookies, deleted my temp files, deleted my history, emptied everything anyone has ever told me to delete when having problems like this, even ran disk clean up. I opened up Internet Explorer, changed my start up page to blank like normal, reset my security settings to High and checked to make sure everything else was set to highest security possible. I then again ran norton (which now was fully operational) found about 3 more files, not sure where they came from or how their being installed. I ran Ad-Aware this time it actually found things and removed them. I rebooted my computer.

Checked IE its still normal, ran ad-aware again found more stuff, ran norton again found more programs, checked IE again, security settings are reset and the homepage is changed back to that goofy search page again!

I dont know what to do short of a format of the entire system, which is harsh just for a adware program but the way this thing replicates I just may have to!
Azalin4savioR
Sr. Regular Poster
 
Posts: 175
Joined: Thu Apr 22, 2004 8:14 am

Postby Drocket on Thu Jun 17, 2004 11:06 pm

That sounds somewhat similar to what my sister's PC managed to catch about a month ago. It deactivated the virusscan program, preventing me from installing any other virusscan programs and installed about 5 bajillion other virus/spyware programs in secret. It took me about forever fiddling around, but I finally got it cleaned up.

This may not help, but if you haven't already, I'd recommend rebooting Windows in Safe mode (press and hold F8 while your PC is booting.) Before you do that, though (since you probably won't be able to connect to the net in safe mode), download the Stinger tool from McAfee (<a href="http://us.mcafee.com/virusInfo/default.asp?id=stinger">here</a>.) Running that in safe mode eventually got me to the point where I could install a virusscan program which cleaned out most of the rest, with AdAware taking out the last remaining survivors.

The people who create this sort of crap should be shot. I mean that seriously, too.
Drocket
Site Admin
 
Posts: 820
Joined: Mon Oct 07, 2002 2:54 am

Postby Atei on Fri Jun 18, 2004 1:50 am

McAfee's Stinger tool rocks. It cleaned my sister's PC when nothing else would.

One other thing to try (learned this from McAfee, too): disable System Restore, then run your virus scan. If the virus is in your Restore files, virus scan can't get at it while System Restore is active. Once the scan is complete, turn System Restore back on. I've had to do this a couple of times, and it has worked every time.

And Drocket, you are absolutely correct, except I think shooting might be too good for them. They deserve to be crucified until the corpses rot on the logs, then let the buzzards have the remnants.
Atei
Sr. Oldbie
 
Posts: 927
Joined: Fri Oct 11, 2002 3:33 am
Location: In Nia's House

Postby Joka Atticus on Fri Jun 18, 2004 2:14 am

Ok about a week ago i had the exact same thing. The websearch and everything. i ran my antivirus and it found nothing so i said o well. i kept changing my home page back and it just stoped so i just checked my computer searches and nothing like what you said came up so o well. i will keep my eye out.
Joka Atticus
Regular Poster
 
Posts: 141
Joined: Tue Jul 15, 2003 11:09 pm
Location: now that i think about it im not sure

Postby [Kobayashi] on Fri Jun 18, 2004 6:09 am

hijackthis
coolwebsearch shredder(cws shreder)

These programs can fix a lot ie related spyware.
The first one is hard to use but when you scan you can tell what most things are and what shouldnt be in there. If you need help with it post your log here. THe second one is automatic.
[Kobayashi]
Regular Poster
 
Posts: 123
Joined: Thu Nov 13, 2003 5:40 pm

Postby simon on Fri Jun 18, 2004 2:39 pm

also not a bad idea to use mozilla or firefox in the future, it could prevent such an event from happening again.
simon
Oldbie
 
Posts: 494
Joined: Wed Oct 01, 2003 2:46 am
Location: Pennsylvania

Postby Tamla Tamara on Sat Jun 19, 2004 3:58 pm

I also had adware/virus problems and tried to get UO on my laptop because of it (which I could never get to work). I was that close to formatting my C drive on this computer. I thought I tried everything. (This is part of why I stopped playing for awhile, it caused Talia's death in Destard, I was afraid to go hunting).

I finally got rid of my "internet lag" problem. I had to use a combination of things to fix the problem. One was the AdAware, which not only pointed out the naughty adware files, but also the registry entries associated with them (which I went in with regedit.exe and deleted those). I also use AVG which caught and fixed a few things. I also used this free online scanner (you have to scroll down a little to see it):

http://www.spywareinfo.com/

NOW I run ZoneAlarm Pro, which tells you exactly what programs on your computer are trying to access the internet. You can deny those bad programs from access, so even if they mysteriously "come back" they will not bother you again.

It took a bit of doing, but I *finally* have my computer back and didn't have to format *yea!*

So don't give up just yet, be persistent. Don't let those jerks win. Even if you formatted, who's to say the problems won't still come back just from browsing the web? Then you are right back where you started. Arm yourself and win the battle.
Tamla Tamara
Regular Poster
 
Posts: 108
Joined: Tue Oct 29, 2002 7:26 am
Location: North of Fellowship Hall

Postby Wolfie on Sat Jun 19, 2004 4:22 pm

I run Zone Alarm Pro also. The free version is just as good of a firewall. The pro version just ads some cookie and ad blockers.
Wolfie
Oldbie
 
Posts: 422
Joined: Thu Oct 09, 2003 11:37 pm
Location: AL, U.S.

Postby Azalin4savioR on Sat Jun 19, 2004 10:33 pm

Thank you all for your input, havent formated yet, wanted to wait till everyone got a chance to read and post. As for free/pay versions, heh this is the internet, everything is free! *grin*
Azalin4savioR
Sr. Regular Poster
 
Posts: 175
Joined: Thu Apr 22, 2004 8:14 am

Postby John Duklain on Sun Jun 20, 2004 2:47 pm

Those little programs and things have running .dll files that will replace their registry key and the .exe file with a random set of numbers and letters. To get them completely out of there, find the .dll files that are 'controlling' them, and delete them all.
John Duklain
Jr. Assistant Regular Poster
 
Posts: 63
Joined: Tue Mar 02, 2004 4:31 am

Postby Azalin4savioR on Sun Jun 20, 2004 4:59 pm

Yeah Norton Anti-Virus finds the dll files and such too, but deleting them doesnt solve the problem either, I still havent gotten that Stinger program Drocket suggested, everyone keeps saying about how Mcafee and Norton programs collide, which in the past I have had computer problems of that nature myself, im wonderin if I should uninstall Norton before I try it
Azalin4savioR
Sr. Regular Poster
 
Posts: 175
Joined: Thu Apr 22, 2004 8:14 am

Postby Wolfie on Sun Jun 20, 2004 5:07 pm

Do you just have Norton antivirus or the package with the firewall too? Norton firewall conflicts with ZoneAlarm, so if youve got that then dont download it.
Wolfie
Oldbie
 
Posts: 422
Joined: Thu Oct 09, 2003 11:37 pm
Location: AL, U.S.

Postby Azalin4savioR on Mon Jun 21, 2004 10:41 am

just the anti virus
Azalin4savioR
Sr. Regular Poster
 
Posts: 175
Joined: Thu Apr 22, 2004 8:14 am


Return to General

Who is online

Users browsing this forum: No registered users and 1 guest

cron