Thetownend.com

Somehow our computer had completely reset itself.

Everything has gone, and when I click to go on the internet, it comes up with a box with a load of drabble about connectivity etc...

The only way I can get onto the internet is by going onto msn and clicking on my mail.

What do I do?

buy a new one.

Knife someone right up their own guts

In IE make sure your connection settings are set to never dial a connection and your LAN settings option is set to automatically detect settings.

picnic

? :?

problem in chair not in computer.

XP? Yiou could try a system restore to an earlier (working) date I guess.

Working in IT Support has changed you sonic  :D

Or just do it is by going onto msn and clicking on my mail

How do you do this?

Still not working, cheers though.

Your computer has the aids I think. Run your anti virus and anti-spyware

Right, my Comp is riddled with adware / spyware my silly fault for downloading dodgy software from the web, what is the best freebie cleaner out there as it looks like it has loaded lot's of it ??

Looking at download.com there seems to be mixed review on the ones from there.

Spybot Search & Destroy

Hitman Pro, which includes Spybot Search & Destroy.

Dazza may be right that Hitman Pro is better (and I'd certainly not argue with anything called that!) but Sypot S&D is the nuts.

Hitman Pro is a composite of programs that includes Spybot S&D and a few others so it ticks all of the boxes and ensures everything is picked up.  Plus it’s free!

Excellent Thanks I will give this a go when I get home in a bit, anything to get rid of those annoying pop up web page ads !

Well run it last night and it found about 20 instances, took something like 3 hours to complete so tried IE and still getting adware - will run again tonight, failing hat I may just re-build the computer (and watch what Torrent's I download next time)

Can't imagine that Spybot S&D would miss anything that would cause pop-ups. Might be worth trying Adaware to see if that picks up anything else. Also, did you do it in safe-mode?

I wouldn't be as drastic as re-formatting - that's worst case scenario. Try using Firefox, shouldn't get any pop-ups with that.

Unless your ISP have decided to go with that Phorm advertising thing.

Run a virus scan as well and you also have the pop-up blocker in your privacy settings enabled.

I didn't tick the safe mode box ?....should I have  - although it did say about it needed to remove the desktop & taskbar while scanning which it did

I'm surprised but it did find 20 odd occurances and seemed to clear them, I am going to try tonight again though, instead of letting 2 or 3 scan the drive I'll just use Spybot S & D and see what happens.

I'm sure my isp (talktalk) isn't using Phorm as it has only been gonig since I think I downloaded a couple of dodgy torrents about a week ago

I will only re-format as a worse case though

If you want you could download an application called hijack this. When you run it, it gives you a log of what is running on your machine. If you paste all the text of the log into this forum I will have a look at it later and see if anything dodgy is running.

Don't reformat because you will lose all your drivers and settings and that is a pain in the arse.

http://download.hijackthis.eu/HJTInstall.exe

I've got a restore CD so not bothered about re-loading XP, but yeah it would be a pain having to re-install all my odd equipment and email etc (sp)

If Spybot don't fix then I'll have a look at that hijackthis and post the log see if you see anything I'm missing

Best thing to do is start the PC in safemode the run the scan, otherwise the Spyware gets loaded during boot-up and the scan won't be able to remove it if it's already running or hiding inside another running application.



Yeah, it probably isn't - but be warned that TalkTalk have signed up to the Phorm service so they might start selling your browsing habits in future!

Right, loaded Spybot in Safe mode and it found nothing, went into IE and all was fine....just slow.

After a while just all of a sudden I start getting adware (at the moment mai ones are BA & Clairvoyance !) opening up and IE is soooo slow, if I close it down and open up a page it is fine but go from 1 page to another is nigh on impossible.

I have run Hijack this here is the contents of the log file....any help appreciated, this is getting daft

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:11:57, on 03/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Nero\Nero8\InCD\NBHGui.exe
C:\Program Files\Nero\Nero8\InCD\InCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 3\HOMERunner.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.swindontownfc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\PAUL&S~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Microsoft WinUpdate] C:\WINDOWS\system32\mslatest_updt.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero8\InCD\InCD.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [1018c977] rundll32.exe "C:\WINDOWS\system32\vjsguqah.dll",b
O4 - HKLM\..\Run: [BM132bfaeb] Rundll32.exe "C:\WINDOWS\system32\jbedydro.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 3\HOMERunner.exe"
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1196704030000
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 8330 bytes

If you still have hijackthis open tick the follwing entries to fix:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O4 - HKLM\..\Run: [1018c977] rundll32.exe "C:\WINDOWS\system32\vjsguqah.dll",b

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

If not open run it again and then check the boxes to fix those entries.

There's possibly another couple of entries that may need fixing but sort those out first. I know for a fact the top one is buggering up your IE

A lot of the shit you pick up off the internet is from those "are you a werewolf?" games on the facebooks.

That and looking at grumble on the web.

Stating the obvious there of course.

start->run    
type in msconfig
Hit "OK"

"System Configuration" app will appear, select "Launch System Restore"

"System Restore" app will appear, select "restore my computer to an earlier date", pick the last restore point before the date everything went wrong.

May not work, but worth a try if you haven't fixed it already.

i seem to be doing less support everyday that passes. i pretty much sit there and run the place now.

If you're the boss, can you get me a job?  :D

I'll give this a go tonight, I gave up last night as it was such a struggle to get to anywhere on the web it would let me look at 1 or 2 sites and then just sit there searching...and in between the adware was popping up....I was just getting more and more wound up as I looked through stuff trying to find any problems....

Done that, still got adware popping up, symantec found a virus which it cleared and keeps blocking another so I'm runnig norton at the mo to see if it exists.

The one highlighted above did not exist when I run this again but I also got rid of all nero startups

IE is also still playing up when you try and go from say one page of TEF to another

System was complaining about c:\windows\sys32\vqfjgak0.dll could not be run so I removed that as well

Also something is disabling windows update on boot up

Any more ideas ?

this is ridiculous - I've now run adaware 2008 freebie and it found 23, and cleared them but I'm still getting ad sites coming up......I will run ad ware again and see if it picks anything else up then run spybot see if that get's anything else

Oh and I've un-installed Nero 8 as I think that is possibly when it started after installing that....maybe

Simple answer - If you don't want pop-ups then don't use IE.

And did you run the scans with the PC in safe mode this time?

Run the scans in safe mode. If that doesn't work then disable system restore and then run the scans.

Do this my by right clicking on my computer, select properties and then the system restore tab. You can then disable it here.

Where did you download nero 8 from?

Done all that already, looks like I have now cleared all adware, just run ad aware about 3 times and each time it found some last scan found none.

IE is now running really badly, goes onto some sites but others just sit there trying and trying, I will try re-installing IE.

Something has stopped the service for automatic updates and it will not let you re-start the service just errors everytime about cannot run script

Downloaded Nero 8 from a Torrent site.

You have nothing to lose by running hitman pro (mentioned earlier by Dazzza). It will repeat some of what you have done, but it may well run a program that you haven't that'll detect it. It should be fully automatic once you  press 'go'.

http://www.hitmanpro.nl/hitmanpro/content/view/3/9/lang,en/

If you're going to download torrents you should always try and read the comments to check if people have warned it's a virus and the such. Always do a scan on the file as well.

Try to turn on automatic updates in msconfig

start>run>msconfig>services

Failing that

start>run>services.msc

right click on auto updates and make sure it's set to startup automatically in the properties

That is how I was doing it but with no joy, I think all adware etc has now gone but I'm assuming it has left nasty emlements behind.

I did read the torrent info and there were no comments....it has taught me a lesson though to be extremely careful and to scan files before trying to install.

I think my weekend may be taken up rebuilding the computer at the moment.....

I've finally admitted defeat every time I scan it and it is clean go to IE and off we go again scan and it found at least 5/6 instances of adware, then something it stopping the windows update service, everytime I start it it stops itself again for no rhyme or reason, then IE is so fuckin slow as well.

Just going to be a damn site easier I reckon to re-build, the only annoying thing is I'll lose all my emails as I don't think there is any program that can backup your inbox (unless anyone knows of anything ?)

That's my weekend sorted...and the Mrs moaning I spend more time on the computer than with her  :o

Don't you work in IT?

Two points (that have already been made):

Why are you persisting in using IE then complaining about pop-ups, security holes etc?
Why aren't you using Spybot S&D or Hitman as others have advised? Adaware doesn't catch a fraction of what they do

And apologies if you've already answered those in the rest of this thread. Life's too short and all

I recommended Adaware after PTP ran Spybot and said it didn't catch everything.

I like nice things and I like IE.....it is usually fine but I do take your point..irelevant now as the comp is shagged !

And I have been using spybot also but that was not finding anything either and then it was again

And Si Pi I do work in IT but the useless gits I work with know nothing so it is always good to talk to others who are actually knowledeble who may come up with something I have not thought of....there's been a few good ideas

I just found it quite ironic that someone who works in IT wouldn't scan something from the internet, least at all a dodgy download.

who are you?

who are you?

I know very silly.....for some stupid reason I thought it would be fine as I had downloaded stuff from there before and it had been fine.

Taught me a very harsh lesson that's for sure..won't be making that mistake again !