Spyware problem [XP Laptop]

MikeFold · 03-04-2004

OK..been working on this for hours and I can't find the root of this problem on the boot. I am not that familiar with XP

I quarantined the files with ad-aware...but on a reboot they just reload again. I have found who originated it, but I still don't know how the cockholster did it.

It appears to have disrupted and exploited Media Player..

When I launch explorer, it defaults to
res://mshp.dll/index.html 23658
[his porn search affiliate code revealed his identity]

I have to get some sleep, so if anyone knows what i am experiencing and has a remedy, i would be grateful.

Thanks,
Fold

Mike AI · 03-04-2004

OldFold - I just sent this to Ed, he is online. He is out #1 tech guy!

Edd · 03-04-2004

Fold - not entirely sure what sort of nasty-ass bug you've got there... But I do have an idea for ya -

http://www.pchell.com/support/lookfor.shtml

I know that by DEFAULT, XP probably has the "system restore" function turned on.... You'll have to turn it off (its in the "System Information" section of your Control Panel) and follow their instructions on the website to remove the evil hack :grrr:

MikeFold · 03-04-2004

Thanks Mike...
Edd...The system restore was not clicked [it was off]
I never accessed so i did not even know it existed.

Its nasty.....
It actually runs a process that blocks view source/makes the double click on your main screen inoperative [can't open anything via the desktop or the start menu]

I have found some stuff, reloaded Media Player [i noticed in the Zone Alarm Log that the installed wmplayer.exe did not have an MS auth cert.
???????

Now Media Player works...gonna try and reboot again.
I have identified the offending dll, but as you know i can't just remove them...

Gracias

oh..i'm gonna check that site now.

doxdesk is a little behind

Last edited by MikeFold at Mar 4 2004, 03:21 AM

Hooper · 03-04-2004

http://www.apple.com/switch/

MikeFold · 03-04-2004

Edd..
That link looks good [promising]
I recognize some of that stuff it mentions
I am going to do it in the morning......

Thanks a bunch......

MikeFold · 03-04-2004

thanks hooper....

unfortunately, although i was brought up on a Mac, I have these things now.

idownload, is that your proggy?

Hooper · 03-04-2004

lol. j/k about the switch. some of those spyware programs are very evil. almost all run by idiots though.

yes idownload is my baby.

Bangwang · 03-04-2004

Hey Mike,

I have seen that exploit and adware didn't clean it..

But Spybot did http://www.tucows.com/preview/310138.html

Once you install spybot run the "Search for Updates" option,
then run "Search & Destroy" .

Questions give me a buzz...

bummer · 03-04-2004

hello mike

i have to agree with "bangwang" on using the "spybot search and destroy" program.

i have used "adaware" and "search and destroy". "Search and destroy" seems to find some stuff that "adaware" does not. keep the updates current and it will take care of most of your problems.

laterz.

Winetalk.com · 03-04-2004

Bangwang, is that you, Richard?

Almighty Colin · 03-04-2004

Quote:

Originally posted by Bangwang@Mar 4 2004, 03:17 AM
Hey Mike,

I have seen that exploit and adware didn't clean it..

But Spybot did http://www.tucows.com/preview/310138.html

Once you install spybot run the "Search for Updates" option,
then run "Search & Destroy" .

Questions give me a buzz...

I use both Spybot and Ad-aware too. The two of them together have knocked out everything I've seen. I miss Linux sometimes. As soon as i switched to Windows, I realized what a battlefield my PC was going to become.

MikeFold · 03-04-2004

Thanks to everyone.....
Richard, long time no see

The only fun part of this is playing Joe Sleuth and tracking down
where I picked it up.
6:17 p.m. yesterday my rundll32 was modified,

I am not this irked very often, but whoever dropped this on me
beware ....

and i will put the pieces together

[like this rectal cancer plug is gonna read oprano]

Dianna Vesta · 03-04-2004

Quote:

Originally posted by Bangwang@Mar 4 2004, 03:17 AM
Hey Mike,

I have seen that exploit and adware didn't clean it..

But Spybot did http://www.tucows.com/preview/310138.html

Once you install spybot run the "Search for Updates" option,
then run "Search & Destroy" .

Questions give me a buzz...

I love Spybot. Every morning I run Adware and Spybot. What a big difference.

AM Jeff · 03-04-2004

I use Spy Bot too.

Gotta love the way it even immunizes your computer from all known spyware out there too.

MikeFold · 03-04-2004

and the beat goes on.....

ran em both...[ad-aware & spybot]
both located a bunch of files--
looked like it worked initially...
opened google search page, searched for "porn"
and got a popup over the google results.....

launched a new browser, and there was the
res://mshp.dll/index.html#37049
again......
[nice looking page flying the microsoft logo]

MikeFold · 03-04-2004

OK...
It appears to be resolved

A program called CWShredder found 5 more files...
It is fast and quite efficient, but strictly for CWS hijacks.....

CWShredder

Thanks to all for the assistance...
Colin, how ya doing I am a MORON,?

Mike AI · 03-04-2004

Mike you have to be careful what you download. It is ashame, but the spyware wars are JUST starting. It is going to get uglier and uglier.

This is why I do not download anything off the web, and only install software I know that works. I am probably missing out on a lot of "Killer Aps" but my computer works.

MikeFold · 03-04-2004

Mike...
Thats whats scary....
I didn't download anything....
I have Spectorsoft [keystroke logger and screen caps every 04 seconds]
on the machine, I reveiwed the activities prior to this intrusion, and I did nothing.
There was an entry in Zone Alarm as well as Symantec logs that was wierd, and I am persuing that now....
I have the IP but am still deciphering all the tech jargon on those logs

Thanks again....quick learning curve

03-04-2004	#2
Mike AI Administrator Want to see your own Advertising Here! Join Date: Oct 2002 Posts: 11,618	OldFold - I just sent this to Ed, he is online. He is out #1 tech guy! __________________ Make big money on your Domains! Why wait 40 days to get paid with the other guys? Parked.com pays the most for your traffic, and cuts checks twice a month!

03-04-2004	#5
Hooper Members Join Date: Oct 2002 Posts: 1,156	http://www.apple.com/switch/ __________________ Quickbuck is paying $100 Per trial join.

03-04-2004	#8
Hooper Members Join Date: Oct 2002 Posts: 1,156	lol. j/k about the switch. some of those spyware programs are very evil. almost all run by idiots though. yes idownload is my baby. __________________ Quickbuck is paying $100 Per trial join.

03-04-2004	#9
Bangwang Members Join Date: Mar 2004 Location: California Posts: 6	Hey Mike, I have seen that exploit and adware didn't clean it.. But Spybot did http://www.tucows.com/preview/310138.html Once you install spybot run the "Search for Updates" option, then run "Search & Destroy" . Questions give me a buzz... __________________ SilverCash - Pornholio

03-04-2004	#11
Winetalk.com Prostate Examiner I quoff fine wine at corkd.com Join Date: Oct 2002 Location: good 'ole USA Posts: 21,018	Bangwang, is that you, Richard? __________________ why dogs sniff each other butts?

03-04-2004	#1
MikeFold Members Join Date: Oct 2002 Posts: 325	OK..been working on this for hours and I can't find the root of this problem on the boot. I am not that familiar with XP I quarantined the files with ad-aware...but on a reboot they just reload again. I have found who originated it, but I still don't know how the cockholster did it. It appears to have disrupted and exploited Media Player.. When I launch explorer, it defaults to res://mshp.dll/index.html 23658 [his porn search affiliate code revealed his identity] I have to get some sleep, so if anyone knows what i am experiencing and has a remedy, i would be grateful. Thanks, Fold

03-04-2004	#3
Edd Members Join Date: Oct 2002 Location: Deadwood, you Cocksucker! Posts: 833	Fold - not entirely sure what sort of nasty-ass bug you've got there... But I do have an idea for ya - http://www.pchell.com/support/lookfor.shtml I know that by DEFAULT, XP probably has the "system restore" function turned on.... You'll have to turn it off (its in the "System Information" section of your Control Panel) and follow their instructions on the website to remove the evil hack :grrr: __________________ You can't just cut the throat of every Cocksucker who's character it MIGHT improve!

03-04-2004	#7
MikeFold Members Join Date: Oct 2002 Posts: 325	thanks hooper.... unfortunately, although i was brought up on a Mac, I have these things now. idownload, is that your proggy?

03-04-2004	#10
bummer Members Join Date: Oct 2002 Posts: 25	hello mike i have to agree with "bangwang" on using the "spybot search and destroy" program. i have used "adaware" and "search and destroy". "Search and destroy" seems to find some stuff that "adaware" does not. keep the updates current and it will take care of most of your problems. laterz.

03-04-2004	#15
AM Jeff Members Join Date: Mar 2004 Location: Louisville, Ky Posts: 227	I use Spy Bot too. Gotta love the way it even immunizes your computer from all known spyware out there too. __________________ Need a sweet deal on advertising on Oprano?? Hit me up on ICQ. 9078231 or PM me.

03-04-2004	#17
MikeFold Members Join Date: Oct 2002 Posts: 325	OK... It appears to be resolved A program called CWShredder found 5 more files... It is fast and quite efficient, but strictly for CWS hijacks..... CWShredder Thanks to all for the assistance... Colin, how ya doing I am a MORON,?