J. Gibson said:
this seems to be a new exploit.. or, at least new to me..
my daughters got it .. and i'm not sure how to get rid of it..
the little sucker:
a) disables the task manager and tells you that it has been disabled by the
system admin
b) removes the "run" option from your start menu so you can't run msconfig
or stop the processes from loading
c)changes your homepage to
http://puzzlecircle.cm (if you want to roll the
dice, it's "com"
)<<<and "greys out the area ( tools, internet options)
(yes.. internet explorer) so you can't change it to anything else
d) it prevents your firewall from loading
this box has only norton now, but, was running spysweeper, zone alarm,
avast, and adaware personal when it was infected
You are probably going to have to clean this box up from a safe mode
boot. Until Dave or one of the other experts weighs in, this is what I
would do.
1) Since Zone Alarm, doesn't load, if you disable it, can you enable
the WinXP SP2 FW?
2) Which browser are you using? If IE is hijacked, perhaps you can
successfully install Firefox or Opera. If you do, disable everthing
including Java, Javscript, cookies, iframes, popups, etc.
3) Can you still get to your command prompt?
Start -> Programs -> Accessories -> Command Prompt
That does this.
%SystemRoot%\system32\cmd.exe
You should be able to do the same thing from Windows Explorer. Search
for msconfig.exe in your Windows directory and all of its
sub-directories. You should have a few copies.
3) Download and install SUPERAntiSpyware.
http://www.superantispyware.com/
4) Boot into Safe Mode (F8).
5) Run SAS, a couple of times.
6) Run SpySweeper and Ad-Aware also. Are their definitions up to date?
7) See Ian's page for more ideas, including Multi-AV.
http://ik-cs.com/v2/got-a-virus.htm
http://www.claymania.com/removal-trojan-adware.html
8) If you run HijackThis!, post the log(s) in one of the Web Forums
acceptable for such things. This is not one. Scroll to the bottom of
the a.p.s FAQ for the links.
http://shplink.com/misc/FAQ.htm
As I said, perhaps Dave or one of the other experts can point you
toward a specific cleanup tool or regimen.
BTW, how do you get away with two resident AV apps? Although it is
possible, it is not necessary, and generally causes more problems for
most people than it is worth.
Once you get this box cleaned up, you will want to change your setup.
Nothing worse than false security.
http://ik-cs.com/v2/
http://www.claymania.com/safe-hex.html
Ron