Somethin wrong is goin on!!

hi everyone

a new kinda virus has affected my computer. Actually i went to site called www.serials.ws for gettin some serials. But, all i got from that site was a GOD DAMN VIRUS.

What it does is, it automatically starts an iexplore.exe i.e. it doesnt open a new internet explorer window but when I press CTRL+ALT+DEL i.e. the Task Manager, i see this process runnin. And it keeps on generatin new processes like that after some time interval. And it only works when i am connected to the internet. So, here's wat it happens:

1. My computer works fine until its connected to internet.
2. After the computer is connected to the internet, the process iexplore.exe starts by itself. Remember, no Explorer windows opens. But, it's listed in the process list in the Task Manager menu. And multiple iexplore.exe processes keeps on starting by itself.
3. To stop it, I either keep on checking from time to time the Task Manager process menu, n terminate the suspected processes(sometimes, i even end up closing the actual iexplore.exe on which i m working!). And if i dont terminate these processes( from Task Manager process menu), after sometime I get a message "The webpage you are viewing is trying to close by itself, Press Yes to continue or No to cancel". So, if I press "yes", one of those iexplore.exe gets terminated but the other iexplore.exe processes are still there. So, its like If I dont terminate the processes from the Task Manager process menu, I keep on getting the dialogue box after some time intervals.
4. And as soon as I disconnect the internet, I no more see this problem.

Following are the details of my machine:
Windows XP Professional SP2
Internet Explorer 7.1
Although u may not need it, but still:
256 MB Ram
AMD Athlon XP 2000+ 1.67 GHz
64 MB Graphics Card

To avoid this, I tried scanning my computer from the following(all with fully updated definations):
McAfee
Microsoft Antispyware
Lavasoft Ad-Aware SE Personal

But there was no relief, I even tried scannin by Online Symantec Virus removal tool, but no success.

One more thing, I completely forgot to tell is, when i see a new iexplore.exe is started from the Task Manager, By pressing the ALT+TAB key, when I take my cursor, to the new IE process, it tells its openin a url called www.deal-nation.com/normal/yy102/h.... or sometimes www.deal-mobile.com/yy102/h... and also www.your-deal.com/normal/yy102/h..., n if i leave my cursor over there, still I dont c any IE window, but if I directly press ALT+F4 just after that, the process iexplore.exe gets terminated.

I dont know whether i was able to completely tell the problem to you, but still i tried my best, and if u want some more clarification, please ask me. And tell me the solution. I'll be really greatful. Coz, if I tell u, the whole above matter, was completed in the fourth attempt....
:-(

I am sure, its somethin related to those URLs, but I didnt had the balls to check them, myself.

Thnx to everyone, helping me with this!!

I also saw one more thing, my Phishing filter isnt workin. It says " Phishing Filter is not currently available, and cannot check whether this is a suspicious or reported phishing website." I seriously hav no idea, wat the heck is goin on. One more URL I found was "www.popunder.paypopup.com/....."

Whoa, chill out.. first off, you should have posted a warning about that link before posting it (I didn't click it, but apparently it isn't good). Second, what are you worrying about? By the sounds of things, you might have contracted some malware.. in which case you should lookup some spyware removal tools (possibly in our download section) or malware removal tools online.

That's my guess on it, post back if you need further assistance. Oh, and please.. calm down. You'll be alright. ;)

EDIT: Ah, I see you tried that.. Hrmm.. I'll lookup this tool you might have to download that target's the damaged/corrupted files and eliminates them (I just forgot the link).

one more url " www.deal-pro.com/normal/yy102/....

Okay, I'm still searching.. but I wouldn't post these url's if they are causing problems. Just a tip..

Hey In task manager highlight the iexplorer process and choose end process tree ( not end process) That should kill what ever is relaunching and then run your spyware removal tools.

Of course running the tools in safe mode works too.

C'mon get some more caffeine/booze in ya huh?

tossers:www.serials.ws

Now that Isn't some cracking site is it? :rolleyes:

I am going to give him a full blast of the negometer for that insult to my cat's fleas' intelligence.....yes I did go to the site.............no.............I went in an ARV :D

would you care to tell us your standard security practice ?
what you run, and when ?

and although this thread doesn't cover the Anti-Virus, it does have links to some other tools you may wish to try.........

specifically :

Quote:

---

Spyware Blaster http://www.javacoolsoftware.com/spywareblaster.html
This is software that will stop the bad guys from even getting onto your PC in the first place. Again, it's a free download, and it's a load and forget device, even has auto-update enabled for us really forgetful types.

Prevx http://www.prevx.com/
Another piece of software that detects when the registry is being changed, and will alert you to it, to let you decide whether to allow / disallow.
One tip. suspend Prevx protection when you are loading software, as it will question EVERYTHING that you are doing

---

yeah I just gave him a slap on the wrist for it ;)

but seriously go through your posts and place something like [REMOVE ME] in the middle of the URL so someone doesn't stumble onto this post and visit them by accident. otherwise you are just aiding with the distribution of this malware.

Next I would get an alternative browser (eg: Firefox) and block IE at your firewall to stop it dialing home.

Personaly at this stage I would prefer to go for a full backup / format / reinstall if you are infected with unkown malware - but if thats not an option then get these, update fully and scan

ad-aware
spybot search & destroy

also I would check your hosts file for any 'additions' and you could place the offending urls in there redirected to 127.0.0.1 as an added precaution to them dialing home.

Check your firewall for any other sus traffic and report back

you may also want to post a hi-jack this log for some of the members here to take a look at.

Oh and next time - just pay for the software....and dont give me some BS about "but its too exspensive!" if thats the case dont use it! Would you expect the police to accept the same excuse if you drove off in someone elses car? So what makes this different? And if you insist on pirating software dont broadcast the fact on a security forum - esp not one which has a large amount of software developers ¬_¬

OK In response to your IM. If you have ran all your malware / AV tools (in Safe Mode) and followed the advice of valhallen...

Format the box. It will take less time than tracking down all the registry keys and hidden programs.


peace.

are you sure your AV/malware/spyware scanners are fully updated? Most new malware will attempt to block all conections to the software vendors update sites upon install (As well as sometimes killing the scanning processes)

When was the last time you did a manual update? and verified it had completed sucessfully? Make sure this is done - then as everyone has said run them in SAFEMODE (normally accessed by pressing F8 during bootup) this should limit what is loaded at startup and should make it easier for the scanners to do their job.

You may also want to give The Cleaner a go (Trojan scanner from MooSoft) as I know Trojans used to be the malware of choice for crackz/warez sites (tho they seemed to have moved onto the more profitable spyware)

But if you are still haivng problems and have done everythin instructed then i STRONGLY recommend backing up your files (lets leave that crack out of the backups tho hrm?) and then formatting the system and reinstalling (am sure you still have that cracked version of XP lying about somewhere :rolleyes: )

oh and disable your system restore while doing all this so you dont run into problems later down the road should you get it cleaned up.

I shall make one more post then close this before my sorry liittle friend has his a$$ leached away.............

1. Do not go to "Warez" sites
2. Do not go to "Crackz" sites
3. DO NOT STEAL

Or :

DEAL WITH IT BY YOURSELF

:)

Nihil: With a name like codenamevirus, could you really be mad at him? ;)


Sorry, just had to add that..