My PC has been got at - Page 3

Archer17 · #61 (**permalink**) 19-November-2005, 01:19 AM

I've went the re-install route more than once when using Windows 98 and agree that sometimes that's the only recourse but hate to see Sticks lose everything he has on his computer, especially things like that SP2 upgrade that takes forever.

Sticks, has anyone done a remote assistance session with you? I'm willing to give it a shot if we can both find a convenient time. I recently started a new job and work 8a-6p (1300-2300 GMT) M,W,Th, F so I don't make it on as often as I used to but on weekends or Tuesdays time shouldn't be an issue.

Hate to see you have to reinstall from scratch. Some suggestions .. another poster already recommended running Spybot and Ad-Aware and that's a good idea. Those freebies sometimes find stuff the other ones miss. Can't hurt.

I'd also recommend you download CCleaner. It's a freebie system optimization tool that might snare those pesky remnants that you can't get rid of.

One last suggestion and that's after running those three programs to use XP's error-checker, which unlike some previous versions of Windows, is hard to find on XP. Here's a link on how to use it with some screenshots. (I prefer the "graphical version" which is the second method listed).

Good luck!

Fraser · #62 (**permalink**) 19-November-2005, 02:14 AM

I've had this. I got it as an add on for a plug in that I installed with MS Messenger. It was awful to remove, and I literally couldn't do it myself. And I'm pretty technical...

My solution came from an amazing forum called: http://forums.spywareinfo.com/

You download and run a program called Hijack This, which provides a summary of everything currently running on your computer. You post your log to the forum, and a volunteer comes along and give you personalized, step by step instructions on how to remove it. Amazing place, and it shows how many volunteers there are you there willing to help out.

I'm not sure Sticks needs to do a reformat yet, although, it's sure to fix any problem with Windows. And make it run way faster as well. I just did a reformat on my computer... very refreshing.

Archer17 · #63 (**permalink**) 19-November-2005, 04:55 AM

Cool forum Fraser! Sticks .. give 'em a try. I'm somewhat savvy .. from what I've read over there, those people are more than that.

genebujold · #64 (**permalink**) 19-November-2005, 03:24 PM

Try Spybot Search and Destroy. Adaware and Spybot largely overlap, but not totally.

Also, if you're running XP, create "restore points" before you download anything, even if it's just updates to your antivirus or operating system. Even the good guys occasionally make mistakes that will bring you down.

Sticks · #65 (**permalink**) 19-November-2005, 04:44 PM

Before I try these extra's, given my experience with Paretologic's XoftSpy, How does Adaware and Spybot compare to the Microsoft's own "AntiSpyware"? Will there be any conflict if I run them, AntiSpyware is active

Where can I get a clean copy of Spybot?

Incidentally when I was visiting the Dilbert site again, using Firefox, that Winfix 2005 tried to come back. I thought Firefox was not supposed to be affected by these things. BTW can someone report this to Scott Adams, just incase his site is compromised, for the moment I am keeping away from it.

GDwarf · #66 (**permalink**) 19-November-2005, 05:05 PM

Quote:

Originally Posted by Sticks

Before I try these extra's, given my experience with Paretologic's XoftSpy, How does Adaware and Spybot compare to the Microsoft's own "AntiSpyware"? Will there be any conflict if I run them, AntiSpyware is active

There shouldn't be any problems, and it won't hurt to try. I can vouch for them as good programs that find many, many nasty things and get rid of them.

Quote:

Where can I get a clean copy of Spybot?

http://www.spybot.info/

Quote:

Incidentally when I was visiting the Dilbert site again, using Firefox, that Winfix 2005 tried to come back. I thought Firefox was not supposed to be affected by these things. BTW can someone report this to Scott Adams, just incase his site is compromised, for the moment I am keeping away from it.

Firefox isn't, and the Dilbert website is fine. The virus was probably simply running in the background and chose then to make itself known.

Sticks · #67 (**permalink**) 19-November-2005, 06:33 PM

Quote:

Originally Posted by GDwarf

Firefox isn't, and the Dilbert website is fine. The virus was probably simply running in the background and chose then to make itself known.

It was just that yesterday and today, whilst trying to go to a part of the Dilbert site using Firefox, Winfix 2005 shows up and it is panic stations as it refuses to shut down, and gives all sort of dialog boxes.

I have downloaded SpyBot and run it.

It found some cookie entries and some registry entries, which have now been sent to the back up section. I am terrified of doing anything down there.

I then did a reboot, and the QOSMEDIA.EXE and HHSBDAZE.EXE trying to initialise on shutdown. On boot up, when I was waiting for MSN to give up trying to connect and for Zone Alarm start up, my PC crashed / restarted.

I then had to wait to see if my PC would forever keep restarting at this point, or as it has now restarted. I thought that SpyBot had managed to inadvertantly sabbotage my PC.

While writing this QOSMEDEA.EXE has tried to access the internet. A google search reveals nothing on this program, so I do not know if it is legitimate or a nasty. The fact I could not find it on a Windows Explorer search does not bode well.

How can these things survive different types of deep scanning, including three bootscans?

BTW doing the nuke option is not an option due to such things as the broadband, XP service pack 2, Front Page plus all my other files

GDwarf · #68 (**permalink**) 19-November-2005, 06:40 PM

Quote:

Originally Posted by Sticks

It was just that yesterday and today, whilst trying to go to a part of the Dilbert site using Firefox, Winfix 2005 shows up and it is panic stations as it refuses to shut down, and gives all sort of dialog boxes.

I have downloaded SpyBot and run it.

It found some cookie entries and some registry entries, which have now been sent to the back up section. I am terrified of doing anything down there.

I then did a reboot, and the QOSMEDIA.EXE and HHSBDAZE.EXE trying to initialise on shutdown. On boot up, when I was waiting for MSN to give up trying to connect and for Zone Alarm start up, my PC crashed / restarted.

I then had to wait to see if my PC would forever keep restarting at this point, or as it has now restarted. I thought that SpyBot had managed to inadvertantly sabbotage my PC.

While writing this QOSMEDEA.EXE has tried to access the internet. A google search reveals nothing on this program, so I do not know if it is legitimate or a nasty. The fact I could not find it on a Windows Explorer search does not bode well.

How can these things survive different types of deep scanning, including three bootscans?

BTW doing the nuke option is not an option due to such things as the broadband, XP service pack 2, Front Page plus all my other files

Spybot won't do anything to your PC, I run it on a weekly basis. as for QOSMEDIA, I don't think it's a virus, just a program that Windows has started disliking for an unknown reason. If two virus scanner, Spybot and Ad-aware SE (You should also run that if you haven't already) couldn't find/get rid of your computer's problems it really looks like the only option is a complete re-install, do some more asking around first, but it couldn't hurt to backup any files you want to keep, just in case one time your computer doesn't start again.

Stregone · #69 (**permalink**) 19-November-2005, 10:36 PM

Quote:

Originally Posted by Sticks

BTW doing the nuke option is not an option due to such things as the broadband, XP service pack 2, Front Page plus all my other files

You could have been back up and running by now

Do you have a cd burner? Instead of paying this 'engineer' again buy a stack of cd's and backup your data, and wipe the HD and start over. Also, you can slipstream service packs into a new install cd. Google for 'service pack slipstream'.

Sticks · #70 (**permalink**) 20-November-2005, 09:21 PM

On Sunday Afternoon, after church I booted up, and got error messages on how HHSBDAZE.EXE could not start up, due to Ace.dll being missing.

I used the PC for a while, and rebooted.

On boot up, the flashing icon of the two PC's that you get from "Show my Network" connection was missing, although the broadband continued to work

I went to Start - Show all Network Connenctions and saw that the section for lan setting was not there, and only my old dial ups. I tried a dial up and got error 797, either the modem was busy or the modem was not there.

I tried a system restore to a restore point I created on Saturday, but the PC seemed to hang on the reboot. After a telephone cal to a friend, who walked me through on the network connections. it seems like the modem is not connected.

He took me to Control Panel and we tried Add hardware, and it could not find any new hardware, so he took me to Control Panel -Windows System - Hardware - Device Drivers.

That box was blank, not listing any drivers.

My friend walked me through getting into Safe Mode, and so I booted up in safe mode and did Control Panel -Windows System - Hardware - Device Drivers, and in Safe Mode, all the drivers were there and the Modem seemed to be there.

So something seems to be blocking my modem, so I can not use the dial ups.

This is critical, as a number of websites I support, will not allow me to FTP to them unless I use their dial up, plus with at least three accounts I have to use their dial up, at least once every 30 days or else the e-mail account is suspended

(I have also noticed that Windows explorer seems to be slow in operating)

My friend believes I should call the engineer out again

GDwarf · #71 (**permalink**) 20-November-2005, 10:30 PM

I'm afraid to say Sticks that at this point a clean install is about all I can recommend, that original virus seems to have allowed others in that are deleting files, escaping detection, and blocking device drivers. I recommend you find every file you want to keep and either burn them onto CD, zip them and store them on floppies, or back them up somehow. Then if you know how to re-format a hard drive do so and re-install Windows. If you don't know how do some Google searches for how to do it. If you still don't feel comfortable call the engineer to do it for you, but Installing Windows is fairly painless, it just takes a long time.

genebujold · #72 (**permalink**) 21-November-2005, 02:17 AM

Sorry to hear this. Take the following steps:

1. Find all your data files (Word documents, excel spreadsheets, TaxCut returns, etc), and back them to CD.

2. Do it again.

3. Find and back up all the keys you have for any programs you've purchased and downloaded. Hopefully, if you're like me, you keep all details written in a little black book next to the computer.

4. From an uninfected computer, download Eraser from here: http://www.heidi.ie/eraser/

5. Install it on that uninfected computer.

6. Use it to create a NukeBootDisk.

7. Use it as per the instructions on your current computer. Scary, but it WILL totally erase your hard drive, including any "hidden" progams which routinely escape Windows reinstalls.

8. If you haven't upgraded to the latest version of Norton Antivirus, yet, go to the store and purchase a copy (2006).

9. Once the NukeBootDisk finishes, your computer is, as the short lady in Poltergeist said, "is clean!"

10. Reinstall Windows without reconnecting to the network, choosing to reformat the hard drive (doing so locates and blocks off bad sectors). Don't choose multiple partitions. One big one is fine.

11. Install your fresh copy of Norton AntiVirus.

12. Connect to the Internet and ONLY go to Symantec and update your virus definitions FIRST. Not even to Microsoft.

13. Update Windows.

14. Download and run Spybot and Adaware. If they ask you to change anything, delete anything, etc., say NO! It'll educate them as to what's supposed to be there. But do set Spybot to run in the background to prevent Spyware infection.

15. Download and install the latest versions of all your drivers (video, network, sound, printer, scanner, etc.).

16. Finally, create a folder on your desktop called "Old Stuff" and copy everything from your backup CDs to there.

17. When you need something you know is in Old Stuff, create a new folder for the subject on your desktop and drag only the pertinant files into that folder.

After a few years, archive your Old Stuff to CD/DVD using a program that spans CDs and DVDs like PKZIP.

Yeah - it's a royal pain. But I did it in 1999 before I got smart, purchased a NAT-based router/firewall from Linksys, properly configured it to keep everyone out, and haven't had a SINGLE problem since!

Reason - even running Norton Antivirus loaded for bear won't protect your computer from being hijaacked. We tested unprotected computers in Korea, and it took about 15 minutes, on average, before hijaacker's scanning programs detected them and began using them as piecemeal servers for file-sharing services.

It's that prolific, and about 30% of all home computers are infected in this manner. It's not a "virus," however - it's not malicious, or designed to cripple your computer, so it's often overlooked by antivirus programs.

Go here for some older details on how to properly configure your Linksys router. It's about 2 yrs old, but the same principles apply: http://www.seoulcc.org/meeting_archive_2004.html

Check out the June 04 meeting entitled Linksys Router Configuration.

Sticks · #73 (**permalink**) 21-November-2005, 01:12 PM

I have emailed the full account to the PC engineer, and he has now said that a wipe out is the only thing to do.

I have had to take another day's annual leave and the engineer is coming on Friday morning.

Before he arrives, I will be doing the restore process. When I get home I will look at the booklet on how this is done. I have located the paper folder I did that has the code in so it will re-install.

The engineer says he has a disc with XP service pack 2, although I have asked some, if they are in a certain area and passing a branch ofhttp://www.pcworld.co.uk if he can pick up a copy of the XP service pack 2 disc, so I have one in reserve. According to Microsoft PC World are supposed to be giving free CD's of SP2.

I then have the nightmare of trying to get broadband and my other internet connections up safely, reinstalling all of the drivers to my peripherals and recovering software I normally use.

One thing that has started to worry me is that I do all of my documents in MS Word. I do not know if that was just put on in the factory or if it will be in the restore discs. I have heard stories, can not cite where, that applications like Word are not on the restore discs, so people have to go out and buy it after a restart. £199.99 according to the Microsoft site

Sticks · #74 (**permalink**) 21-November-2005, 01:17 PM

Also I am going to loose my copy of Acrobat Distiller 5.0, that I do not know where I got it.

I have been using it to create church related documents, so as well as not having MS Word, I can not full fill my church functions.

These virus writers have won

forum rules prohibit me from letting me express what I feel about them.

genebujold · #75 (**permalink**) 22-November-2005, 01:33 AM

Hi, Sticks. I wouldn't worry too much - the vast majority of restore disks include full copies of all preinstalled software. There's only a few horror stories out there, compared to thousands of successful ones.

Forum rules allow me to express what you feel about them for you: $%$^ &$%& & %&%*%* _^(** $^$ &&^% ! (random typing - no spacing characteristic of any word not found in a dictionary 30 years ago).

At least that's what they used in the Marvel Comic books when I was a kid.

Or was it Mad Magazine?

Good luck!

Sticks · #76 (**permalink**) 24-November-2005, 01:11 PM

It is now less than 24 hours to go before I reformat my hard drive, so if you never hear from me after tomorrow, it was this trouble that marked my disapearence

Tomorrow morning, when I get up at my normal work time of 05:00, I will boot the computer up and run the bath.

While the bath is filling I will check my e-mails.

I will leave my PC on while I process though the bath instead of shutting it down. I usually exit the bath at 05:30, but I may be too wound up to relax in it, and get out early.

I will then put the main restore disc in the DVD reader drive and shut down.

While it is shut down I will be unplugging everything from the USB ports and the Earthernet connection from the broadband input.

I will then power up and hope I have put the restore disc in the correct drive and start the long restore sequence, trying to follow the instructions. This will be highly stressfull especially as the documentation says it wil take 45 minutes plus and wil do restarts with creeping bars that may stop

Should that work, I have a CD-ROM of XP service pack 2, which I will put in and start as soon as the reformat completes. I am told this can take up to half an hour.

If that works and I do not have just a heap of metal, I will be trying to restore peripherall devices, and creating the dial ups.

The engineer does not want me to go near the internet, before he is made sure my machine is secure. He is due at 09:30. So in the interim, if I can I will try and restore data and any applications not requiring internet access.

I can not say what will be happening when the engineer comes, I can not see past that. Come to think of it I am so stressed out by this I can not see past the start of the re-install process.

So as I said at the beginning of this post, if I disapear, something went wrong and it was a good time posting here.

Argos · #77 (**permalink**) 24-November-2005, 01:45 PM

Won´t the engineer give your money back? I just hate to see people formatting. Good luck, anyway.

Sticks · #78 (**permalink**) 25-November-2005, 04:04 PM

The system is back up and running, and the engineer has restored me to having front page, and I have an alternate application to make PDF files

Security measures installed are:

Avast - Anti virus
Microsoft AntiSpyware
Firewall is being done by the XP Service Pack 2 fire wall. I have been informed that that should be ok.

In addition I also have Spybot

Also, my default browser is Firefox now. I will need to use IE for my development work, as that is still used by a lot of people.

What I have lost:

My copy of ADG Panorama 4, would not load, and the 5.0 is now a pay or have Unregistered in large letters across the panorama.

Anyone know of a freeware stitching tool that I can make 360 degree panorama's

My Zoom webcam does not work, and the system can not seem to locate drivers for it. (My sister has offered to give me money for a new web cam, as I got that one prior to 2002.)

For some reason, the CD-ROM with my copy of Terrapin, would not play in either of the CD drives. Any ideas why a CD-ROM stops being able to be read?. Luckily, sometime before that there was an upgraded version, which I had the presence of mind to back up on to CD-ROM archive, so I still have that.

1 Day's Annual leave
£45.00
skipped lunch

crosscountry · #79 (**permalink**) 30-November-2005, 06:36 AM

I'm glad to hear you got it running.

Sorry I never sent that copy of Front Page. The holiday really took a lot of my time.

Sticks · #80 (**permalink**) 27-July-2007, 11:06 AM

I was clearing some old hotmail messages away and found the link to this thread in one of them. It was between me and the engineer.

Unfortunately he has gone out of business.

If my finances were not so shot to pieces I might have hired him again to do a PC health check, since virtually everytime I try and view a video on YouTube the fan kicks in. I suspect I might have dust bunnies as it has never been opened up since I got it in 2002.

Reading through this has reminded me of a lot of stress and pain, similar to the anxiety I have been feeling since an incident last night whilst viewing Phil's Blog.

Son of Winzip2005 appeared and it was touch and go shutting things down without triggering any nasty downloads.

Then an agonising hour as Avast scanned the system to make sure there were no nasties, as far as I can tell. Windows defender said it did a scan just before I started the Avast scan and found nothing. Would like to think I got away with it, but I still have this nagging doubt in the back of my mind

I just wish that my engineer was still in business and my finances were in better shape

crosscountry · #81 (**permalink**) 27-July-2007, 11:43 AM

you got a virus while reading Phil´s blog?

Maksutov · #82 (**permalink**) 27-July-2007, 12:02 PM

Sticks,

What AV, firewall, anti-spyware, adware, malware, trojan applications are you running?

If they're Norton/Symantec/McAfee, junk them (that may be harder than it sounds, since those apps infiltrate your system like viruses). Sorry Argos, but, do you have stock in Symantec?

Everything I run in those departments is freeware.

I've not had a problem with invasions, etc., in, well, it's been years.

There's no need to pay some engineer to rescue your computer.

Just install AVG, ZoneAlarm, AdAware, and Spybot Search & Destroy. Then run the last two every day or so, and you'll be fine.

Re ZoneAlarm, read its help files. They're very well done and easy to understand, even for a non-techie.

Plus Firefox has add-ons such as NoScript and AdBlock that also serve as a wall of defense. NoScript is very important, because many nasty programs use Java et al to bypass your shields and install malicious software on your hard drive.

Remember, liberty depends on a well-informed citizenry (at least here in the US).

Sticks · #83 (**permalink**) 27-July-2007, 12:14 PM

I use Avast and Windows Defender plus the SP2 firewall on the desk top and the same, except Vista for the lap top

I junked Symantec long ago

As far as I am aware I avoided infection by not getting tricked into clicking a pseudo close button. I will try and look at getting the additional add-ons for firefox tonight, if I can for both machines.

tofu · #84 (**permalink**) 27-July-2007, 03:18 PM

It seems to me that reinstalling an operating system is less of a headache and less complicated than fixing one that is riddled with spyware. For some reason, people recoil at the idea of "all that work" to reinstall. But often, that little effort up front saves all the work that people like sticks go through trying to fix the computer.

Best of all, reinstalling is a repeatable task. Once you learn to do it, you do the same thing over and over again. Fixing spyware is detective work - more of an art than a skill.

I don't actually get spyware, but I do find myself installing various utilities and such and after a while, I do find that the computer starts running more slowly. So I take an afternoon to reinstall windows and I'm always happy with the results.

Sticks · #85 (**permalink**) 27-July-2007, 05:34 PM

I now have Adblock plus and NoScript

On the NoScript, for this forum, is it ok to allow google-analytics.com?

crosscountry · #86 (**permalink**) 27-July-2007, 05:39 PM

Quote:

Originally Posted by Sticks

I now have Adblock plus and NoScript

On the NoScript, for this forum, is it ok to allow google-analytics.com?

I don't allow it. No need actually.

Plus it saves you the trouble later on other sites.

You're saying Phil's blog gave you a virus?

Sticks · #87 (**permalink**) 27-July-2007, 06:03 PM

As far as I am aware I managed to stop it in time as Avast gave me a clean bill of health

One problem I have found with NoScript is that embedded wma files seem to be generating errors on one of my own webpages.

The script for embedding I use is

Quote:

Sticks · #88 (**permalink**) 28-July-2007, 05:29 PM

This is the latest

I print the church newsletter, and to save time, and so printers do not over heat, I print from Word on two printers simultaneously.

Whilst doing the printing I usually only have Outlook Express and Word open and not Windows explorer. There is never usually a problem, although the fan whirs up sometime.

Today I had WE open as well, and when it got to the last page on both printers at the same time, everything slowed to a stop. There was also a lot of disc activity.

I was just able to establish that it was not a scan by Windows Defender and via Task Manager, CPU usage was not high.

I managed to shut down WE and OE and eventually printing started, but it seemed to slow down, especially my lexmark 730, the fastest of the two.

After getting the printing done, I ran Windows Defender to do a scan (Clear)

Avast 4.7 was run (clear)

I even did a boot up scan with Avast - Nothing

All the evidence given me so far is that the incident on Thursday did not infect my system.

The people I have asked by phone do not think this is virus activity, although it does not make me stop feeling very wound up.

Has any one else had any problems with nasty pop ups because of ads on Phil's blog?

crosscountry · #89 (**permalink**) 30-July-2007, 10:20 AM

wow, good question.

Sticks · #90 (**permalink**) 30-July-2007, 01:53 PM

Ok

Today at work, when I was looking at Phil's blog, on my works PC, which being a civil service PC is supposed to be running top notch security, supported by a professional company, this pop up occured again.

This time I looked at the name before I went through the emergency kill procedures, and it is call Error Safe

Info from Symantec

Info from Yahoo Answers

The Symantec site has given me details of what to look for in terms of folders, which I plan to look at tonight when I get home.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode