Search results

M
Help removing "asksbar" that keeps reproducing itself in registry

It's adware - nothing dangerous. I know that, as recently as August, if it was on your system, Malwarebytes would nuke it.
- Medea
- Post #3
- Oct 17, 2008
- Forum: Security
M
Want to switch from SpyCatcher to Avira but warning

Isn't SpyCatcher an antispyware app? If it is, and not an antivirus app, then you can keep it and add Avira. You shouldn't have more than one AV unless you turn off the real-time protection on one of them, i.e., keep one AV with real-time protection activated and the second AV as an on-demand...
- Medea
- Post #2
- Jul 31, 2008
- Forum: Security
M
DNS Exploit in the Wild

DNS Cache Poisoning Public Exploit Code Available
- Medea
- Post #173
- Jul 25, 2008
- Forum: OT Discussion Club
M
EXPLOIT/VIRUS ALERT! NO JOKE! NO HOAX!

DNS Cache Poisoning Public Exploit Code Available
- Medea
- Post #3
- Jul 25, 2008
- Forum: Security
M
postcard.exe/ali.exe trojan

masterosok - If you want assistance in cleaning your computer, PM me.
- Medea
- Post #4
- Jun 9, 2008
- Forum: Security
M
every internet connection downloads a trojan

Well, since hardware is not my forte, I can only pass on what I just recently read from a very reputable source. This exploit is different from not having changed the pw. cubby1223's symptoms, especially the 'hacked to' DNS beginning with '85.' are signs of the newest exploit. I did some...
- Medea
- Post #10
- Jun 8, 2008
- Forum: Security
M
every internet connection downloads a trojan

As it stands now, on Linksys routers, to avoid the exploit, set UPnP to 'DISABLED'. Even though you only posted '85' as part of the DNS entry that you cleared out, I'd bet money that the second set of numbers was 255, i.e., '85.255.xxx.xxx which are InHoster servers. Wareout, which is a DNS...
- Medea
- Post #8
- Jun 7, 2008
- Forum: Security
M
every internet connection downloads a trojan

Edited Just read about this, so forget my earlier post. You've got a brand new nasty there. AFAIK, you get infected with this if you have a Linksys router with upnp turned on and get hit by an exploit. Two ways to fix it are to hard reset the router (use the magic button on the back)...
- Medea
- Post #6
- Jun 7, 2008
- Forum: Security
M
Computer desktop changes and browser re-directs

Rottie - PM me your friend's HJT log.
- Medea
- Post #6
- May 26, 2008
- Forum: Security
M
Desktop taken over?

Unfortunately, you haven't "cleaned it all out" if you have to add the word "but"... Post a HJT log and let's see what crap managed to get onto your system.
- Medea
- Post #3
- May 23, 2008
- Forum: Security
M
Computer desktop changes and browser re-directs

If you want assistance in cleaning your system - yes, it is infected - PM me a new HJT log. I missed your thread and just read it. The reason I'm asking for a new HJT log is that I want to see the most recent log rather than one that is two days old.
- Medea
- Post #3
- May 21, 2008
- Forum: Security
M
Antispy Spider removal

It's a rogue program, and it does affect the Task Manager and regedit. PM me her HJT log and I'll be happy to take you through the steps. I'm surprised that she hasn't experienced one of the symptoms which is that her IE will randomly open pages to Russian sites.
- Medea
- Post #6
- May 21, 2008
- Forum: Security
M
Need help bad on my wifes laptop

Your HJT is really outdated. The newest version is 2.0.2 and will provide much more info. Download it and post back. I do see an infection, but too much info in the old HJT version is missing. BTW, you can keep both AV's, but you must disable the real-time component of one AV, keeping it...
- Medea
- Post #4
- May 20, 2008
- Forum: Security
M
CPU spiking issue

I don't see anything that's really bad - just the O4. Make sure hidden files/folders is enabled. Boot into Safe Mode. Run HijackThis, click O4 - HKLM\..\Run: [scroller] fpapli.exe and click 'Fix checked.' Delete C:\WINDOWS\system32\fpapli.exe Reboot into Normal Mode. Download...
- Medea
- Post #2
- May 19, 2008
- Forum: Security
M
XP crashes 1 minute afer booting

There's not a whole lot of info yet on problems installing XP SP3. The biggest problem people run into is not turning off AV's and AS w/active protection/guard when they start installing SP3. The best way of doing it would be to d/l SP from...
- Medea
- Post #3
- May 19, 2008
- Forum: Security
M
virus attack trend ???

The reason for the increase? MONEY The link below is an article in the Washington Post that's two years old. Make a note of what he was making two years ago.... Invasion of the Computer Snatchers
- Medea
- Post #9
- May 11, 2008
- Forum: Security
M
virus attack trend ???

Nope, not by the number of increase in people looking for help with infected systems and are posting HJT logs. If anything, the number of infected systems is increasing.
- Medea
- Post #6
- May 9, 2008
- Forum: Security
M
My computer's desktop background can't be changed.

Sometimes smitfraud messes with the desktop so try the following: Control Panel > Display > Desktop tab > Customize Desktop > Web tab Only thing that should be there is "My Current Home Page" - anything else, delete it.
- Medea
- Post #3
- May 9, 2008
- Forum: Security
M
Spyware/virus that's blocking my main port..

Hans - There can be some whack downloaders out there. The following is a Vundo downloader that you'd see in the running process in a HJT log (the CLSID is always random): C:\Program Files\Common Files\{B0F6B85A-03A4-1033-1119-020207100001}\Update.exe In this case, you have to delete the...
- Medea
- Post #7
- May 7, 2008
- Forum: Security
M
Spyware/virus that's blocking my main port..

You can still have a downloader on your system which just downloads everything back that you removed.
- Medea
- Post #4
- May 5, 2008
- Forum: Security
M
Completely baffled by this IE/FF/Opera browser error....

Hi - Forget that - poor choice of wording. I was just suggesting that you don't have to post what changes you've tried but, rather, just call your ISP and ask for tech support. Explain what you did and maybe they can be of some assistance.
- Medea
- Post #14
- Apr 18, 2008
- Forum: Security
M
Completely baffled by this IE/FF/Opera browser error....

Your log looks clean. You need to update Java because the one you have is out of date. One thing that I noticed is that you mentioned your router. The O17 in your log looks like you have it set up correctly. However, what is confusing to me is that in your HJT log you have your R1, which...
- Medea
- Post #12
- Apr 17, 2008
- Forum: Security
M
Completely baffled by this IE/FF/Opera browser error....

Last step is to try: Go to Start > Run > type: cmd A DOS window will appear. Type in the DOS window: netsh winsock reset Press Enter. Reboot your computer. If you're still having problems, post a HJT log.
- Medea
- Post #9
- Apr 17, 2008
- Forum: Security
M
Completely baffled by this IE/FF/Opera browser error....

Try walking through the following two steps. ? You may want to flush your dns to clear it: - Go to Start > Run > and copy/paste: ipconfig /flushdns - Click OK. ? Please download HostsXpert 4.2 - Hosts File Manager - Create a new folder: C:\HostsXpert - Unzip the file to C:\HostsXpert...
- Medea
- Post #7
- Apr 17, 2008
- Forum: Security
M
Quarantined Cable Modem

I agree with the replies including mech's advice not to run as an administrator which I wholeheartedly agree with. Also, an ISP will scan email for malware and will either delete the attachment if that's where it's located or the content of the email itself. Given the amount of spamming with...
- Medea
- Post #12
- Apr 6, 2008
- Forum: Security
M
Quarantined Cable Modem

You probably had a few instances of malware getting on your system. Obviously, what you have for protection nuked it, but it was saved by System Restore first. It's not a big thing. It can't run from there. I've got a problem with your ISP disconnecting you because you 'had a trojan...
- Medea
- Post #8
- Apr 4, 2008
- Forum: Security
M
Need Help Getting Rid of Spyware

Yep, you're infected, and you can't clean it by deleting a couple of files. It can be cleaned. If you want help, PM me.
- Medea
- Post #2
- Mar 1, 2008
- Forum: Security
M
Possible Virus that nothing caught?

Sounds good to me. That website links to Avira AntiVir® which I'm sure you'll like. I haven't played around with Free Online Armor yet. However, I've only heard good things about it, and a couple of people whose opinions I respect swear by it. BTW, when you format, take a look at...
- Medea
- Post #9
- Mar 1, 2008
- Forum: Security
M
MSN and Offermanage

@ Chronoshock - you're getting the service Messenger confused with MSN Messenger. @ Imp - I think it's unlikely that you have an infection spread by MSN Messenger. First of all, you would have had to received one of those messages and had to have clicked the link contained in the message...
- Medea
- Post #3
- Feb 29, 2008
- Forum: Security
M
Possible Virus that nothing caught?

Either go through cleaning your system or formatting. Whichever you're going to do, do it now - do not wait until the weekend. If you really don't have the time, disconnect from the Internet until you format and reinstall. That file is a username and password stealer...
- Medea
- Post #7
- Feb 28, 2008
- Forum: Security
M
need help getting rid of spyware

If you still need help, give me a PM. Also, don't update to SP2 until your system is clean. Otherwise, you'll get BSOD'd to death. See here for how you got infected: http://www.sophos.com/virusinf...alyses/w32tibickc.html Click the "Advanced" tab.
- Medea
- Post #4
- Feb 26, 2008
- Forum: Security
M
Found a new trojan on pc , not on virus list

FYI: SmartWhois youcantseeus.servebeer.com (66.154.86.86) 66.154.0.0 - 66.154.95.255 Cyber Wurx LLC 12430 Tesson Ferry Rd St Louis, MO US Network Operations Center routing@cyberwurx.com +1-404-681-9888 66.154.86.64 - 66.154.86.127 Basin Creations 817 W. Peachtree St, NW...
- Medea
- Post #3
- Feb 25, 2008
- Forum: Security
M
question about hijackthis report

FYI, in the future, if you should scan and see something like what you had, i.e., C:\SYSTEM VOLUME INFORMATION\_RESTORE{84B2F8B5-0BBB-4B74-8477-BD56095E0BD8}\RP170\A0016657.EXE, this is from a restore point. It's not active unless you restore the restore point where it's located. All you...
- Medea
- Post #8
- Feb 20, 2008
- Forum: Security
M
Pop-up message indicates virus infection?

Well, the file tracks usage. The file was probably originally set to start on bootup under a Run key, i.e.: O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\" My guess is that the file may have been deleted or become corrupted, but...
- Medea
- Post #4
- Feb 16, 2008
- Forum: Security
M
Zlob(puresafteyhere.com)

Yep, you've got malware, some of it nasty, on that system - including Zlob which means you have a smitfraud infection. What I don't like is that you also have a backdoor bot. Can you clean your computer? It's likely. However, if it were my computer, I'd format and reinstall. Once a...
- Medea
- Post #7
- Feb 14, 2008
- Forum: Security
M
Whats the best antivirus/antispyware program?

I agree that AntiVir is one of the top free AV available. :thumbsup: A word of caution: Don't forget that the Bagel Worm has backdoor functionality. Make sure you've changed all of your passwords of sensitive websites. Some info on it: http://www.f-secure.com/v-descs/bagle.shtml...
- Medea
- Post #12
- Jan 31, 2008
- Forum: Security
M
Very Abnoxious Popups

There's a nasty variant of Vundo out there now, and it's spreading rapidly. It makes prior Vundo variants a walk in the park. Why don't you post a HJT log?
- Medea
- Post #3
- Jan 27, 2008
- Forum: Security
M
An undetectable malware, how to effectively remove from the system.

Good point..:laugh:
- Medea
- Post #6
- Jan 25, 2008
- Forum: Security
M
An undetectable malware, how to effectively remove from the system.

Big ditto, here. Battousai001, mech's point was was the first question I had when I read your post, i.e., why isn't your friend's IT Dept. working to fix this? Anyway, just telling us that "SCVHSOT.EXE" is on your friend's computer doesn't provide enough information. It can be a backdoor...
- Medea
- Post #4
- Jan 25, 2008
- Forum: Security
M
Update your Sun Java Runtime

Can also get it here without having to answer questions. Majorgeeks immediately updates when a new update is released, so you can always use this url: http://www.majorgeeks.com/Sun_...Environment_d4648.html
- Medea
- Post #20
- Jan 20, 2008
- Forum: Security

RESOURCES

Top Bottom