Virus in computer
Vivek
browser other than IE. Whenever I open firefox, i get a window which
says "USE INTERNET EXPLORER YOU DOPE" as the title and the message
says "I DNT HATE MOZILLA BUT USE IE OR ELSE..." . I am having NIS 2006
but it is not able to detect the virus... Please help me....
squaredancer
generate the following:? :
click properties
click links tab
what does the "Target" field say? It should be N:\pathto\firefox.exe (N
is your drive letter)
click the button [Find Target] .... where does it take you? should
be to the FF-folder and Firefox.exe
let us know what you get when you try all that!
reg
Vivek
Well.. it does not allow me to see that.. the moment the properties
window opens the same msg box comes up closing the window.... :-(
Nir
> Well.. it does not allow me to see that.. the moment the properties
> window opens the same msg box comes up closing the window.... :-(
>
do you get same problem if you try to run firefox by directly double
clicking on firefox.exe file ?
Vivek
msg box virus comes immediately closing the window..
Ok.. I opened it when the msg box was open and then I was able to
see.. It is "C:\Program Files\Mozilla Firefox\firefox.exe"
Terry R.
If you can access the internet download Spybot Search & Destroy and run
the updates after installing:
http://www.safer-networking.org/en/download/index.html
AND Ad-Aware Free Version and run the updates after installing.
http://www.lavasoftusa.com/download_and_buy/product_comparison_chart.php
You may have to do that from the Windows Safe Mode with Networking.
Report back,
--
Terry R.
Anti-spam measures are included in my email address.
Delete NOSPAM from the email address after clicking Reply.
goodwin
> On 4/23/2007 11:47 AM On a whim, Vivek pounded out on the keyboard
>
>> I am not able to do that... The minute the properties window opens the
>> msg box virus comes immediately closing the window..
>> Ok.. I opened it when the msg box was open and then I was able to
>> see.. It is "C:\Program Files\Mozilla Firefox\firefox.exe"
>>
>>
>
> If you can access the internet download Spybot Search & Destroy and run
> the updates after installing:
> http://www.safer-networking.org/en/download/index.html
>
> AND Ad-Aware Free Version and run the updates after installing.
> http://www.lavasoftusa.com/download_and_buy/product_comparison_chart.php
>
> You may have to do that from the Windows Safe Mode with Networking.
>
> Report back,
>
If OP can't run FF, he may have a problem with spybot as well unless
malware is FF specific...
Terry R.
That's why I suggested Safe Mode. Many times it will run that way.
Otherwise he may have to download the files from another computer and
transfer them.
goodwin
> On 4/23/2007 1:23 PM On a whim, goodwin pounded out on the keyboard
>
>> On 4/23/2007 12:24 PM Terry R. opined:
>>
>>> On 4/23/2007 11:47 AM On a whim, Vivek pounded out on the keyboard
>>>
>>>> I am not able to do that... The minute the properties window opens the
>>>> msg box virus comes immediately closing the window..
>>>> Ok.. I opened it when the msg box was open and then I was able to
>>>> see.. It is "C:\Program Files\Mozilla Firefox\firefox.exe"
>>>>
>>>>
>>> If you can access the internet download Spybot Search & Destroy and run
>>> the updates after installing:
>>> http://www.safer-networking.org/en/download/index.html
>>>
>>> AND Ad-Aware Free Version and run the updates after installing.
>>> http://www.lavasoftusa.com/download_and_buy/product_comparison_chart.php
>>>
>>> You may have to do that from the Windows Safe Mode with Networking.
>>>
>>> Report back,
>>>
>> If OP can't run FF, he may have a problem with spybot as well unless
>> malware is FF specific...
>
> That's why I suggested Safe Mode. Many times it will run that way.
> Otherwise he may have to download the files from another computer and
> transfer them.
>
sigh..
50 quatloos says we don't find out.
Vivek
ran a check with both. No spyware found by any of them. Firefox works
fine in safe mode. I rebooted the computer and tried to run firefox
and i get the same virus..... :(( I don't know what to do.. Please
suggest something.. No antivirus sites have any mention of such a
virus..!! even firefox site is not having any mention of this kind of
problem. One more thing I would like to add, even one of my friend has
the same problem, so it is not problem with my computer.
Tony Raven
Did you download firefox and all your extensions from the Mozilla
website or elsewhere?
--
Tony
"The most savage controversies are those about matters as to which there
is no good evidence either way."
- Bertrand Russell
Vivek
I installed Spy-bot and Ad-aware and ran a spyware check in safe mode.
Firefox opens in safe mode without any problem. But when I boot to
normal mode same error. Another thing is.. the virus comes up even
when I open the Firefox folder i.e C:\Program Files\Firefox folder in
explorer...!! My friend is also having same problem, so it must be
some problem in firefox only..... Please help.... Urgent...
Thanos
> I installed spy-bot, also lavasoft adaware. I booted to safe mode and
> ran a check with both. No spyware found by any of them. Firefox works
> fine in safe mode. I rebooted the computer and tried to run firefox
> and i get the same virus.....
Can you access the Windows Task Manager? If yes go to 'Processes' tab
and search there for anything strange. If not sure check for each
process you see in google.
Something else you could try is to see if something strange is loaded
when windows startup.
Start \ Run \ (type) msconfig
Go to 'Startup' tab and search for anything unfamiliar.
goodwin
<snip>
>
>
>
> I installed Spy-bot and Ad-aware and ran a spyware check in safe mode.
> Firefox opens in safe mode without any problem. But when I boot to
> normal mode same error. Another thing is.. the virus comes up even
> when I open the Firefox folder i.e C:\Program Files\Firefox folder in
> explorer...!!
This would indicate a problem with your computer/windows, to me anyway.
FF has nothing to do with file management - it seems to be the target.
My friend is also having same problem, so it must be
> some problem in firefox only..... Please help.... Urgent...
>
did you and your friend have any recent email communication??
I googled the msg you are getting and came up with squat - its maybe
brand new malware.
Try shutting down windows messenger service and see if that stops it -
it may be coming in from outside...
squaredancer
generate the following:? :
"into" the OPs computer, only a re-install of FF may solve - but if a
*.dll has been implemented someplace, only a system reset to before the
trouble started will clean it!
SpyBot has an Advanced mode (main menu>>mode) that can be set to look at
system files - also the Startup list can be looked at and modified there!
reg
Thomas Aeschbacher
Hash: SHA1
squaredancer schrieb:
You could also use "hijack this" to analyse your pc:
<http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php>
- --
***Gewalt ist das Mittel des geistig Schwachen***
http://www.board.swizz-elite.ch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGLmsTRZ1UX/kP4pMRAu+vAJ0XvGaVPtTCzk11PdSsacwlLw1sYQCfYE5+
8I8rtU+vMcg6FrNy4xAE7Ek=
=a/eq
-----END PGP SIGNATURE-----
goodwin
> On 24/04/2007 20:36, CET - what odd quirk of fate caused goodwin to
> generate the following:? :
>> On 4/24/2007 10:47 AM Vivek opined:
>>
>> <snip>
>>
>>
>>>
>>> I installed Spy-bot and Ad-aware and ran a spyware check in safe mode.
>>> Firefox opens in safe mode without any problem. But when I boot to
>>> normal mode same error. Another thing is.. the virus comes up even
>>> when I open the Firefox folder i.e C:\Program Files\Firefox folder in
>>> explorer...!!
>>>
>>
>> This would indicate a problem with your computer/windows, to me anyway.
>> FF has nothing to do with file management - it seems to be the target.
>>
>> My friend is also having same problem, so it must be
>>
>>> some problem in firefox only..... Please help.... Urgent...
>>>
>>>
>>
>> did you and your friend have any recent email communication??
>>
>> I googled the msg you are getting and came up with squat - its maybe
>> brand new malware.
>>
>> Try shutting down windows messenger service and see if that stops it -
>> it may be coming in from outside...
>>
> I reckon that there are too many possibilities that, without getting
> "into" the OPs computer, only a re-install of FF may solve - but if a
> *.dll has been implemented someplace, only a system reset to before the
> trouble started will clean it!
true enough if its a FF dll but if whatever it is takes over explorer,
it doesn't sound that way...
As Thomas said, hijack this may be a god source of help - if he can get
there. Forgot about
them - been awhile.
> SpyBot has an Advanced mode (main menu>>mode) that can be set to look at
> system files - also the Startup list can be looked at and modified there!
>
> reg
I wasn't aware that spybot /did not/ scan system files - I gotta look at
that...
Leonidas Jones
> On Apr 24, 3:44 am, "Terry R." <Terry.F1ComNOS...@gmail.com> wrote:
>> On 4/23/2007 1:23 PM On a whim, goodwin pounded out on the keyboard
>>
>>
>>
>>> On 4/23/2007 12:24 PM Terry R. opined:
>>>> On 4/23/2007 11:47 AM On a whim, Vivek pounded out on the keyboard
>> That's why I suggested Safe Mode. Many times it will run that way.
>> Otherwise he may have to download the files from another computer and
>> transfer them.
>>
>> --
>> Terry R.
>> Anti-spam measures are included in my email address.
>> Delete NOSPAM from the email address after clicking Reply.
>
>
>
> I installed Spy-bot and Ad-aware and ran a spyware check in safe mode.
> Firefox opens in safe mode without any problem. But when I boot to
> normal mode same error. Another thing is.. the virus comes up even
> when I open the Firefox folder i.e C:\Program Files\Firefox folder in
> explorer...!! My friend is also having same problem, so it must be
> some problem in firefox only..... Please help.... Urgent...
>
You are opening in Firefox safe mode, not Windows safe mode, aren't you?
Start>>Programs>>Mozilla Firefox>>Mozilla Firefox (Safe Mode)
If it opens and runs correctly in safe mode, it would seem that, somehow
an extension got installed without your knowledge. Open FF in sfae mode.
Tools>>Addons. Take a good long look at all the installed extensions.
Uninstall any that look suspicious. Restart in regular mode.
If the errors keep coming, You might need to either, open in safe mode
and uninstall every extension, or probably better, open Profile Manager:
To open Firefox's Profile Manager, click Start>>>Run, type firefox.exe
-p in the field, and click OK. Note the space after exe, it is important.
Create a new profile and start over.
Lee
--
Leonidas Jones, Netscape/Mozilla Champion
The Champs: http://mozillachampions.ufaq.org
Links: http://www.ufaq.org/ http://mozilla.com http://kb.mozillazine.org
Posting Etiquette: http://www.mozilla.org/community/etiquette.html
Terry R.
Did you download the latest updates from each program? This is very
important.
Terry R.
Did you download the latest updates from each program? This is very
important.
--
Terry R.
I wasn't asking him to load FF in it's Safe Mode, I told him "Windows
Safe Mode". This is a completely different direction of t-shooting that
I hadn't moved to yet.
Terry R.
While to an experienced user or consultant this could be considered a
good suggestion, to most others, ANY process in Task Manager would look
strange. Your suggestion assumes the user can differentiate between
what is normal and what is /strange/.
Leonidas Jones
Sorry Terry, I shouldn't have jumped in then. Maybe thats one of the
problems here, too many cooks.
Thanos
> On 4/24/2007 11:20 AM On a whim, Thanos pounded out on the keyboard
>> Can you access the Windows Task Manager? If yes go to 'Processes' tab
>> and search there for anything strange. If not sure check for each
>> process you see in google.
>>
>> Something else you could try is to see if something strange is loaded
>> when windows startup.
>>
>> Start \ Run \ (type) msconfig
>>
>> Go to 'Startup' tab and search for anything unfamiliar.
>
> While to an experienced user or consultant this could be considered a
> good suggestion, to most others, ANY process in Task Manager would look
> strange. Your suggestion assumes the user can differentiate between
> what is normal and what is /strange/.
Well, he started windows in safe mode and everything worked ok so there
must be something starting up when windows boot in normal mode. I don't
see/know any other ways to determine this.
Irwin Greenwald
Did you run Firefox in windows safe mode or in firefox safe mode
(Start>>Run>>firefox.exe -safe-mode)?
--
Irwin
Please do not use my email address to make requests for help.
Knowledge Base: http://kb.mozillazine.org/Main_Page
Ron Hunter
> On 4/24/2007 11:20 AM On a whim, Thanos pounded out on the keyboard
>
>> Vivek wrote:
>>> I installed spy-bot, also lavasoft adaware. I booted to safe mode and
>>> ran a check with both. No spyware found by any of them. Firefox works
>>> fine in safe mode. I rebooted the computer and tried to run firefox
>>> and i get the same virus.....
>>
>> Can you access the Windows Task Manager? If yes go to 'Processes' tab
>> and search there for anything strange. If not sure check for each
>> process you see in google.
>>
>> Something else you could try is to see if something strange is loaded
>> when windows startup.
>>
>> Start \ Run \ (type) msconfig
>>
>> Go to 'Startup' tab and search for anything unfamiliar.
>
> While to an experienced user or consultant this could be considered a
> good suggestion, to most others, ANY process in Task Manager would look
> strange. Your suggestion assumes the user can differentiate between
> what is normal and what is /strange/.
>
It is a bit tedious, but one can go through all of them, and Google each
in turn to determine what it is, and what it does.
--
Ron Hunter rphu...@charter.net
thelordof...@gmail.com
ive tried the apyware removers u said.
t doesnt seem to be mallicious..
Where do u think it could be lodged?
I checked services and proccesses, but dint find anything unusual.
Do u think it could be camouflaginf itself by using a system proccess
name?
What could it be..
And if it IS such a virus, it has to be in the memory right so that it
checks when firefox is loaded everytime.. But my memory checks are
clean.
Please help!!!!!!!!!!
thelordof...@gmail.com
Gordon Weast
This sounds like a root kit. That is, an evil program that inserts
itself into the system call sequence. I don't know the exact mechanism,
but once such a program is in place, it can monitor all system calls.
This would explain how it would catch the name 'firefox' when using
explorer to change directories.
It probably has a list of specific names to catch in file system
accesses.
It would also filter the returns from directory queries to remove
any mention of itself. That is, there is probably a directory somewhere
on your disk that contains this program, but it won't be visible when
running Windows because any mention of it is filtered out, both in
file system accesses and system activity queries.
I believe that the hijackthis utility may be able to detect some rootkits.
There is another program, rootkitrevealer, that may also be valuable.
I don't have a link handy where to get it though.
Since the problem doesn't seem to be present when you run in Windows
safe mode, you have some chance of getting rid of it. Run these
tools in Windows safe mode.
Just for fun, come up in Windows safe mode and change the name of the
directory where firefox is installed. Then boot into full mode and
see if explorer can look at that directory. Granted, firefox may not
run correctly because the registery will still have the old directory name
attached to some config settings, but you might make progress. (Does
firefox depend on registry settings?) If that works, then you might
be able to change the name of firefox.exe and get it to run. You still
haven't gotten rid of the root kit, but you will have found out some
important information about it.
Gordon Weast
Terry R.
Not a problem, as long as the OP realizes the difference between the
two. Your option was next in line after I find out if they updated
Spybot & Ad-Aware prior to running them in Windows Safe Mode. So you
saved me further typing!
Terry R.
HijackThis was one of the tools I wanted him to download:
http://www.merijn.org/programs.php#hijackthis
Terry R.
Yes, Thanos suggested that in his post. But that can get confusing for
someone who isn't sure of what is "normal". Googling Lsass alone gives
many explanations, many of which would be more than one could figure out
on their own. Although the info IS there which is a lot more than we
had in earlier years.
John Doue
Such a problem should be high on the priority list of those who in
Mozilla monitor this newsgroup.
My suggestion will not help much if we are dealing here with a rootkit,
but, using a search tool to locate the text string "you dope" (which
should not produce too many results !!!) in the files under the Windows
Directory, the Program files, and Firefox directory could be helpful.
Granted, this will be a long search but in this kind of situation ...
I am less sure my next suggestion is of much interest, but assuming the
OP runs a single OS on his machine, booting to a Win 98 disk and running
fdisk /mbr should not hurt.
Regards
--
John Doue
Stefan
scanners (Avira or AVG). There is already one report that the Avira
rootkit detection caught one which was missed by everything else. UNQUOTE
John Doue
--
John Doue
Terry R.
Product name: Antivir - free version available. The last update now
includes rootkit detection. Been using it for almost two years (since I
finally dumped Norton after using it since AV software was available).
Highly recommended. Daily updates.
kes
This poster and also 'Vivek' are the same person. I have a suspicion
this is a wild goose chase instigated by one moron...
(have a look at the full headers, compare NNTP hosts...)
Leonidas Jones
UA is the same, posting host is different, but both resolve to
Bangalore, India.
You may be right kes.
Shawnews
news:t-Wdnf-hbPzzHLDb...@mozilla.org...
> On 4/23/2007 3:44 PM Terry R. opined:
>
>> On 4/23/2007 1:23 PM On a whim, goodwin pounded out on the keyboard
>>
>>> On 4/23/2007 12:24 PM Terry R. opined:
>>>
>>>>
>>>>> I am not able to do that... The minute the properties window opens the
>>>>> msg box virus comes immediately closing the window..
>>>>> Ok.. I opened it when the msg box was open and then I was able to
>>>>> see.. It is "C:\Program Files\Mozilla Firefox\firefox.exe"
>>>>>
>>>>>
>>>> If you can access the internet download Spybot Search & Destroy and run
>>>> the updates after installing:
>>>> http://www.safer-networking.org/en/download/index.html
>>>>
>>>> AND Ad-Aware Free Version and run the updates after installing.
>>>> http://www.lavasoftusa.com/download_and_buy/product_comparison_chart.php
>>>>
>>>> You may have to do that from the Windows Safe Mode with Networking.
>>>>
>>>> Report back,
>>>>
>>> If OP can't run FF, he may have a problem with spybot as well unless
>>> malware is FF specific...
>>
>> Otherwise he may have to download the files from another computer and
>> transfer them.
>>
>
>
> 50 quatloos says we don't find out.
i'll call your 50 and raise you 10 quatloos
Irwin Greenwald
> kes wrote:
>> thelordof...@gmail.com wrote:
>>> I have the same problem.. and NOTHING IS working.
>>> ive tried the apyware removers u said.
>>> t doesnt seem to be mallicious..
>>> Where do u think it could be lodged?
>>> I checked services and proccesses, but dint find anything unusual.
>>> Do u think it could be camouflaginf itself by using a system proccess
>>> name?
>>> What could it be..
>>> And if it IS such a virus, it has to be in the memory right so that it
>>> checks when firefox is loaded everytime.. But my memory checks are
>>> clean.
>>> Please help!!!!!!!!!!
>>>
>>
>> This poster and also 'Vivek' are the same person. I have a suspicion
>> this is a wild goose chase instigated by one moron...
>> (have a look at the full headers, compare NNTP hosts...)
>
> UA is the same, posting host is different, but both resolve to
> Bangalore, India.
>
> You may be right kes.
>
> Lee
>
>
>
struggled with. See:
http://www.aceviper.net/forums.php?topic=63
http://www.aceviper.net/WinAntiVirus_Pro_2006.php
http://en.wikipedia.org/wiki/WinFixer
Sjouke Burry
each entry in the startup list of msconfig.
Thats a lot of work, but it did the job.
It turned out to be one unknown to ADAWARE/SPYBOT,
but listed by google.
Stefan
Manager in Windows. I just start the Task Manager and press the "I"-icon
for the process I want info about, and PANG I get the info. Can be
downloaded here; http://www.processlibrary.com/freetools/quickaccess/
Ron Hunter
--
Ron Hunter rphu...@charter.net
FRANZ
FRANZ
notepad :-P
John Doue
addresses. Some people deserve ... real viruses!
--
John Doue
goodwin
>>>>> Report back,
>>>>>
>>>> If OP can't run FF, he may have a problem with spybot as well unless
>>>> malware is FF specific...
>>>
>>> That's why I suggested Safe Mode. Many times it will run that way.
>>> Otherwise he may have to download the files from another computer and
>>> transfer them.
>>>
>>
>> sigh..
>>
>> 50 quatloos says we don't find out.
>
> i'll call your 50 and raise you 10 quatloos
>
>
we'll probably have to take the game to another table, though...
goodwin
>>
> A tool I found handy is Quick Access. It integrates nice with the Task
> Manager in Windows. I just start the Task Manager and press the "I"-icon
> for the process I want info about, and PANG I get the info. Can be
> downloaded here; http://www.processlibrary.com/freetools/quickaccess/
>
>
Vivek
virus and remove it. The virus is svchost.exe the icon is a white H in
a green button. There is a hidden folder in the C drive named heap41a,
i.e C:\heap41a. There are 3 text files in that and one text file which
had the entire code for bringing up the message window and there is an
mp3 file by name 2.mp3. In the script.txt file the person is blocking
sites orkut and youtube, then he is also blocking firefox browser. He
also disables the hidden files from viewing. And when u try to put the
radio button to show hidden files, it automatically reverts back to
hide. That is one problem which I need to fix.
The way I got there was I had another partition with Win2000 and I was
able to see the hidden files there. So I found this foldr in C. I
deleted the folder and problem was solved. Another thing is it also
puts a program to run in the startup, which is present in HKCU\Software
\Microsoft\Windows\CurrentVersion\Policies\Explorer\. You need to
delete that key. Then I think it should be fine.
Ron Hunter
can determine where you got the virus/trojan, please share that
information with us as well.
--
Ron Hunter rphu...@charter.net
Irwin Greenwald
> Thank you so much for all your help. I was finally able to trace the
> virus and remove it. The virus is svchost.exe the icon is a white H in
> a green button.
That icon is used by HostsMan which is a (legitimate) program to
dynamically manage the HOSTS file. Sounds like your virus is using this
program for its own purposes. svchost.exe is a necessary Windows
program, which - unfortunately - is a target for hijacking; see:
http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/
There is a hidden folder in the C drive named heap41a,
> i.e C:\heap41a. There are 3 text files in that and one text file which
> had the entire code for bringing up the message window and there is an
> mp3 file by name 2.mp3. In the script.txt file the person is blocking
> sites orkut and youtube, then he is also blocking firefox browser. He
> also disables the hidden files from viewing. And when u try to put the
> radio button to show hidden files, it automatically reverts back to
> hide. That is one problem which I need to fix.
>
> The way I got there was I had another partition with Win2000 and I was
> able to see the hidden files there. So I found this foldr in C. I
> deleted the folder and problem was solved. Another thing is it also
> puts a program to run in the startup, which is present in HKCU\Software
> \Microsoft\Windows\CurrentVersion\Policies\Explorer\. You need to
> delete that key. Then I think it should be fine.
>
>
avanis...@gmail.com
orkut......
it gives the alert "orkut\youtube is banned you fool" and closes the
window immediately,......
it also blocks the user from opening Firefox......
it gives the alert "use IE you dope" and closes the Firefox
window.....
it also plays a .wav file (which sounds as "muhahaha!!) whenever the
alerts pop-up.....
also when you start windows, a phrase from the "holy quaran" is played
(i dunno what is says, but it praises Allah i think)
SOLUTION: this malware can be solved using "hijakthis!" from trend
micro.....which can be downloaded here: http://filehippo.com/download_hijackthis/
delete a entry which has SVCHOST.EXE in it......it comes as c:
\heaps(some number)\svchost.exe
this will kill the malware......
this malware jumps into your flash drive when plugged into infected
system and hides itself diguised as a folder......
i have solved the problem by following this method and it
worked.......im able to access orkut and youtube and can open
Firefox......and it didn't reload itself when i restarted my
system......
im only a person with a little knowledge about this.....does anybody
have the complete knowledge about this malware and its real actions??
please reply to this thread if this method works( it worked in my
case)....also if you know more about this malware.......
i think its a ow threat malware since it doesn't do much harm yo the
system....
Phillip M. Jones, C.E.T
Sounds Like you have figured out how to Fix.
--
------------------------------------------------------------------------
Phillip M. Jones, CET http://www.vpea.org
If it's "fixed", don't "break it"! mailto:pjo...@kimbanet.com
http://www.kimbanet.com/~pjones/default.htm
Mac G4-500, OSX.3.9 Mac 17" PowerBook G4-1.67 Gb, OSX.4.8
------------------------------------------------------------------------
clay
> ...
>
> I wasn't aware that spybot /did not/ scan system files - I gotta look at
> that...
Spybot also has some exploits ignored by default.
Have a look in settings>ignore*
--
100% money back guarantee!
If at any time you are dissatisfied with the performance of your Mozilla
product, feel free to return it for a complete refund of your full
purchase price...
goodwin
> goodwin wrote:
>> ...
>>
>> I wasn't aware that spybot /did not/ scan system files - I gotta look at
>> that...
>
> Spybot also has some exploits ignored by default.
> Have a look in settings>ignore*
>
>
just got the time to go into this - I don't recollect ever changing
anything in those lists
and /nothing/ is ignored. But then, its been a few /years/ since I've
even looked
into the settings, so it may have been on day one that I unchecked
everything and never
looked back.
squaredancer
generate the following:? :
check through the possible settings and also look at what various
"features" now do!
reg
reg
clay
goodwin
I've pretty much noticed the newer changes over the years. Since I
don't use xp, don't use IE, and don't use OE, those
changes have been pretty much passe to me.
I'd guess the default ignore settings mentioned had to do with MS IE and
act-x, which I would have unchecked, if checked,
unconsciously.
The bit about not scanning system files did make me curious but I
haven't found out anything about that yet - its not in the spybot docs
that I can see, nor at the website. I don't think that to be correct,
but we'll have to take it elsewhere before the OT cops show
up...
goodwin
> goodwin wrote:
>> On 5/7/2007 3:19 PM clay opined:
>>
>>> goodwin wrote:
>>>> ...
>>>>
>>>> I wasn't aware that spybot /did not/ scan system files - I gotta look at
>>>> that...
>>>
>>> Spybot also has some exploits ignored by default.
>>> Have a look in settings>ignore*
>>>
>>>
>> just got the time to go into this - I don't recollect ever changing
>> anything in those lists
>> and /nothing/ is ignored. But then, its been a few /years/ since I've
>> even looked
>> into the settings, so it may have been on day one that I unchecked
>> everything and never
>> looked back.
>
> http://safer-networking.org/en/faq/51.html
> http://forums.spybot.info/showthread.php?t=336
>
> Running processes...
> http://safer-networking.org/en/faq/40.html
>
sorry, Clay, didn't see your reply before responding to reg..
ok - Cdilla & sidestep - who cares?
the thread was totally unenlightening, as newsgroup threads can be at
times - nothing there.
And I had just read the bit on running precesses - I don't see any
problems there - their
explanation seemed reasonable to me. Some folks don't like some
software and can always
find fault with anything.
I don't see any issues with spybot, never had a problem with it.
After using both for almost 7 years, I've never had /anything/ detected
by either AVG or spybot.
Never had any problems, either...
knocking on head...
squaredancer
generate the following:? :
> goodwin wrote:
>
>> On 5/7/2007 3:19 PM clay opined:
>>
>>
>>> goodwin wrote:
>>>
>>>> ...
>>>>
>>>> I wasn't aware that spybot /did not/ scan system files - I gotta look at
>>>> that...
>>>>
>>> Spybot also has some exploits ignored by default.
>>> Have a look in settings>ignore*
>>>
>>>
>>>
>> just got the time to go into this - I don't recollect ever changing
>> anything in those lists
>> and /nothing/ is ignored. But then, its been a few /years/ since I've
>> even looked
>> into the settings, so it may have been on day one that I unchecked
>> everything and never
>> looked back.
>>
>
> http://safer-networking.org/en/faq/51.html
> http://forums.spybot.info/showthread.php?t=336
>
> Running processes...
> http://safer-networking.org/en/faq/40.html
>
>
I looked at those URLs and, on closing FF saw this popup on my monitor...
http://img510.imageshack.us/my.php?image=clipboard01al6.png
Any offers??
I have set the followup to thunderbird - wonder what will happen =-O
probably crap, as the OP will not be seen there, and no-one will have a
clue as to what it is all about!
reg
R. Vijay
>
> - Show quoted text -
hi Irwin,
Thanks a lot dude...Without your help i dont think i could have
deleted that orkut virus....Thaks a lot once again..
Please follow the steps suggested by avanishsha and Irwin,u'll be able
to delete the virus
katz...@gmail.com
m.nir...@gmail.com
> SOLUTION: this malware can be solved using "hijakthis!" from trend
> micro.....which can be downloaded here:http://filehippo.com/download_hijackthis/
>
> delete a entry which has SVCHOST.EXE in it......it comes as c:
> \heaps(some number)\svchost.exe
>
> this will kill the malware......
>
> this malware jumps into your flash drive when plugged into infected
> system and hides itself diguised as a folder......
>
> i have solved the problem by following this method and it
> worked.......im able to access orkut and youtube and can open
> Firefox......and it didn't reload itself when i restarted my
> system......
My PC got infected by this worm thru a USB Flashdive.. I've located
the HEAP41A folder & deleted it's contents.
Now I can use Firefox, access Orkut & YouTube as usual.
Also, there's no sign of SVCHOST.EXE spawed under user-name even after
a re-boot. So I think it's gone.
But I still got the Hidden Files problem... as soon as I select the
"Show all hidden files" option, it quickly reverts back to "Don't show
hidden files"
Can you please explain the step to fix this? Thanks a lot, been a lot
of help.
cip...@gmail.com
> I am having a virus in my computer which does not allow me to open any
> browser other than IE. Whenever I open firefox, i get a window which
> says "USE INTERNET EXPLORER YOU DOPE" as the title and the message
> says "I DNT HATE MOZILLA BUT USE IE OR ELSE..." . I am having NIS 2006
> but it is not able to detect the virus... Please help me....
Check out this !!!
http://meninweb.blogspot.com/2007/05/i-dnt-hate-mozilla-but-use-ie-or-else.html
I tired this and it works
paderu...@gmail.com
> On 4/24/2007 10:24 AM, Vivek wrote:
>
> > I installed spy-bot, also lavasoft adaware. I booted to safe mode and
> > ran a check with both. No spyware found by any of them. Firefox works
> > fine in safe mode. I rebooted the computer and tried to run firefox
> > and i get the same virus..... :(( I don't know what to do.. Please
> > suggest something.. No antivirus sites have any mention of such a
> > virus..!! even firefox site is not having any mention of this kind of
> > problem. One more thing I would like to add, even one of my friend has
> > the same problem, so it is not problem with my computer.
>
> Did you run Firefox in windows safe mode or in firefox safe mode
> (Start>>Run>>firefox.exe -safe-mode)?
>
> --
> Irwin
>
> Please do not use my email address to make requests for help.
>
> Knowledge Base:http://kb.mozillazine.org/Main_Page
hello every one
i too have the same probelem
not only firefox some sites like orkut also wneh i open i get a
message saying "U FOOL ORKUT IS BLOCKED UR ADMINISTRATOR HAS NOT DONE
IT GUESS WHO DID IT"
even the same message i get when firefox is opened "
help me guys soon..............