Spy creating problems.

Hello All:

I think I have a spy in my Win98 box. I use IE6.
Everytime I open Internet Explorer( whose default homepage is set as 'about: blank' ), I get to see a webpage with many links(art, entertainment, health ...), 'n so much unwanted stuff, though the browser shows 'about blank' itself.
If I click on a link on the page, it goes to a page like http://searchx.cc/search.php?pin=58&...etball+betting (showing "Connection Problem" )
The most annoying fact is that I get popup applets telling that I'm infected with a spy, 'n when click the "Find out more", I get redirected to a page http://search.morgen.cc/search.php?p...pyware+remover (again saying "Connection Problem.. Plz. try later)

Yea. At first what I though was that the popup was of some of the spyware remover trying to warn me of some spy. But since both the links (from the webpage and the popup) point to similar sites, I understood that the popup was also fishy. Every time a I open a new browser window, or everytime I enter a new address, similar popups appear.... ugh! ..so annoying.

I tried running two free spywares removers. Though they found out some spies 'n removed them, this problem still persists.
So, I decided to try fixing it myself :o .

I viewed the source of the loading page. (which is attached)
I saw something like <base href="res://%43%3a%5c%57%49%4e%44%4f%57%53%5c%53%59%53%54%45%4d%5c%4a%4e%50%47%42%2e%44%4c%4c/"> on the very first line.
I uncoded the url and found it to be 'C:\WINDOWS\SYSTEM\jnpgb.dll .
So I opened the dll file using wordpad. 'n found that it had something to do with the page. After around the the first half of the doccument, I could see html code in black and white relating to the website. What am I to do next ??.. Is jnpgb.dll a standard windows file ??
Is there any onr can edit the contents of the so set 'about: blank' homepage ??

Thanx b4hand :) .

PS. attachment is of the source of the webpage loaded.

This seems more like a spyware issue so I've moved the thread here. You might want to take a shot at CWShredder and HiJackThis as methods of solving the issue. A quick Google search on "search.cc spyware" resulted in this forum's solution

and here is the jnpgb.dll file... When u open it in wordpad, you see some code of the webpage after half the document...

PS. I've renamed the .dll to .txt

Quote:

---

Spy creating problems. posted Today 07:34 AM

---

Hey I resemble that remark! :) I didn't do it!

I DENY everything and DEMAND proof!

open up C:\program files - do you have a folder there called wintools?

Z

no .. no folder called wintools

Download HijackThis,CWShredder from here:http://www.spywareinfo.com/~merijn/downloads.html
Unzip HijackThis to a permanent directory and run it..attach the logs to a file here(thought you might want to try to remove it yourself..funner that way?lol..Just search for the file entries on google and see if you come up with some dirt if you want to do it yourself)
Also,you might want to get Adaware and Spybot S&D..here's athe latest thread on AO onspyware/adware removal:http://www.antionline.com/showthread...hreadid=257183

I would first DL a few programs:

HijackThis which the link has been given above.

Spybot S & D Spybot Website . Download the updates and run this prog and most likely it will solve your problem.

However if this problem still is not eradicated from the two progs. Go to google. Type in the name of the company that looks as though it is advertising. Type into google something like "spyware company" and more then likely you will find a way to go to the registry and delete the bogus entries.



- Adiz

Quote:

---

no .. no folder called wintools

---

sorry meant to reply to this hours ago.... well thats good anyway - I asked because I recently had to clean out a friends machine suffering much the same problems as yours seems to be. The friends box was infected with wtoolsa and wtoolsb - they tend to reside in c:\program files\wintools amongst other places. best thing you can do is download the above tools mentioned and run them in safe mode - very important to run it in safe mode (as no one else seems to have mentioned it)

actually... one other thing - have you noticed a new toolbar appear on your IE bar? if so make sure you run spybot v1.3 because v 1.2 will not remove the thing. and do also run adaware as it does pick up things that spybot doesn't.

Also, just another note on wintools, there is a variation that runs as a service, so if all else fails, check there. Once disabled, it can then be deleted.

And yet another variation locks itself into the startup files and has to be disabled through msconfig.

hmm.. I'll try runnin' them in safe mode.. but 1 newbie dbt. .. What exactly is the reason 4 running it in safe mode.. Whats the use of safe mode ??

XNikon - when you boot up in safe mode the majority of services on XP are not started - basically it starts XP in a minimal configuration with just enough running so that you can use the OS. As groovicus points out some variants of scumware run as services or lock themselves into start up files etc. So by starting in safe mode none of these scumware variants get loaded into memory as services or startup items. If they aren't running then neither are the scum ware 'protection features' - thus allowing you to remove the little devils completely.

I'm not exactly sure how its done but I'd guess that the scumware uses something similar to windows own file protection system. Hope that explains it

Z

I had an interesting trojan some time back..it used to start itself everytime an exe file got executed,it started again..just an example ofcourse,but basically since none of your programs that're on startup get loaded in safe mode,you'll just be able to avoid problems of this kind

hmm.. ok. thanx.

Would everyone also recommend disabling System restore before running these programs?

And when should system restore be re-enabled?

BTW XNikon...
I'm sure you did this but be sure to update and run your AV program...

Neither Spybot or Adaware will harm anything, although poop happens sometimes, so it can't hurt.
Hijack this is different though. It is not a tool like Spybot and Adaware..it fixes what you tell it to fix, and it doesn't care if you picked the right thing or not. If used improperly, you can break your internet access, and worse. Let someone who knows what they are looking for look through your log.

I recommend to those I am helping, to disable, then re-enable system restore after each 'round', if you will. That way we don't lose ground if we screw up.

Another interesting note therenegade, I just had the opportunity to fight a trojan that executed itself from a hidden .dll, and once it ran, the .exe deleted itself. Fun Fun Fun!! :D