I'm Not Always This Clueless, But(A Thing That Loads When I Sign-On)

[Michael A.]

I have NAV Professional Edition. Update my DAT files and do full virus
scans (comes up "zero" viri each time) often.

For the past 6 months I have this horrific "thing" that starts loading
programs--not visible on my screen, but "there" according to Task
Manager-- the instant I sign-on to the Internet. One porno program
after another. I can make them end (til the next one loads) by hitting
End Task but I find this horrendously invasive.

I posted this Prob to this Board many months ago and the (consensus)
cure was go to MS website and follow instructions for Removal of this
"non-virus virus".

Here's where the clueless part comes in: I did so (followed link to
Microsoft page) but for the life of me could not follow a step by step
Removal procedure. Apparently this thing--whatever it is--was more of
a problem a few years ago and any Removal "tool" or instructions seem
to be over my head.

I tried calling my ISP for tech advice, but the guy said "it's not an
NAV problem (or solution)" and "might be" related previously DL'd
KaZaa files. He suggested I Uninstall KaZaa and see if that solves
things upon Reboot.

I have no problem with that--haven't even accessed KaZaa for a long
time--but I did not get that advice here when I previously posted.

As stated, I'm outraged at this invasion and outraged too that even if
not "technically" a virus that NAV does not have what (for most) would
seem to be a basic removal or quarantine tool.

What is it if not a virus per se?

Is there a Removal link--perhaps other than the Microsoft page though
I'll try that again if I must--that dumbs it down for me?

Thanks as always and sorry for the repetition.


PS--After about 50-75 "End Tasks" this loading thing just stops on its
own, only to return about 30 mins later or upon the next time I go
online.

 

[Heather]

It very well could be a browser hijacker.......or Cool Web Search. Follow
the instructions below to see if it is a hijacker.......bearing in mind that
the spyware sites were under a DOS attack.

I would also suggest you get the CWS Shredder tool and run it with
everything closed. Try this first, and I will dig up a CWS site.....Tom
Coyote's site is down, so found the mirror for Hijack This. And the spyware
forum one is up at the moment.

OK......found a site where you can download CWS Shredder......it is at....
http://www.google.ca/search?q=cache...wareinfo.com/articles/cws/+CWS&hl=en&ie=UTF-8

But first try the Hijack This one.......

Go to: http://mjc1.com/mirror/hjt/

Download "Hijack This!" [freeware]

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save
Log" button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.

Let them decipher it for you.

Heather
___________________________________________

 

[Beauregard T. Shagnasty]

Quoth the raven named Michael A.:

I have NAV Professional Edition. Update my DAT files and do full virus
scans (comes up "zero" viri each time) often.

Ok. That's good.

For the past 6 months I have this horrific "thing" that starts loading
programs--not visible on my screen, but "there" according to Task
Manager-- the instant I sign-on to the Internet. One porno program
after another. I can make them end (til the next one loads) by hitting
End Task but I find this horrendously invasive.

You've lived with this for *six months* ?

I posted this Prob to this Board many months ago and the (consensus)
cure was go to MS website and follow instructions for Removal of this
"non-virus virus".

At best, MS would say... "check for malware..." Right?

Here's where the clueless part comes in: I did so (followed link to
Microsoft page) but for the life of me could not follow a step by step
Removal procedure. Apparently this thing--whatever it is--was more of
a problem a few years ago and any Removal "tool" or instructions seem
to be over my head.

Most removal tools are click-click...

I tried calling my ISP for tech advice, but the guy said "it's not an
NAV problem (or solution)" and "might be" related previously DL'd
KaZaa files. He suggested I Uninstall KaZaa and see if that solves
things upon Reboot.

From what I've read, if you've got Kazaa, you've opened up your
computer to half the hackers on the planet. I don't have it.

As stated, I'm outraged at this invasion and outraged too that even if
not "technically" a virus that NAV does not have what (for most) would
seem to be a basic removal or quarantine tool.

NAV finds viruses. Not adware, not spyware, not (most) trojans, not
browser hijackers. It is an anti-virus program.

What is it if not a virus per se?

You need specific tools. You wouldn't take your Harley Davidson to the
Ford garage...

In addition to what Heather said, I'd probably run the tools in this
order:

Spyware Products. Get and run both they are free).
Spybot Search & Destroy: http://www.safer-networking.org/
AdAware: http://www.lavasoftusa.com/software/adaware/
Be sure to get the latest updates after installation and before scanning.

Homepage hijacks with a search page are usually the CoolWebSearch
malware. It is very hard to get rid of. Try the solution - the
CWShredder. Read about it here:
http://www.spywareinfo.com/~merijn/cwschronicles.html
and download from here:
http://www.spywareinfo.com/~merijn/downloads.html

If the above don't cure the problem, get this program
http://www.net-integration.net/tools/hijackthis.html
and submit the results to their forum. This page will help non-novices
figure out on their own what the HiJackThis log indicates:
http://hjt.wizardsofwebsites.com/

Practice safe hex!
http://www.claymania.com/safe-hex.html

 

[Heather]

Well written, Sir Beau.......I was rushing out and didn't have time to find
all the adware info. Plus a few of the spyware forums are down due to a DOS
attack.......I will leave it to you to guess who is doing it, grin. Andrew
(Merijn) and others are putting Hijack This and CWS Shredder up on alternate
sites and I poked around a bit to find him one.

I believe one called 'computercops' is still working as well. Have not
checked today.

OH.....and there is a tool to totally remove that blasted Kazaa and it is on
the Major Geeks website, along with AdAware, Spybot, Hijack This and
CWS......found it the other day for one of the MS n.g's.

If anyone wants Kazaa Lite (no spyware or viruses), it can be found on the
Old Versions site.... www.oldversion.com Personally, I use WinMX and have
done so for 3 years. No spyware with that one. Or viruses. But I am just
downloading music......not programs.

Cheers......Heather

 

[kurt wismer]

Heather wrote:
[snip]

If anyone wants Kazaa Lite (no spyware or viruses), it can be found on the
Old Versions site.... www.oldversion.com Personally, I use WinMX and have
done so for 3 years. No spyware with that one. Or viruses. But I am just
downloading music......not programs.

i guess you've probably heard the CRIA is trying to crack down on that
the way the RIAA was doing in the states...

 

[Beauregard T. Shagnasty]

Quoth the raven named Heather:

Well written, Sir Beau.......I was rushing out and didn't have time
to find all the adware info.

(shhhhhh... it's boilerplate.)

 

[Beauregard T. Shagnasty]

Beauregard T. Shagnasty replied to hisself:

Quoth the raven named Heather:


(shhhhhh... it's boilerplate.)

Speaking of... I just saw a link to another one that reads like it may
be a good addition to the toolbox. Does anyone know if this is a
worthy program?

http://www.xblock.com/download-freeware.shtml

 

[Heather]

Heather wrote:
[snip]

If anyone wants Kazaa Lite (no spyware or viruses), it can be found on

the Old Versions site.... www.oldversion.com Personally, I use WinMX and
have done so for 3 years. No spyware with that one. Or viruses. But I am
just downloading music......not programs.

i guess you've probably heard the CRIA is trying to crack down on that >

the way the RIAA was doing in the states...

Yes.......idiots!! I rarely download anything now as I have all I want.
But I noticed that a lot of them trying to download from me had zero songs
to share.......there are leeches, of course......but I think they are trying
to evade prosecution (should it ever come to that). I only share a couple
of subfolders.....not my main ones. And not many people want spanish
music.......(G). Other than Julio or Enrique Iglesias.

I really don't think the legislation will fly here.......and seems to be
failing in the US. Haven't checked on an mp3 ng for a long time. And I
never hear mine mentioned.....it is usually Kazaa.

Cheers.......Heather (nice weather today, eh?)

 

[Heather]

Quoth the raven named Heather:


(shhhhhh... it's boilerplate.)

Good......I will snitch it, grin. I was too busy trying to find a working
website for CWS and Hijack This......Tom Coyote's one is down. As are
Merijn's I think. I am pretty sure I know who is behind it, but prefer not
to say. Think 3 letters.....grin.

Heather

 

[Heather]

Beauregard T. Shagnasty replied to hisself:


Speaking of... I just saw a link to another one that reads like it may
be a good addition to the toolbox. Does anyone know if this is a
worthy program?

http://www.xblock.com/download-freeware.shtml

Hadn't heard of that one, but I could check with the spyware crowd. Who are
probably reading this........grin.

Heather

 

[Jan Il]

Heather,

Good......I will snitch it, grin. I was too busy trying to find a working
website for CWS and Hijack This......Tom Coyote's one is down. As are
Merijn's I think. I am pretty sure I know who is behind it, but prefer not
to say. Think 3 letters.....grin.

For additional information,

Siljaline posted these for me today in repsonse to a post on the AumHa
forums
----------------------------------------------------------------------------
----
http://www.merijn.org/downloads.html
http://www.merijn.org/files/CWShredder.exe
http://www.merijn.org/files/cwshredder.zip
http://www.spywareinfo.com/downloads/tools/CWShredder.exe
http://www.majorgeeks.com/download4086.html

The BTN on the Major Geeks seemed to the one working best. There are a lot
of other very good programs offered at this website.

Note: Not all the sites may be working due to a server flood, so keep
trying. SpywareInfo was down again, and Net-Integration is totally gone as
of yesterday because of the DoS attack.

Jan

 

[Geese_Hunter]

Quoth the raven named Michael A.:


Ok. That's good.


You've lived with this for *six months* ?


In addition to what Heather said, I'd probably run the tools in this

<snip>

And QUIT going to those porn sites, they will re infest your PC, faster
than you can say, "wow she's hot"
I hope you haven't had outrageous phone bills for the last 6 months

 

[kurt wismer]

Heather wrote:
[snip]

If anyone wants Kazaa Lite (no spyware or viruses), it can be found on
the Old Versions site.... www.oldversion.com Personally, I use WinMX and
have done so for 3 years. No spyware with that one. Or viruses. But I am
just downloading music......not programs.

i guess you've probably heard the CRIA is trying to crack down on that >
the way the RIAA was doing in the states...

Yes.......idiots!! I rarely download anything now as I have all I want.
But I noticed that a lot of them trying to download from me had zero songs
to share.......there are leeches, of course......

that's what programs like leech hammer and mxmonitor are for...

but I think they are trying
to evade prosecution (should it ever come to that).

it's my understanding they're aiming at the big sharers right now, so
yeah, that seems like a likely motivation...

[snip]

I really don't think the legislation will fly here.......

oh, i don't know... this is canada after all... dumber things have
happened... they say they don't recognize the decisions of the
copyright board as legally binding - i say they should give back all
the levy monies collected from the sale of blank recordable media then,
cause you can't have your cake and eat it too..

 

[Heather]

Thanks Jan.......just getting to my mail now. I will keep these for use
when needed. Btw......new SpywareBlaster update last night. I forgot to
hit send on my post, duh!!

What is "BTN"?? My brain is not working......just found out some major
painful dental work is in my future.....to the tune of $2,500!! All because
I bit down too hard on a Smartie.....thinking of suing the Smartie people.
8-(( If I lived in the US, I would probably win.......sigh.

Btw......if you would like to exchange some emails on graphic arts and
stuff, write me at my Hotmail address and I will send you my real one.

janeysmith60 at hotmail.com

Cheers, Janey (G)

 

[Jan Il]

Hey Heather,

Thanks Jan.......just getting to my mail now. I will keep these for use
when needed. Btw......new SpywareBlaster update last night. I forgot to
hit send on my post, duh!!

Got that one this morning first thing. Heh! I'm the one whose mouse gets
antsy and jumps on the send button too soon. ;-))

What is "BTN"?? My brain is not working......just found out some major
painful dental work is in my future.....to the tune of $2,500!! All because
I bit down too hard on a Smartie.....thinking of suing the Smartie people.
8-(( If I lived in the US, I would probably win.......sigh.

Ooohhooo...ouch! Dang...that happened to me with a piece of Krazy Korn.
Broke the whole side out of the tooth on top, and cracked the lower one.
Yeah....get you a good lawyer on this side of the border, you'll win big
bucks for sure. Might help pay for the upcoming to the UK. <G>

BTN....hmmm...not really sure there, it is a mirror download on the Major
Geeks site along with Planet Mirror and others, to keep important programs
such as CWShredder and other spyware/malware available. Maybe someone here
knows exactly what the site is. I got the link for Major Geeks from, IIRCC,
either PA Bear or Siljaline who both cover the AumHa forum too, when
Merijin's site and others were under attack. The whole wazoolie is available
there in one place, SpyBot, Adaware, Zone Alarm, AVG...you name it. Just
about everything you need in spy and virus ware. A one-stop-shopping kind of
place. Makes the reference links easier to keep track of for posts, too.
Especially at times like this, when so many sites going down or unavailable.

Btw......if you would like to exchange some emails on graphic arts and
stuff, write me at my Hotmail address and I will send you my real one.

janeysmith60 at hotmail.com

On it's way.....you know I can't resist GA stuff.

Jan

 

[Heather]

Heather wrote:
[snip]

If anyone wants Kazaa Lite (no spyware or viruses), it can be found on
the Old Versions site.... www.oldversion.com Personally, I use WinMX and
have done so for 3 years. No spyware with that one. Or viruses. But I am
just downloading music......not programs.

i guess you've probably heard the CRIA is trying to crack down on that >
the way the RIAA was doing in the states...

Yes.......idiots!! I rarely download anything now as I have all I want.
But I noticed that a lot of them trying to download from me had zero songs
to share.......there are leeches, of course......

that's what programs like leech hammer and mxmonitor are for...

Hi Kurt.......I read about those on the WinMX ng, but at that point had
most of the songs I wanted so didn't use leech hammer......I just nail them
when I catch them, grin.

[snip]

I really don't think the legislation will fly here.......

oh, i don't know... this is canada after all... dumber things have
happened... they say they don't recognize the decisions of the
copyright board as legally binding - i say they should give back all
the levy monies collected from the sale of blank recordable media then,

cause you can't have your cake and eat it too..

Fully agree, and I assume you saw the article in the Star this
morning......haven't had time to go over it yet, but I bet they are backing
off a bit.

Best.....Heather