My vacation and PC woes (*&%$%#!!!!)

thartley

thartley

Veteran
I went on vacation starting yesterday and turned my pc on to find that I had been hijacked and loaded up with nasty stuff. I've been working since yesterday, running ad-aware, spy sweeper, spy bot S&D, norton, loaded Stopzilla for pop-ups. Cleaned up in safe mode, etc, etc, etc..... and I still have a prob with two (or three) things that I cant get rid of. Common Hijackers and IGetNet that are giving me re-direct hosts.
ieautosearch=69.20.16.183
search.netscape.com=69.20.16.183
auto.search.msn.com=69.20.16.183

I feel like a monkey doing brain surgery. :'(

*deep breath* ok, I am going to go eat lunch and try not to pitch this infernal machine out a window.
 
Re: My vacation and PC woes (*&%$%#!!!!)

nevermind on lunch....the cat just took off with my pork chop.
 
Re: My vacation and PC woes (*&%$%#!!!!)

A lot of the hijackers out there rename themselves on the fly and are very difficult to remove. A lot of spyware removers just can't catch them.

Best to do is manually get rid of them one at a time. Time consuming and tricky. A firewall is a must.

Search each description individually and print out any how to's you can find to remove. Disconnect the internet and try going through and delete them manually. Most will be in system folder - Then run a full virus scan from boot. (try this first - Sometimes it catches them too. Update dats)

It could take a **** load of work to get them all and if formatting the system and fresh install is a possibility you can always do that.
 
Re: My vacation and PC woes (*&%$%#!!!!)

Don't worry thartley. We'll fight those nasty computer invaders. Nobody hijacks a DVXusers computer and gets away with it!

I found this, which might help. These are not my words, but the guy sounds like he knows what he's talking about and gives 3 solutions. Be VERY careful.


Here’s a basic low down on the spyware/adware bug.

Once infected it installs a list of adware/spyware programs including Wintools, 180 Search Assistant, and much more.

Your hosts file becomes “hijacked” and if you try to delete or edit it, you will succeed in doing so, but seconds later if you check back, it returns.

Adaware, spybot, Giant, Hijack This, and everything else does not fix it. Adaware, spybot and Giant will however clean out 180 search, wintools and the other spywars installed, but they return because of the Look2Me bug installing spyware/adware over time. As this bug resides on the system, it will continue to install spyware and adware as long as the machine is connected to the internet.

Upon further researching this, I found there are a speciffic 2-3 random generated DLL’s located in the system32 folder ( there also might be a file called guard.tmp). These files cannot be deleted in regular mode nor safe mode. And upon every reboot, the DLL’s are renamed.

As of right now, there are no programs or fixes to clean this bug, however I have installed the same variant on my home machine and messed with it some more because the fixes some people posted online didn’t work and some related to the older variant of the Look2Me. I also did some more research and have figured a couple ways to get rid of this.

Resolution A:
1) Run adaware and spybot to get rid of all the adware and spyware it installed. Adaware and spybot will want to reboot and run since files are in use, I did not do this.

2) Open Msconfig and disable suspicious loading files (I would recommend disabling all and then coming back after the spyware is gone to re-enable virus protection and everything else)

3) Run regedit and check out HKLM>Software>Microsoft>Windows>Current Version> Run and Run Once – Make sure nothing suspicious is in there.

4) Open up system32 folder and View by Details and Arrange by Size. Scroll down to where the file sizes start to hit 217-220 kb. Right click these files and view properties, make sure under Version or Summary that they include Microsoft’s name. If they do not say Microsoft, write down this filename to be deleted. Check all files from 217-220 ( I personally only found these files 218-220 but somebody online said they got one that was 217). You might be able to tell right away the files are made up or if you see guard.tmp. There’s 2-3 files, so once you have them written down, time to download a program.

5) Download KillBox. This is the site http://www.bleepingcomputer.com/files/killbox.php ; here’s the download link http://www.bleepingcomputer.com/fil...are/KillBox.zip

6) Once download, extract the file and run it, in the “Full Path of File to Delete”, type in the path to each of the files you written down. Check the boxes for “Delete on Reboot” and “Unregister .dll before deleting.” Click the Red X on the right. It will tell you file will be deleted upon reboot, and ask if you want to reboot, choose no and then click on OK.

7) Repeat step 6 for the rest of the files you wrote down. On the last file, say Yes on reboot.

8) Upon rebooting, if you look at your system32 folder, those files will be gone and nothing suspicious will be there as they were before.

9) Delete your hosts file

10) Run adaware and spybot. Also clean out temp files, internet temps, etc.

11) Uninstall anything left in Add/remove programs that spybot or adaware didn’t get.

12) Check msconfig and regedit to make sure nothing else is there.

13) Reboot and check things out, should be ok.


Resolution B:
Do steps 1-4 of Resolution A. Reboot with xp or 2k cd in or if running 98 with a boot disk. Boot into recover console and delete the files manually for 2k/xp. For 98, delete manually once booted from boot disk in dos. Reboot and follow steps 9-13 of Resolution A


Resolution C:
Do steps 1-4 of Resolution A. Turn off computer, and take out HD. Put in another computer and boot up and delete the files. Shut down, take out HD and put back in original computer. Boot back up and do steps 9-13 of Resolution A.

Obviously A is by far the easiest and most practical, but in case they can’t get online or their system is just soo slow and unstable to where getting online is not going to happen, Res. B and C are the next best approaches.
 
Re: My vacation and PC woes (*&%$%#!!!!)

I haven't used my PC for weeks because of these thugs. They should all be beaten with ball peen hammers.
 
Re: My vacation and PC woes (*&%$%#!!!!)

Sorry to hear that mayhem struck your 'puter. I agree, it is so evil, this hijacking stuff. One of the worst things one can do is rob someone else of their time. What a nuisance. Be patient, eventually you'll clean it up.

This has happened to two of my friends. One ended up wiping of the drive completely and doing a whole reinstall. For another person, so many parts were paralyzed and it would take to much time to recoup, he bought another computer to use while fixing the other.

Good luck!
 
Re: My vacation and PC woes (*&%$%#!!!!)

Hey Thartley. This problem is so common now and is really a pain in the ass. I have tried to fix my system before and rid it of this crap but never completely got it out. I decided to attack the problem from a different angle. I developed a system that always has all my important work ready to archive at all times. The good stuff gets burned to DVD probably once or twice a week. Then I steamlined the rebuild process so all the essential software I need on my system is also archived onto one or two DVD,s Now I can have my system wiped out and rebuilt in three hours or so.(way less time than poking around in code)
In addition, I installed Zone alarm pro Which does not let anything in or out of this system without my say so. During my last rebuild I had a thought. We need to find out where these shitheads live who write this malicious code and perform a few carefuly placed surgical head bashings until the little cretins understand that they're messin with the wrong people. For me It always seemed faster to wipe the system and rebuild that ferret out all the crap. As far as I know, there is no software written to fix the cat/porkchop virus. For what it's worth I keep the cat food bowl full 24/7 and neither of my cats show any interest in human food ( Except Tuna!!!!)
Mino
 
Re: My vacation and PC woes (*&%$%#!!!!)

I can definitely feel your pain because my main computer is in pieces after a long but noble battle.  Despite a good firewall, virus checker, Ad-aware, Spybot precautions, I got some malware that can't be removed.  I've gone through every recommended procedure and like you, the stuff can't be totally vanquished.  So, I'm rebuilding everything now and my music vid project is on hold until I get everything running again.  Spreading this stuff should be a felony and I'll leave it to the nice people in prison to exact my revenge.  ;)   On the slightly positive side, the Federal Trade Commission is starting to go after the scum that do this, so eventually the situation may get better.
 
Re: My vacation and PC woes (*&%$%#!!!!)

Hey Thartley...Almost forgot to mention my other line of defense. I got a cheep older system who's job it is to voyage on the net just OS and browser on that one. It has small hardrive and can be rebuilt in an hour. It is networked to the other workhorses. All three loaded with zone alarm as firewall and Uncle Norton to gaurd against viruses.
 
Re: My vacation and PC woes (*&%$%#!!!!)

Thanks for all the sympathy...misery loves it, you know. I have gone to safe mode and run all the usual tricks, run regedit armed with known items to delete and was able to get rid of quite a bit lastnight, gone to System32 folder and got rid of one bad file that happened to be 219kb, gone to msconfig and disabled on questionable .exe

Maybe I will just wipe this one (read: call someone who knows what they are doing) and reload. That is just a BIG PAIN in the "powerword"!!!

And like Mino said, I also have a different system that is basically just for junk online. I also have a teenage daughter who loves gaming and the fact that I have highspeed on this one. >:(

At least I am not alone in this hell. I am, apparently, in good company. ;D
 
Re: My vacation and PC woes (*&%$%#!!!!)

I too recently set up an older pc for just the net. My graphics/video machine is hooked up to nothing but the camera. Without the need for all the "creep software" like virus scan, firewall, spyware and so on it runs way better and way faster. If my internet unit gets ass f**ked by crap I can't remove I just flush and go. A pain in the ass but nothing important is ever at risk.

Hope all works out for ya.
 
Re: My vacation and PC woes (*&%$%#!!!!)

am I just paranoid?

When I was trying to help my friend get rid of the baddies, we were downloading all that "spyware, spybot, etc..."

I just kept thinking, what if these little "cure alls" were actually adding more crap to your system? Becaues you don't know anything about that free software "provider.."

where does it end? do you have to buy the spy stuff from the store in a box to know it will be okay?
 
Re: My vacation and PC woes (*&%$%#!!!!)

[quote author=Pooh link=board=Offtopic;num=1103299651;start=0#11 date=12/17/04 at 12:04:08]

I just kept thinking, what if these little "cure alls" were actually adding more crap to your system?  

[/quote]

Some do, yes >:(

Read reviews on the software first. If it's crap you can find out fast.

There is no cure all - I have 4 different scanners and they all catch different ****. Its a battle no matter what but I still think a good firewall is key. Zone alarm has served me well. If you refuse to run any pop up programs you can fend off a ton too. NEVER install on demand.
 
Re: My vacation and PC woes (*&%$%#!!!!)

Here's my simple solution to this ****** problem. I have to Comps, one computer just for internet like the one I'm using now. The other computer is stricktly for editing,graphics,etc and has absolute no internet at all. They can hijack or do whatever they want with this one.

nevermind on lunch....the cat just took off with my pork chop.
Click to expand...

Never leave your porkchop unatennded. :)
 
Re: My vacation and PC woes (*&%$%#!!!!)

I'm thinking a swipe is going to be the easiest thing. Pray that I have a ghost image to reboot from.
 
Re: My vacation and PC woes (*&%$%#!!!!)

Okay, I have now officially cracked. :P To really get a flavor for my life, please see below:
1. hijacked and totally messed up system
2. had to call someone I used to date and ask for help
3. I fed him dinner and he stayed til 10:30p lastnight, and the problem persists today.
4. I worked on pc all day, cat ate my lunch
5. problem got so bad, I cant keep a page loaded.
6. remembered I have a ghost image of my C:drive in the root of D: cool. Now, if I can just boot up from disk and get into DOS, then I can reimage my C:drive.
6. I only have boot disk on floppy. I have no floppy drive in infected machine.
7. I go to my backup dial-up system over here (which I am now on) and get link from my brother via yahooIM to make my own boot disk, only to find that my cd-rom on this system has died.
8. had to call same guy from lastnight to come out again this weekend with HIS boot disk. I made the observation that it seems I am using him. He said he wouldnt care if I was.
9. Now I feel bad for that, too.

:(
 
Re: My vacation and PC woes (*&%$%#!!!!)

You have a Tom Hanks - Meg Ryan movie there! - Add some humor and you are set! ;)
 
Re: My vacation and PC woes (*&%$%#!!!!)

[quote author=thartley link=board=Offtopic;num=1103299651;start=15#15 date=12/17/04 at 15:51:20]I made the observation that it seems I am using him.  He said he wouldnt care if I was.
9. Now I feel bad for that, too.
:([/quote]

Don't feel bad. He wouldn't even bother if he didn't want to at all. Men love to fix things, yes?

Sometimes I even break things, just to get them fixed! only kiddin' :)
 
Re: My vacation and PC woes (*&%$%#!!!!)

[quote author=TC link=board=Offtopic;num=1103299651;start=15#18 date=12/18/04 at 08:18:49]Ahh, the bliss of technology.[/quote]

TC--took you way, way too long to jump into this thread? your explanation?
 
You must log in or register to reply here.
Back
Top