Virus Help
Author
Discussion

moleamol

Original Poster:

15,887 posts

287 months

Wednesday 16th June 2004
quotequote all
It's fairly nasty. Hard to get onto IE. When anything does work, a pop up comes up and then when I try and exit the comp tries to shut down and all programs close. Can't even get the virus checker to work properly. Any ideas?

plotloss

67,280 posts

294 months

Wednesday 16th June 2004
quotequote all
Hmmmn.

Tricky.

IE doesnt work meaning an online one is difficult, as is downloading another.

There are virii that attack specific AV products so perhaps, if you possibly can, try and get hold of a different one...

tvrgit

8,483 posts

276 months

Wednesday 16th June 2004
quotequote all
what operating system have you got, and what AV product?

Some you can run a full AV scan from DOS, without opening windows...

Or:
boot into safe mode and run AV from there...

Or:
do you have a boot disk?

moleamol

Original Poster:

15,887 posts

287 months

Wednesday 16th June 2004
quotequote all
Right, I've avast, f-prot, f-prot for dos, antivir and Spybot S&D. None of them can find anything. Yet this ad is still here. The one that crashes the system.

IE has got to the point where I had to download Netscape to access the net. I used S&D to disable anything dodgy in the startup but one keeps coming back: A program called automove.exe which has the value Adstartup. IE seems to crash when it tries to connect to any ad sites(within a page). Netscape seems stable (surprise sursprise) but I need to know what is going on.

moleamol

Original Poster:

15,887 posts

287 months

Wednesday 16th June 2004
quotequote all
Is there an easy way to delete all temp files and temp internet files? Without it crashing

GlenMH

5,421 posts

267 months

Wednesday 16th June 2004
quotequote all
moleamol said:
Is there an easy way to delete all temp files and temp internet files? Without it crashing


You could try control panel then internet options - this doesn't then start IE explicitly...

Good luck!

Glen

malman

2,258 posts

283 months

Wednesday 16th June 2004
quotequote all
Try running Hijackthis from

www.spywareinfo.com/~merijn/downloads.html

Sounds like you might have bxxx5.dll loading somewhere.

Post the logs on one of the merijn forums or here and I'll take a look at it.

Neil

tvrgit

8,483 posts

276 months

Wednesday 16th June 2004
quotequote all
is it the same ad each time?

what is the pop-up program?

has it changed your ie home page?

I ask because i saw something similar on a friends pc, and had to use mcafee to get rid of the virus (forget what it was) and ad-aware to get rid of the trojan it had planted

moleamol

Original Poster:

15,887 posts

287 months

Wednesday 23rd June 2004
quotequote all
Cheers chaps. I saved all my stuff to DVD and decided to start again.

I done a soft format and then installed XP pro. I'm still having the problems . I can't find where to low level format from BIOS. Any way round it?

The homepage is now stuck at http://searchcentral.cc/index.php?v=4&aff=4424

malman

2,258 posts

283 months

Wednesday 23rd June 2004
quotequote all
Not sure what you mean by soft format. If its an IDE disk you won't find a format in the BIOS these days. Using the XP install disk you can remove the partition and recreate and then do a format (not quick) on the new partition then install xp. If you are using a recovery disk from some manufacturer then go for the one that sounds like you will loose all your data on your disk. Some have a sort of preserve data recovery.

Your real problem sounds like you have CoolWebSearch.
go here
www.spywareinfo.com/~merijn/downloads.html
and get cwshredder. Then run and do a fix. Take note of any versions it finds as you may need to do some manual removal.

rerun after fix to make sure

moleamol

Original Poster:

15,887 posts

287 months

Monday 28th June 2004
quotequote all
Malman, sorry I didn't reply earlier, I have been in Glastonbury. And some other place with elves and tunnels

Anyway, it seems you were spot on but the program will not get rid of it. It finds it, says it is getting rid. Then when I try again it says clean. When I reboot though it is back!

I don't mind reformatting but doing it from command prompt doesn't work. How do I properly format the disk? Or any other fix you may know of?

Cheers,

John

simpo two

91,604 posts

289 months

Monday 28th June 2004
quotequote all
I'm no expert, but it may be lurking in the registry and hence recreating itself each time.
searchcentral.cc certainly looks like spyware. At your discretion: Start/Run regedit CtrlF 'searchcentral' - keep hunting and see how many references you find.

malman

2,258 posts

283 months

Tuesday 29th June 2004
quotequote all
There will be an exe or dll loading that is putting the registry entries back in on reboot. If you post the hijack this log I might be able to spot it. You then boot to safe mode and remove the dll/exe then run the fix and that should do it unless you have the realyellow page variant which is a bitch to remove.

Sometimes running the fix when booted into safe mode gets better results.

If you want to (give in ) blank it and start again. Insert the XP CD and boot from it. select to repair the install but choose the recovery console you should then get a command prompt. help ill give you a list of commands. Format and fdisk are available from the prompt. format /? should show help on the format command.

Never used XP format but I'll guess

Format c: /u

will do it.

PS
hope you enjoyed glastonbury - looked a bit muddy. I've never been but I was there in spirit (while sat on nice leather sofa with cold beer in hand flicking channels between bbc2 and bbc3)

moleamol

Original Poster:

15,887 posts

287 months

Tuesday 29th June 2004
quotequote all
Right, I now seem to have got rid of CWS. It seems clean each time. The problem now is one Spybot picks up and is a Data Source Exploit problem. The following is the log

>> Edited by moleamol on Tuesday 29th June 17:35

moleamol

Original Poster:

15,887 posts

287 months

Tuesday 29th June 2004
quotequote all
My reply dissapeared then, strange. I'll try again.

I seem to have got rid of CWS but now have a DSO problem that spybot picks up on. The following is the log:

>> Edited by moleamol on Tuesday 29th June 17:35

moleamol

Original Poster:

15,887 posts

287 months

Tuesday 29th June 2004
quotequote all
wtf?!

moleamol

Original Poster:

15,887 posts

287 months

Tuesday 29th June 2004
quotequote all
wtf?!

malman

2,258 posts

283 months

Tuesday 29th June 2004
quotequote all
Oohh no you've broke the gassing station.

I think you've posted some HTML in your post try editing it out.

Descrambling what you have posted it looks like something has put some nasty sites in your trusted zones so that if you go there you won't get any security warnings from IE.

Right click IE then select properties, select the security tab then click on trusted site(big green tick) click on the sites button and see whats in there. remove anything that looks dodgy, obviously

Neil

PS nice delta. I hadn't seen one for ages then saw a really nice one in Newcastle the other day which started me thinking hmmm second car? . Few years back I came really close to buying an black EVO.

>> Edited by malman on Tuesday 29th June 17:25

>> Edited by malman on Tuesday 29th June 17:30

moleamol

Original Poster:

15,887 posts

287 months

Tuesday 29th June 2004
quotequote all
Right, I've taken out the log as it was that causing the problem. I had already checked there and there are no sites in the zone. Is there any chance I can email the spybot log to you so that you can take a look for me?

As for the Delta, of course you should get one as a second car! The nice ones are gorgeous and the good ones aren't as lemony as people try to make out. Besides, do you not like going fast when it's damp too?

Nice Cerby by the way, my next car when the money comes along

malman

2,258 posts

283 months

Tuesday 29th June 2004
quotequote all
email is in my profile - be my guest. I'll take a look when I get home

cerbs bust at the moment so I'm not going fast in the dry never mind the wet