|
 NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
 cool web search 
#3124428 - 09/11/04 11:47 PM (19 years, 7 months ago) |
|
|
can go to hell and die. I've never had as much of a problem with any other kind of ad/spyware EVER. It's go so many variants that it's hard to figure out how to get rid of it. I've been on this for about a week. Anyone else having this problem?
|
Vvellum
Stranger
Registered: 05/24/04
Posts: 10,920
|
|
google "CWShredder"
god fuck that spyware shit - im glad im using linux now.
|
NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
Re: cool web search [Re: Vvellum]
#3124754 - 09/12/04 01:12 AM (19 years, 7 months ago) |
|
|
I've already tried using shredder. Couldn't boot in safemood either but I did have Ad-Aware run when windows started and it comes up before it lets anything else run, and I manualls ran the shredder by bringing up task manager.
|
daussaulit
Forgetful
Registered: 08/06/02
Posts: 2,894
Loc: Earth
|
|
What browser are you using?
|
Le_Canard
The Duk Abides
Registered: 05/16/03
Posts: 94,392
Loc: Earthfarm 1 
|
|
It's a real nasty piece of work, isn't it? I advise getting Mozilla Firefox which isn't as vulnerable to such things like IE.
|
Vvellum
Stranger
Registered: 05/24/04
Posts: 10,920
|
|
have you modifited your HOSTS file?
|
funkymonk
Get's down, withthe get-down.
Registered: 11/29/02
Posts: 8,160
Loc: saskatchewan
|
Re: cool web search [Re: Vvellum]
#3125035 - 09/12/04 02:41 AM (19 years, 7 months ago) |
|
|
im having troubles with downloader.clisser
and can't find any removal info,tools, or anything.
|
blink
eye of horus
Registered: 03/31/02
Posts: 11,349
Loc: Geographic Location (Stat...
|
|
does the new adaware not do anything to kill CSW yet? I thought they used some kind of csi (code sequence identification) to get around the variants.
I made a post about CWS a while back here, search for it cause bio gave step by step instructions on how to kill MS JavaMachine for good and close the hole that let CWS install itself.
Then switch to firefox 
|
NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
Re: cool web search [Re: blink]
#3125560 - 09/12/04 10:12 AM (19 years, 7 months ago) |
|
|
I'm using IE 6. I checked my c:\windows, c:\windows\system and c:\windows\system32 folders. In my system 32 I found a csa.dll that was just created and modified yesterday. I used shredder, ad-aware and such and I thought cws was gone. I reset my homepage to google and everything was working fine for around 10 minutes and I was happy thinking I finally got rid of the cws, and then I go to open IE again, only to find out the homepage has been hijacked again.
|
daussaulit
Forgetful
Registered: 08/06/02
Posts: 2,894
Loc: Earth
|
|
Quote:
NewfoundFreedom said:
I'm using IE 6.
Found the problem. Stop using IE.
|
Shroomism
Space Travellin
Registered: 02/13/00
Posts: 66,015
Loc: 9th Dimension
|
|
1. get firefox
2. use firefox now and forever, unless a page or plugin doesn't work in firefox for some freak reason, then use IE as a last resort
3. make sure to "scan within archives" in ad-aware, and run a "custom scan"
4. download Hijack This! - http://www.spychecker.com/program/hijackthis.html
5. Run it.. post your log here - http://www.spywarewarrior.com/viewforum.php?f=5&sid=058c5d0207199b4d17a12c06f236a863
6. DO NOT "FIX" anything with Hijack This until you get professional advice on what to get rid of
7. Visit this page - http://www.zerosrealm.com/index.php?page=downloads
--------------------
|
Anonymous
|
Re: cool web search [Re: Shroomism]
#3125982 - 09/12/04 01:05 PM (19 years, 7 months ago) |
|
|
regular mozilla kicks ass too, haven't had a problem since i started using it
|
 monoamine
umask 077(nonefor you)
Registered: 09/06/02
Posts: 3,095
Loc: Jacksonville,FL
Last seen: 18 years, 6 months
|
|
I hope all the people that write spyware burn in hell (along with spammers).
--------------------
People think that if you just say the word "hallucinations" it explains everything you want it to explain and eventually whatever it is you can't explain will just go away.It's just a word,it doesn't explain anything...
Douglas Adams
|
NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
Re: cool web search [Re: monoamine]
#3127286 - 09/12/04 09:07 PM (19 years, 7 months ago) |
|
|
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\Common Files\AOL\ACS\acsd.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\WinMX\WinMX.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Daen\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Daen\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Daen\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Daen\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Daen\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Daen\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Daen\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
F0 - system.ini: Shell=
F2 - REG:system.ini: Shell=
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {3ED38600-68D8-4468-A020-F25E98A08720} - C:\WINDOWS\System32\cna.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 (HKLM)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 (HKLM)
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://directv.direcway.com/dwayready/dpcsysinfo.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/aolim/install.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D9B0CF29-3731-41AA-BFDA-2A7335F60B94}: NameServer = 205.188.146.146
|
Shroomism
Space Travellin
Registered: 02/13/00
Posts: 66,015
Loc: 9th Dimension
|
|
post that log in this forum - http://spywarewarrior.com/viewforum.php?f=5 .. you need to register first.. it takes 2 minutes
also I linked you to an outdated version of Hijack This... use this one - http://computercops.biz/downloads-cats-14-10-10.html
and post the log in that forum
--------------------
|
NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
Re: cool web search [Re: Shroomism]
#3127413 - 09/12/04 09:39 PM (19 years, 7 months ago) |
|
|
Thanks. I just installed firefox, so I'll check that stuff out in a bit.
|
NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
|
I'm finally rid of CWS. Thanks for the help everyone. Even though I can use IE again, I think I'll stick with firefox. I seem to like it alot more.
|
NewfoundFreedom
Manure whore
Registered: 05/06/04
Posts: 1,915
|
|
Bleh, or so I thought. It came back a few hours later. Gotta try again.
|
ChingChong
Non-OffensiveTalker
Registered: 06/04/04
Posts: 303
Loc: Where the buffalo roam
Last seen: 17 years, 5 months
|
|
nerdtacular
--------------------
How can one murder enormously if one is microscopic.
|
|
Threaded
Previous
Index
Next
Bridgetown Botanicals 
Maeng Da Thai Kratom Leaf Powder
Edit 
Reply 
RESET32one
1 2 all )
Cow Shit Collector
Lana
Vvellum
Drink_Punk_Soda
Le_Canard
Pinhead