help and i am fucking doomed

[stuveltje]

oke i hve tried to post on other boards didnt work, when reviewing this morning i got the coolwwwweb shit the virus in my puter, i went back to save mode run spy sweeper and other shit, after that i start up on normale mode. now my puter starts up very slow, i can get on icq anymore, i cant post on most boards anymore, alot is changed in my puter, the shit is gone, but problem is still, to slow and not getting to use all, any hint on this one? lol still wonder why this is the only board i can post, i have tried windows update dont work, mmm i wanna know where i can find the option in my puter restore system , i cant emmeber anymore, i use xp pro, i cant send emails, i get not enough memorie

[stuveltje]

Run this tool before doing anything else...it's specifically to get rid of that coolwebsearch shit.
which tool i cant see an link

[MadMax]

Hang on stu

File too large to attach, follow this link to download

http://www.intermute.com/spysubtract/cwshredder_download.html

[stuveltje]

do you mean cwshredder? it wont catch this one i have tried, it, it seems its away, but still something is in my pputer, i have search alot of google stuff to find the solution, what i found didnt give me the solution, but i am in deep shit now, all i know that this one isnt easy to remove

[stuveltje]

Hang on stu

File too large to attach, follow this link to download

http://www.intermute.com/spysubtract/cwshredder_download.htmlthanks i am trying that , damnn i am wrking on this one since 11 morning my time so thats 8 hours already, gonna try your link madmax

[stuveltje]

i cant get the link it wont work, oke final option before i throw my puter thru the window, where do i find the restore stystem thing in xp? and oh i wish the guy who gave me this will get all the diseases of the world

[Useless]

Try this direct link:

http://cwshredder.net/bin/CWShredder.exe

Should download immediately.

[stuveltje]

Try this direct link:

http://cwshredder.net/bin/CWShredder.exe

Should download immediately.
nop doesnt work, i have xcwshredder but its also known it cant remove the last version of cool webthing ,fucking shit damn fucking cheaters, mmmmmmmm i now need to know the restore system thing in xp, because i lost alot

[Cleo]

Maybe you need more Fruit in your work

[stuveltje]

Maybe you need more Fruit in your work
funny cleo, arghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh dont start now, damn i cant even put an stupid smilie, here, i think i have alot patience today because dealing 8 hours with some fucking shit , and believe me not a thing can protect you from this one, its getting on my freaken nerve now, and instead of talking about fruit, help me out will ya, where the hell can i find that restore thing

[babymaker]

hey stu :D system rstore should be here, i am win XP home tho but this should be same place:

all programs/accesories/system tools/system restore

hope u get this fixed

[stuveltje]

hey stu :D system rstore should be here, i am win XP home tho but this should be same place:

all programs/accesories/system tools/system restore

hope u get this fixedthanks bm thats what i wanted t know gonna try that one

[buttster]

Don't know if this will help

Important! A new variation of Coolwebsearch includes the CWS SmartKiller, which prevents you from reaching anti-spyware sites, and keeps Spybot and Hijackthis from working. In order to clean your system, you must first download and run a special Smartkiller cleaning tool.
http://www.siena.edu/antivirus/spyware/cws.asp

[Cleo]

instead of talking about fruit, help me out will ya
Sorry but I'm about as useless on Windows viruses as it gets since I don't use Windows.

Didn't this just happen to you less then a month ago? :(

[Jel]

Hi Stu,
I had this muthafucker a while back,
And got rid of it with the help of this forum:
http://www.techsupportforum.com/forumdisplay.php?f=50

Go to this thread first:
http://www.techsupportforum.com/showthread.php?t=15968

If you can't get onto that forum post here and I'll post the info here

[Stever]

The best way to remove this shit is a full restore. As in re-install the OS from the disks. Wipes hard-drive clean. just make sure you've backed up your important files.

Gallery and FreeSite reviewers should consider using a second cheaper machine dedicated to reviewing sites or surfing potentialy unsafe sites. That way when you do catch something you just wipe the hard drive clean and not worry about loosing data.

CoolWebSearch sucks, I've had it a few times. All the programs that claim to get rid of it don't do a good job. It gets so deep into your system, and its always changing to stay ahead of the anit-spyware. Got to clean the hard-drive completely or it will come back.

P.S. This is my 100th post here at Greeny. Happy anniversary to me!|party

[Jel]

btw in XP pro you need to go:
My computer> drive C> Windows> System32> rstrui.exe
Make sure in the left hand menu panel you can view hidden files and folders.

From what I remember, this won't get rid of the problem, but you WILL need to disable it when running the fix as the cws reinstalls every time if system restore is on.

Took about 3 days to get back up and running, it's a very busy forum over there, but they will and do get you back up.

[Jel]

Stever, that forum link I posted has guys that will get rid of it. Takes a few days but you don't lose all your work. Congrats on the 100th post btw :)

[stuveltje]

Sorry but I'm about as useless on Windows viruses as it gets since I don't use Windows.

Didn't this just happen to you less then a month ago? :(no cleo this one not, this one is the new one where butster is talking about, and for real its an huge pain in the ass, that coolwebthing, will get in your puter as an virus, i got it from a free site i reviewed this morning, cwshedder cant remove this one its to clean to find, your viru scanner will catch it but it wont be able to remove it, it use alot of your programs and files, its gone now, but with removining that one, alot of my files went gone also which makes my puter like shit, i can download te files but it wont instal, even system restore dont work, still i am not gonne whipe out my whole sustyem and instal it again, even it wll tak me all night or all week, i will get the thing , like always, and i apriciate all the help i got and get from all people, i owe you guys and girls!!!!!

[stuveltje]

like i said i have remove the think but my system is so slow and i cant use all no emails and all, i think i will use the xp pro disk ducth language to get over my stuff, damnnn i still wonder why i like to review this is the first time i had the collweb thing and right away the worse one too

[stuveltje]

Jell , can you please inform rowdy about my issue, i cant get on icq and all also i cant post on the newbie board i have tried a coupe of times, i have callled a guy who will help me out tomorrow,!!!

[stuveltje]

a jel i cant get t that forum, i cant get anywhere, damnnn i am so fucking doomed btw the guy who gave it to me too, a friend of my contacted his host with a nice message

[Jel]

NP stu, I'll let Rowdy know :)

[Jel]

Stu do you have a spare machine you can use to get on the net? That's what I done until I got things fixed up. Hope your guy sorts things tomorrow for you |thumb

I think that as you have removed the cws feature already that forum may not be much help at the moment, if you are still stuck after your guy turns up I'll post the tools needed here, and if it's OK with the Green Guy I can relay your info to the other place if you post it here. Not sure if the PM feature here allows for lengthy messages?

[stuveltje]

Stu do you have a spare machine you can use to get on the net? That's what I done until I got things fixed up. Hope your guy sorts things tomorrow for you |thumb

I think that as you have removed the cws feature already that forum may not be much help at the moment, if you are still stuck after your guy turns up I'll post the tools needed here, and if it's OK with the Green Guy I can relay your info to the other place if you post it here. Not sure if the PM feature here allows for lengthy messages?i dont mind if you post my info anywhere i just need to get out of this shit, i cant afford to loose all my stuff again on this puter i did on the last one and many thanks for the help i realy apriciate it .!!!!

[Mr. Blue]

Stu try using Microsofts spyware program, its in beta format and free...for me it's been the most effective in handling these problems. I use a combo of Avast and MS Spyware and I haven't been infected with a virus or adware in a long time.

I guess you couldn't use firefox to review as these things as they would slip by the review process?

[stuveltje]

Stu try using Microsofts spyware program, its in beta format and free...for me it's been the most effective in handling these problems. I use a combo of Avast and MS Spyware and I haven't been infected with a virus or adware in a long time.

I guess you couldn't use firefox to review as these things as they would slip by the review process?
mr bleu, yep i tried to use firfox for reviewing but most still use ie for building, the one i got my shit from use ie, damn i should have listen to , i believe it was raw alex or dare last time, when somebody use an name like phil collins...blacklist them because thats the fucker i got this shit from, i was helping pimplinks with reviewing .....and i am so doomed now, but watch me i ill be back.i will...

[stuveltje]

Stu do you have a spare machine you can use to get on the net? That's what I done until I got things fixed up. Hope your guy sorts things tomorrow for you |thumb

I think that as you have removed the cws feature already that forum may not be much help at the moment, if you are still stuck after your guy turns up I'll post the tools needed here, and if it's OK with the Green Guy I can relay your info to the other place if you post it here. Not sure if the PM feature here allows for lengthy messages?
i have 4 spares here in the house but i am afraid to fuck up frot the others, i used my hubbies puter to prnt hit and all to fix this, i am gonna try mister bleus thing, and if that not works the only selution will be reinstall xp pro, because the putere is telling me i miss .dll files, please bare my chinese but deling with this stuf for more thne 11 hours will make you tired

[Jel]

Well normally if you reinstall windows the only thing you will lose is your emails.

[stuveltje]

Well normally if you reinstall windows the only thing you will lose is your emails. still a weeeehhhhhhhhhhhhhhhhhhhh my old puter crashed 2 times i lost all, but then i have no other choise then to put the shit up again...will be tomorrow i am to tired now.....i wanna thank all for trying t help me, i realy realy apriciate it all, and i bow for you all, now me gonna kill some one to get loose of my stress............

[Mr. Blue]

Well normally if you reinstall windows the only thing you will lose is your emails.

Just backup your emails before you reinstall. You can do it manually or use a program called Outlook Express Backup. It'll create a self extracting archive and it also saves your bookmarks, rules, etc, for outlook.

I do a backup of my emails once a week just incase my computer dies on me.

[stuveltje]

Just backup your emails before you reinstall. You can do it manually or use a program called Outlook Express Backup. It'll create a self extracting archive and it also saves your bookmarks, rules, etc, for outlook.

I do a backup of my emails once a week just incase my computer dies on me.
yeah i saw an message that cnt send emails because some dll files are missing, i thought to fixed that to reinstall ie6 but it wont reinstal

[Linkster]

Stu - make sure that when you run those programs like cwshredder and hijackthis as well as spysweeper and your antivirus that you do it from safe mode (just start your computer and tap F8 a few times to get to the menu to choose safe mode) and make sure you are not connected to your net connection - if you have more than one user account on your computer you will also need to run those programs as the admin first and then each user

After you have removed everything (I sure wish you could post exactly what type of symptoms you are having besides being slow like any popups, or any particular virus/trojan being identified) I would run the hijackthis and post a copy of the log here or you can pm it to me

I would not recommend a system restore unless you are sure you have a good clean version - most of the good trojans these days attach themselves to the backup files first to ensure they stick around after a restore

[RamCharger]

The best way to remove this shit is a full restore. As in re-install the OS from the disks. Wipes hard-drive clean. just make sure you've backed up your important files.

Gallery and FreeSite reviewers should consider using a second cheaper machine dedicated to reviewing sites or surfing potentialy unsafe sites. That way when you do catch something you just wipe the hard drive clean and not worry about loosing data.

CoolWebSearch sucks, I've had it a few times. All the programs that claim to get rid of it don't do a good job. It gets so deep into your system, and its always changing to stay ahead of the anit-spyware. Got to clean the hard-drive completely or it will come back.

P.S. This is my 100th post here at Greeny. Happy anniversary to me!|party


Might I suggest an alternative to a whole other box? http://www.microsoft.com/windows/virtualpc/default.mspx
or
http://www.vmware.com/products/desktop/ws_features.html

Burn an ISO of your Windows CD to your box and you can (re)load a virtual machine in no time.

Better than buying a whole freakin other box and faster to reload. |headbang|

[Theproofhouse]

Scuse me, Would yo kindly keep youre language down please. There are children that read the boards.

[digifan]

Stu,

wish I could help but I have an old Fruit too... I hope keeping my fingers crossed for you is a little help.

[Mr. Blue]

Stu - make sure that when you run those programs like cwshredder and hijackthis as well as spysweeper and your antivirus that you do it from safe mode (just start your computer and tap F8 a few times to get to the menu to choose safe mode) and make sure you are not connected to your net connection - if you have more than one user account on your computer you will also need to run those programs as the admin first and then each user

After you have removed everything (I sure wish you could post exactly what type of symptoms you are having besides being slow like any popups, or any particular virus/trojan being identified) I would run the hijackthis and post a copy of the log here or you can pm it to me

I would not recommend a system restore unless you are sure you have a good clean version - most of the good trojans these days attach themselves to the backup files first to ensure they stick around after a restore

Excellent post, posting a Hijack this log is helpful...I'm not great at reading them, but the people that are can usually pinpoint all the things you need to do.

Describing the problem a bit more would also be good...I have a feeling you haven't cleared all the virus / adware that's present.

[juggernaut]

If you know the name of the file a few things you might want to try
1) go to control panel/admin tools/ local policy. once that is up and running create a new software restriction policy in the addtional rules section. make a new rule based on path. put in the path to the file and disallow. if you know of any other files that are related to this file is using create rule for them also.
2) go to start/ run/ type msconfig
go to services and check off hide all microsoft service. now uncheck everything. this is going to stop anything you might need running but this part is only a tempory thing to do. IE if you have a remote desktop service that is not MS software it will not run after you do this part. next in the same msconfig go to start up and uncheck everything except explorer. look in the command tab this will tell you the location of the a file that will run on system start up. if you are not sure what it is then leave it alone. but anything you know of ie (adobe update service) and shit like that. make sure the checks are removed. you dont need this crap hammering down your boxes resources. once you apply this then you will be asked to restart. DONT RESTART. make note of the location of that software. restart your computer in safemode. and go to the directories where they are to be siting. IE c:\program files\shithead software. And delete all the crap you can. You should be able to delete the whole thing. now also check your local administrators group. IE right click my computer and go to manage. Any user in that group other then you and administrator should be removed. now restart the box normally. and see if you can get to where you need to go on the internet. if all is ok, this next process could take some time. you have to go into msconfig again and re-enable every service you shut off one at a time and restart the box every time. Bring the box to a full shut down and wait about 10 seconds for the drives to stop spinning. turn the box back on and keep turning on your services that you had shut off one at a time until everything is ok. if you find you are not able to get out to the internet sites after you reenable one then that is the fucker. Find its location and remove it. if you need software to remove the service let me know you can get them off of any windows resource kits. I'll throw up the service removal one for you. hope this helps. Just in my opinon I would just dump the box and rebuild it. I dont bother with any spyware or any filter software anymore. it ruins my internet experiance. i just run a virus protection and rebuild my boxes every 3 months nice and clean. shit xp load a new box in 20 minutes, all this time you have spent today trying ti fix this, and you could have been up and running clean and new. jugg.....

[MrYum]

Ouch...so sorry to hear about this Stu :( Farging iceholes installing this crap should be rolled in honey and tied to a fire ant mound |angry|

Looks like a lot of good ideas have already been proferred...hope you get it fixed soon!

I'm doing site reviews in FF. I have found that FF is less forgiving of bad code than IE. So, I made that one of the rules on my list...make sure your code is FF compliant. Haven't noticed any real problems or had any resistance from submitters...yet...

Good luck Stu!

[stuveltje]

linkster, i have done all that, i have no pop up no virus , but it seems with removing the bad stuff, i re moved alot of my ie .lol. so my internet exlporer doesnt work anymore ad i cant reinstal it to, and my system restore dont work anymore, na i will reinstal xp today

[cd34]

you might be able to install firefox, which would then let you get the MSIE 6.0 downloader.

[MrHackula]

Sorry I am late to the party Stu. We have been reconfiguring our life again.

Without more information, I can't fully help you.

Here is the link to re-install IE:

http://www.theeldergeek.com/repair_reinstall_ie_and_oe_6.htm

... The odds are you still have adware on your system.

If you can get to this URL:

http://housecall60.trendmicro.com/en/start_corp.asp?id=scan

...Run that scan. The full one, spyware and virus.

If you cannot start hijackthis, just rename the file to something else and run it.

If you can download the Microsoft anti-spyware beta:

http://www.microsoft.com/athome/security/spyware/software/default.mspx

... then go ahead and install that.

Do a search in your C:\windows folder for *.com

anything that shows up as being 1k files size, go ahead and delete it. This puts files in the directory called regedit.com, ping.com, etc...

This is for discouraging a fixable solution. You see windows will always run the .com before the .exe if there are two files of the same name with different extensions.

If you post your hijackthis log, I can tell you what probably doesn't belong.

I would advise you to install:

http://www.javacoolsoftware.com/spywareblaster.html

...and :

Spybot Search and Destroy:

http://www.safer-networking.org/en/download/

... Make sure you turn on the S&D resident scanner. "TeaTimer" This will alery you to attempted changes to your registry. This way you know exactly which site you were reviewing when the bad stuff happened, and... Who to blame.

I also run:

http://www.mlin.net/StartupMonitor.shtml

... which has largely the same functions as the tea-timer, but catches things it might miss.

I have been running a TGP since 1999, and have been dosed with everything ever put out before the detectors would detect it.

Formatting your hard drive should be your last option. This way, if you beat the little bastard out of your system, you will be setup to repel future invaders.

I will wait to see your hijackthis log.

23 years in computer repair and it has come to chasing bugs. |angry|

Mr. H.

[stuveltje]

wowwwwwwwwwwww Mrhackula :D i am wokrking on it thanks

[stuveltje]

Logfile of HijackThis v1.99.1
Scan saved at 13:46:57, on 24-5-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\QUICKH~1\QHWSCSVC.EXE
C:\PROGRA~1\QUICKH~1\QHONSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\QUICKH~1\QHM32.EXE
C:\PROGRA~1\QUICKH~1\MailSvr.exe
C:\PROGRA~1\QUICKH~1\UPSCHD.EXE
C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\system.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\QUICKH~1\QHONLINE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\locator.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\hopeloos\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Quick Heal Startup Scan] C:\PROGRA~1\QUICKH~1\QHSTRT32.EXE /LOADRUN
O4 - HKLM\..\Run: [Quick Heal On-Line Protection] C:\PROGRA~1\QUICKH~1\CATEYE.EXE
O4 - HKLM\..\Run: [Quick Heal Messenger] C:\PROGRA~1\QUICKH~1\QHM32.EXE
O4 - HKLM\..\Run: [Quick Heal e-mail Protection] C:\PROGRA~1\QUICKH~1\MailSvr.exe
O4 - HKLM\..\Run: [QH Office 2K Check] C:\PROGRA~1\QUICKH~1\O2KCHECK.EXE /CHECK
O4 - HKLM\..\Run: [QH Live Update Scheduler] C:\PROGRA~1\QUICKH~1\UPSCHD.EXE /Check
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\RunOnce: [Quick Heal Startup Scan] C:\PROGRA~1\QUICKH~1\QHSTRT32.EXE /check
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096750544656
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Quick Heal Helper Service WSC (qhwscsvc) - Unknown owner - C:\PROGRA~1\QUICKH~1\QHWSCSVC.EXE
O23 - Service: Quick Heal Online Protection - Unknown owner - C:\PROGRA~1\QUICKH~1\QHONSVC.EXE

[ronnie]

I agree with Mr Blue, the MS anti-sypware program works very well. Only thing, it usually takes a good number of scans before it gets rid of everything. Last time I had some nasty stuff it took about 7-8 scans, but it did get rid of it. Many other programs never even found what I had.

ronnie

[N J]

http://www.hijackthis.de/en use this or similar for a quick analyse of your hijackthislog!

Great to see how helpful people are!

[RawAlex]

The best way to remove this shit is a full restore. As in re-install the OS from the disks. Wipes hard-drive clean. just make sure you've backed up your important files.

Gallery and FreeSite reviewers should consider using a second cheaper machine dedicated to reviewing sites or surfing potentialy unsafe sites. That way when you do catch something you just wipe the hard drive clean and not worry about loosing data.

CoolWebSearch sucks, I've had it a few times. All the programs that claim to get rid of it don't do a good job. It gets so deep into your system, and its always changing to stay ahead of the anit-spyware. Got to clean the hard-drive completely or it will come back.

P.S. This is my 100th post here at Greeny. Happy anniversary to me!|party



Stever, I have found that declining all sites with scripts, iframes, and other outside sources has certainly decreased the amount of junk I am forced to deal with (and that my surfers have to deal with too). As I determine new methods for adding stuff on pages, I add that to the bot filter so that my surfers are not subject to this crap.

If more TGPs and such spent a few minutes actually pre-checking stuff, there would be much less crap out there in the world.

Oh yeah, firefox instead of IE is a HUGE help... not a total fix, but moves me from 99% to 1% pretty much directly!

Alex

[stuveltje]

mmm i did the housecal mirotrend thing he found 4 infected files, after that one i did the spysweeper i have myself and that one found Mitglieder_trojan, housecall didnt catch that,

Raw alex was it you who said that time to ban all the people who use fmous names, like the Phil Collins guy? well from his site i got this shit, i was doing some of the reviews at pimplinks and that ones had the coolwwwweb shit in filled my puter with virusses, even my virus scanner catch most

[f69j69b]

hi Stu
in your hijackthis log
"C:\WINDOWS\System32\system.exe"
may be the problem
go here to read about this before you delete this as I am not 100% sure
http://www.answersthatwork.com/Tasklist_pages/tasklist_s.htm

Fred

[stuveltje]

hi Stu
in your hijackthis log
"C:\WINDOWS\System32\system.exe"
may be the problem
go here to read about this before you delete this as I am not 100% sure
http://www.answersthatwork.com/Tasklist_pages/tasklist_s.htm

Fred
oke thaks me gonna read

[stuveltje]

i cant get on the link fred i get time out

[stuveltje]

that file you pointed me at is infected with the midglieder trojan thing

[f69j69b]

Stu then dont delete it because like I said I'm not 100% sure and wouldn't want to be the cause of making it worse wait and see if someone else that reads the hijackthis log agrees with me.

ok then if that is a virus let hijackthis fix it
Fred

[MrHackula]

wowwwwwwwwwwww Mrhackula :D i am wokrking on it thanks

You are welcome.

Now, the mitglieder worm you already know about. Here is the details page at symantec:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.mitglieder.b.html

The most interesting line is this one:

"The Trojan also downloads and executes PWSteal.Ldpinch"

... so any common passwords in use are to be suspect and should be changed.

For the hijack this log... There is another tool you might find helpful if you can't reach the first:

http://hjt.iamnotageek.com/

In my opinion the only really bad thing there was already pointed out by someone else(f69j69b):

C:\WINDOWS\System32\system.exe


The actual file in this case is called:

"ssgrate.exe"

... it is just lyint to the system process manager to make it think it has a true filename of: "system.exe"

Read the removal instructions at symantec's site (linked above) and all should be well.

If you need anything else, just ask.

Dealing with this shit is fun, isn't it?

Now you know why my blacklist is up to 67,126 domains.

Pity there aren't enough non-"traffic-trading" (circle jerk) sites out there to bother making a communal blacklist.

Most sites approve anything because the surfer only has a 1-10 chance of seeing an actual gallery anyway. :-(

I hope it is easy fixing from here on out.

Mr. H.

[stuveltje]

You are welcome.

Now, the mitglieder worm you already know about. Here is the details page at symantec:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.mitglieder.b.html

The most interesting line is this one:

"The Trojan also downloads and executes PWSteal.Ldpinch"

... so any common passwords in use are to be suspect and should be changed.

For the hijack this log... There is another tool you might find helpful if you can't reach the first:

http://hjt.iamnotageek.com/

In my opinion the only really bad thing there was already pointed out by someone else(f69j69b):

C:\WINDOWS\System32\system.exe


The actual file in this case is called:

"ssgrate.exe"

... it is just lyint to the system process manager to make it think it has a true filename of: "system.exe"

Read the removal instructions at symantec's site (linked above) and all should be well.

If you need anything else, just ask.

Dealing with this shit is fun, isn't it?

Now you know why my blacklist is up to 67,126 domains.

Pity there aren't enough non-"traffic-trading" (circle jerk) sites out there to bother making a communal blacklist.

Most sites approve anything because the surfer only has a 1-10 chance of seeing an actual gallery anyway. :-(

I hope it is easy fixing from here on out.

Mr. H.
thanks it seems i got rid of the thing but i got rid of more then needed, i still need to reinstal some of ie and my mail because they dont work good anymore. what a hell, so i am not done yet....i will be back here question is only to ask more or to say i did it:D

[stuveltje]

oke have runned all the programs now, it looks its gone, but, there is the but....puter is slow with starting up, sintetnet exploere is still fucked and firefox is finme, i tried to reinstal ie with the setup i have, but the puter said cant find iesetup.inf or something like

[Dan]

you should have let me get someone else to do the sites |satan|
what a pain in the ass it been so sorry |cry|
hit me when you back ok |waves|

[Cleo]

Until next month when you get to go through all this again…

[stuveltje]

you should have let me get someone else to do the sites |satan|
what a pain in the ass it been so sorry |cry|
hit me when you back ok |waves|na dont be sorry, its the latest of coolwwwsearch thing which attacks you as an virus, could been anybody who got hit with it, ii had most of the programs mentioned here on my puter
and no virus scanner would catch it, its like symantic said , it has to be removed by hadn also, cwshredder thing couldnt find it but it was there.na i think i can be safe now for awhile with firefox, because thats the only one who does work on my puter. i am gonna review this eve again. i have send opti also pm, because all my pass and ids are whiped out too.

[stuveltje]

Until next month when you get to go through all this again…
well when it happens to me its everytime an other thing, this one i never ever had , while its bin around since i believe august 2004, but sure it was learning again. And its realy great to see how many people are popping in to help, this way others can learn also about the problem :D

[stuveltje]

oke uodate even with all the help here, it didnt work, well it did work to get rid of the coollwww and the 100s of other strange stuff in it, but my files are so damnage that xp cant work good anymore, even putting files back from the disk wont work, so what i am going to do is, totally reinstal xp but then with xp sp2 with it, i am gonna back up all my stuff i need and i ned to do something with those emails, because i dont know how to put my emails in an folder so i can burn them on cd . I realy realy wanna thank all for the help it was realy apriciated and you guys are the best!!! btw i have an totally upgrade and updated puter ready just incase i fuck up reinstalling xp pro again.:D

[ronnie]

oke uodate even with all the help here, it didnt work, well it did work to get rid of the coollwww and the 100s of other strange stuff in it, but my files are so damnage that xp cant work good anymore, even putting files back from the disk wont work, so what i am going to do is, totally reinstal xp but then with xp sp2 with it, i am gonna back up all my stuff i need and i ned to do something with those emails, because i dont know how to put my emails in an folder so i can burn them on cd . I realy realy wanna thank all for the help it was realy apriciated and you guys are the best!!! btw i have an totally upgrade and updated puter ready just incase i fuck up reinstalling xp pro again.:D

In XP there is a "Settings and Files Transfer Wizard", you can use to back up/burn your e-mails and put them back in on another system or fresh OS. Worked for me...:)

ronnie