Really need computer help
 

Ok here's the deal, through no fault of mine something got installed on my computer. I have spent the last two days trying to fix it and have reached the stage where I don't believe I can do any further. This something is now popping up adds every 30 seconds or so. I have the following to fight it

Ad-Aware
My Virus detector
CWshredder
Spysubtract (with venus spytrap)
Hijack this

anyway I have got to the stage where Venus detects software attempting to change my hosts file configuration every 30 seconds or so. This is just as annoying since it stays on the top of my desktop and I have to deny every attempt. Apart from the hosts stuff (and I found the file) but do not have the confidence or knowledge to muck around with it. Every attempt has the following info

127.0.0.1 adwave.com EVENT: HOST:127.0.0.1

apart from adwave I also keep finding files named Drsmartload and such which I delete when I find. I am thinking I need to get professional help but I though I'd try you guys first (things always seem to go wrong on a friday so I have to go all weekend before I get help). I am appending a hijackthis log. I know gamespy or something has a bad reputation but I know that didn't cause it and I need it to play games (which I can't do now as the ^@#$#$% adds/change detector pops up every 30 seconds)

Re: Really need computer help
 

My god whatever you have... please don't spread it around. If you have done all of that and cannot find the problem then I would say that the software you used isn't doing what its suppose to be doing.

Try PestPatrol, or Stinger... let me the Stinger link... it looks for trojans and kills them. http://vil.nai.com/vil/stinger

I would also ditch your viruse protection and try using McAfee or even *shudder* Nortan. You can also do an on line scan using Pandasoft. http://www.pandasoftware.com/products/ActiveScan.htm

Good luck.

Re: Really need computer help
 

One thing, this pop up you see, is it like a windows messinger box? If so you will need to go to MS and find a way to turn that off. There is an internal messinger that adware ****ers have figured out how to tap into to cause pop ups. It took me a very long time to find out how to have it turned off. But MS has an instruction page on it.

Re: Really need computer help
 

If your anty-spyware isn't working you can try solve this by yourself.

Most of spywares, trojans, and other annoyances like bonus toolbars and popups, are just simple dynamic linked libraries (not always have .dll extension, but in fact they are .dlls). Usually can be found in /Windows or /Windows/System. Sort these dirs by modification date and look at latest modified files. If you find something like mfczzx.dll, glajfr.aux etc... that could be what you are seeking.
Deleting files from this dirs is a serious risk, so I suggest doing some backups http://forum.shrapnelgames.com/images/smilies/wink.gif

You can also try to run regedit and find what you've got in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
It's possible that links to some spywares are there.
(something like "Rundll32.exe strange.dll")

If everything fails... reinstalling system always helps.

Re: Really need computer help
 

What OS are you running? I'll assume it's XP sp2. But advice will work for sp1 and win2k also.

OK, Try a run with the MS antispyware program.
MS Downloads

You will have to have a legit install of your OS.

Then Turn off the messanger service.

Then replace your host file with the one attached.


I don't see a good AV program in your list. What are you running? Is it still updating?

Are your MS patches up to date?

I would also recomend that you switch to Firefox as a browser. Ver. 1.5 was just released. At the very least turn off the popups in IE.

Use safemode and MSConfig to controll what loads untill you get it fixed.

Re: Really need computer help
 

A couple of quickie things you can try. Go to windows "add/remove programs" and see if there's anything listed there that YOU didn’t install. Next go to the 'startup menu bar' and under "Set Program Access and Defaults" turn off your messenger service as already mentioned. Then do an [ctrl] + [alt] + [delete] and see if you notice any processes that are running you don’t recognize. Note: (You should always check this window and make a note of how many processes you normally have running.) Try downloading “Spybot Search and Destrroy it does a good job of finding problems before they start. Works well on anything you pick up too!

Good Luck and Good Hunting

Re: Really need computer help
 

One more thing, get a good firewall program. Can never be too safe these days.

Re: Really need computer help
 

That should read "good firewall appliance". Software firewalls are not enough. They are really only a second line of defense.

Re: Really need computer help
 

I'm starting to think that my buddies idea is one of the best things to do. Get yourself a cheap computer, basic CD/DVD burner, install basic OS and your ISP software. NO PERSONEL info at all... Make a copy of it on CD/DVD and your ready to go. It's now your firewall. You can later add any programs you need for on-line ventures. Your other computers AV software and spyware can protect itself from info burned to it or you can risk networking it (not recommended).

Re: Really need computer help
 

You also might want to post a Hijack This log report and info on what you have tried on DSL Reports and get advice from the experts there, if you can't fix it by doing what has been posted here.

Please do not suggest Norton again... that crap is more of a virus than what it tries to clean up...

Re: Really need computer help
 

If you have an old PC, you can make it into a nice firewall appliance. High end would be to load ISA server on it. But you can also do it for free with nix and one of the free nix firewall apps. Just add a second nic card and load the software, instant firewall. And old 500MHz PIII would work fine.

Re: Really need computer help
 

500 MHz is even overkill for that. http://forum.shrapnelgames.com/images/smilies/wink.gif

Re: Really need computer help
 

Ya, but with slower systems, you'll need high end nic's to get high bandwith.

Re: Really need computer help
 

Dunno if spybot's been sugested, but try that.

Re: Really need computer help
 

Norton always works for me. And if you don't like it (like me) you can just let it do it's work and uninstall it when you are done http://forum.shrapnelgames.com/images/smilies/laugh.gif

Re: Really need computer help
 

You can't uninstall Norton. It leaves a lot of junk all over your system. There are specialized utilities out there to disinfect your PC from Norton...

Re: Really need computer help
 

Thanks for all the help though I can't appear to fix the problem. I installed the MS antispyware program and it found a few things, also it blocks the same stuff as Venus spytrap. Anyway I'm afraid I don't understand how to stop messenger. When I installed MS antispyware there was some sort of messenger service that I stopped (not MSmessenger)and until I can work out that bit I'm not sure if it will be worthwhile replacing the hosts file as something seems to keep trying to change it which I can't find. As for my AntiVirus, I use Pccillin by Trend micro which updates a few times a day. I trust it but on this occasion what happened was that someone, who should have known better (not me), downloaded and opened something without thinking that it was malicious http://forum.shrapnelgames.com/images/smilies/mad.gif

Edit: incidentally, if it's any help I know exactly exactly what time it happened as I was walking past and shouted "What the hell did you do". I can search for files created at that time but don't know what to do with them.

Re: Really need computer help
 

Post a Hijack This log report and info on what you have tried on DSL Reports and get advice from the experts there.

Re: Really need computer help
 

I searched for files made that time and there are a few titled wiwm. I googled this and found it is an ad site.

Edit: ok i'll ask the experts

Re: Really need computer help
 

Here's a link to a page describing Window's services, which one's you ought to disable, and how to do it. {web page} You'll find the Messenger Service is one on that list. Usually, Windows XP Service Packs disable the Messanger Service, but you might want to poke around anyway.

Re: Really need computer help
 

I think I managed to turn off the right one then, as it said the sp automatically turns it off.

Re: Really need computer help
 

Thermodyne, should I really replace my hosts file with yours?. Mine is only 2kb and yours is 263kb.

Re: Really need computer help
 

Thermo's looks to be blocking a lot of malware and ad server domains.

If you install Spybot (best anti-spyware), you can usually lock out the hosts file from further changes.

Re: Really need computer help
 

It blocks a lot of malware sites. Which helps to protect you from their loader programs and the redirects that result. Down side is that a lot of adds on respectable sites wont load. http://forum.shrapnelgames.com/images/smilies/happy.gif Which is fine by me!

Re: Really need computer help
 

When you say it blocks the site do you mean nothing happens or that a message pops up?, because my software spots each attempt, but the message is as annoying as the ads. Anyway I just installed sp2 (yeah I know my fault for not doing it before) and I'll try spybot. I should point out some of the adds are just an ad in the middle of my screen and others opens a new browser window to their website. I think I'm actually getting somewhere though. If I fail I can at least tell my self I did everything I could.

Edit: I don't know is this is funny or not, but sp2 was blocking spybot from being downloaded http://forum.shrapnelgames.com/images/smilies/smile.gif

Re: Really need computer help
 

I tried changing the host file like thermodyne said but it didn't fix it and now spytrap finds all the sites in the new hosts file changing. I ok those sites (by which I hope I am ok'ing blocking them)

Re: Really need computer help
 

Ok, so how would I take an old PC and turn it into a server or what not that my other PC's use to access the web? I was thinking about leaving it one all the time to host files and what not.

Re: Really need computer help
 

I would remove all of the spyware programs except the MS beta. They often don't play well togeather.

Here is a link to some new MS beta tools.
Tools
I have not had time to try them yet.

Check the following regestry key, and remove anything you find in it.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\BrowserHelperObjects\

Re: Really need computer help
 

Well first you need to decide if you want a firewall or a file server. The firewall should be just that and nothing else. You could also use it for web page caching or DNS caching with no loss of security.

All you need is a decent PC with two nics. Decent does not mean some POS the wasn’t reliable three years ago when you put it out in the barn.

Set the external nic to address by DHCP and hook it up to your cable/DSL modem. Set the other nic to your internal (local) address and hook it to your switch. This address is now your gateway and will be set on all of your clients. If you want, you can set up a DHCP server on the box and automatically address your workstations. But with less than 10 systems, it’s more work than it’s worth.

The best free firewall with balls is the one in FreeBSD. Just load FreeBSD (DL it) and then make some changes to the kernel and you have a firewall as good as a Sonicwall or PIX. It’ll block everything as installed so you’ll need to enter some filters, and because it’s nix, it’s all done from a cmd prompt. Here is a link with how to set it up and what filters to add.
FreeBSD firewall setup



With that said, ISA server from MS is a lot more user friendly and just as good. But you will have to pay something for it and the Server install that it runs on. If you are going to the uni, then you might be able to get it cheap.

Re: Really need computer help
 

OK, I understand POS. I generally throw that stuff out. [img]/threads/images/Graemlins/icon25.gif[/img]

What would be minimum requirements for a "decent PC" AND what is a "nic"? [network interface card] http://forum.shrapnelgames.com/image...s/confused.gif I'm confused when it comes to abbreviations, please humor me.

Re: Really need computer help
 

NIC = Network card

I would say 500MHz with 128megs of ram and an low use hard drive.

But you could make due with any pentium class processor and 64megs of ram. Old hard drives die, so using one in a 24/7/365 system is asking to rebuild it. And a 20 gig is like $35 these days.

Re: Really need computer help
 

I have an old PII 333 with 384meg of RAM. Would that work?

Re: Really need computer help
 

Yep

Re: Really need computer help
 

Personally, I'd remove everything but Spybot...

Re: Really need computer help
 

This is the sort of thing that makes me very happy that I'm the only one who even touches my computer.

Sorry I can't offer any assistance, but while I'm not computer illiterate, I'm also not as skilled as the other people here obviously are.

Re: Really need computer help
 

I agree, I have Spybot-S&D and it found viruses and trojans that NAV missed. I know, NAV! BUT as mentioned already, once norton is on your computer it'll take a hard drive crash to get it off. http://forum.shrapnelgames.com/images/smilies/Sick.gif
I too am really happy I don't need to setup different users on my computer. I know a few people who have the whole family on it and the computer spends more time down then running. Viruses don't seem to care about who's using the damn thing, they just wreak havoc on the whole system.

Re: Really need computer help
 

Symantec now provides a Norton removal tool on their web site, though it is buried very deeply...

Re: Really need computer help
 

Spybot and Pestpatrol don't like each other but they do work well in combination with one another.

Re: Really need computer help
 

Yeah. It took me a long time to find it!

Re: Really need computer help
 

I had to do it the hard way... line for line in the Registry.... that was an utter nightmare.

So why don't people like Nortan? For me its a resource hog and mostly likely creates is own virus in order to justify its existence.

Re: Really need computer help
 

Norton, back in the day was good. Since ohh 2002 or somewhere around there they lost their way, the software got bigger and it got hit by EA syndrome - Producing a new version every year just for the sake of it, not because their are new features.

As a result of that they have to do new things and integrate with everything just to justify the new version. To force people to get the new version they also don't release virus updates for the old editions.

That is why I don't like Norton. However AT you should take less caffine (of whatever you take http://forum.shrapnelgames.com/images/smilies/wink.gif) because no virus firm is going to make viruses. That is just ridiculous.

Re: Really need computer help
 

So what is a good solid alternative to NORTAN? And yes, I will bet that if they don't make the viruses themselves, they are still behind who does.

Re: Really need computer help
 

Free:

http://www.grisoft.com/

Paid:

http://www.grisoft.com/


Also, it should be pointed out that McAffee AV has slumped as low as Norton AV these days...

Re: Really need computer help
 

I use AVG (the grisoft boys finest free edition) and it works OK, picked up a couple of viruses which I got through my own stupidity so seems to do the job. And it's free. Result!

Viruses are made for a whole variety of reasons, you don't need to be 'behind' someone to make them do it. From professional scammers to extortionist to bored kids viruses will be written, why get involved?

Re: Really need computer help
 

I use a version of McAfee (Network Associates) provided by my school that works quite nicely.

Re: Really need computer help
 

Well I must thank everyone very much for their help, especially the direction to dsl. I reccomend them to any one with a similar problem as I found them extremely helpful. I just hope I never have to talk to them again http://forum.shrapnelgames.com/images/smilies/happy.gif