Printable View
hi all,
i am a bit confused.
I have a laptop having win 2K. My dad used to use it, n now he gave it to me. its not been used since a long time.
Now, Whenever i connect the internet (i have cable net) from it, it starts opening new
IE windows for unknown sites. My laptop is not having any popup blocker/ spyware. The antivirus is not having uptodate definitions.
But when i connect the same net from my desktop PC, it works fine. my desktop PC is having popup blockers and antivirus.
please help.
You've got a classic case of spyware. Run Ad-Aware and Spybot, clean out anything they find.
It would behoove you to first download Firefox for a web browser. A clean install of Firefox at this point will give you a useable browser for now.
and CWShredder too
get it here
run through this tutorial
it will help you out
[edit]
and DON'T change browsers yet .......
fix the issues THEN change
but fix the underlying problems first ...........
Quote:
Originally posted here by brokencrow
You've got a classic case of spyware. Run Ad-Aware and Spybot, clean out anything they find.
It would behoove you to first download Firefox for a web browser. A clean install of Firefox at this point will give you a useable browser for now.
It would probably be a good idea to get rid of your spyware before you start downloading and installing new web browsers!
Hi,
I would check to see what you have the installation CDs for, you might want to consider a reformat and reinstall?
Assuming that you do not:
1. Get a firewall download it on a protected machine, burn it to CD, and install it on the laptop. ZoneAlarm will be adequate for the moment.
2. Get an AV and update it, run it in Safe Mode Avast! and AVG are two reasonable free ones.
3. Update Windows (and IE)..................you will be quite a few security patches behind.
4. Get:
Spybot Search & Destroy
Ewido
A-Squared
AdAware
Update them, and run in safe mode.
Go to the Trend Micro site and run the PC-Cillin "Housecall" online scanner.
That should get you started :)
Greeting's
:)Quote:
You must spread your AntiPoints around before giving it to nihil again.
but anyway seriously we must have some kind of a direct hyperlink or we should make that SPYWARE REMOVAL TUTORIAL a STICKY IN THE SPYWARE AND ADWARE FORUM.
Anyway coming back to the topic I think foxyloxley and nihil have provided more then enough information to keep your PC clean from now. If you continue to use IE here are some tips :
Control Panel
Network and Internet connections
Internet Options
General
Temporary internet files
Settings
Set to: Every visit to page
Days to keep pages in history
Set to: 0
Security
Internet
Custom level
Reset to: High
Reset (yes)
Scroll down to "File download"
Set to: Enable (yes)
Local intranet
Sites
Make sure nothing is selected
Trusted sites
Sites
Add following web site to the zone:
add: *.microsoft.com
add: *.passport.com
If you dont add microsoft to trusted website's list then you will not be able to update your PC
Make sure "require server verification" is not selected!
Move the tab to "Medium"
Restricted Sites
Custom level
Reset to: High
Reset (yes)
Scroll down to "File download"
Set to: Enable (yes)
Privacy
Advanced
Override automatic cookie handling
First party cookies: Block
Third party cookies: Block
Enable: Always allow session cookies
Content
Autocomplete
Disable all
Clear forms (yes)
Clear passwords (yes)
Programs
Disable: Internet Explorer should check whether it is the default web browser
Advanced
Disable everything else, but enable the following
+ Always send URL:s as UTF 8
+ Disable script debugging
+ Enable folder view on FTP sites
+ Enable page transitions
+ Show friendly http error messages
+ Show go button in address bar
+ Use passive ftp
+ Use smooth scrolling
+ Use http 1.1
+ Use http 1.1 through proxy connections
+ Dont display online media content in the media bar
+ Play animations in webpages
+ Play sounds in webpages
+ Play videos in webpages
+ Show pictures
+ Smart image dithering
+ Check for publishers certificate revocation
+ Check for server certificate revocation
+ Check signatures on downloaded programs
+ Do not save encrypted pages to disk
+ Use SSL 3.0
+ Use TLS 1.0
+ Warn about invalid site certificates
+ Warn if form submittal is being redirected
I personally dont prefer IE not because its deemed as an unsecured web browser but because its more intigrated to the OS and thats why its more vulnerable. I would personally prefer you ro change your browser.
One more thing DONT USE YOUR ADMIN ACCOUNT FOR BROWSING (DONT USE IT FOR ANYTHING EXCEPT INSTALLATION'S)
If you must do that use "DropMyrights" by microsoft
get it from :
http://msdn.microsoft.com/library/de...re11152004.asp
thanks a billion....
u people really gave me lots of ways.... now i m glad...
ya, getting a reinstall of OS is the option, but i want to clean stuff....
re-installing an OS is really easy but i want to learn how to clean up.
re-install is not a problem as i dont have much data in my laptop.
i will try all this.... n will surely get back to you ppl!!!
Thanks again!!!
Greeting's
You might want to show us your Hijackthis log to be sure that your system is clean if you are going to re-install then update before coming online for that download autopatcher.
Also try CCleaner. It's great for removing all the temp files on a Windows-based PC. Temp files cause a lot more problems than people realize.
As recommended, I used ZoneAlarm, but after installing it, I am unable to access my internet.
Check the documentation on zone alarm, I haven't used it in some time, but make sure that port 80, 8080, and 443 outgoing are allowed. If I remember correctly, you can also allow certain programs unfettered access to the internet. IE/firefox would be one that you should allow (If all is configured as above ;) )
The way I remember it, zonealarm would pop up a dialog
asking "do you want to let internet explorer/or whatever
access the internet?" and you have to allow it, and whatever
other programs you have that need access.
:cool:
i gave access to IE and firefox both... but still it was not letting me access internet.
Greeting's
That means you have not configured it correctly. See the list of applications that have access to internet, make sure IE is included in it. Do you get any alerts when IE tries to connect to the internet. I have not used zonealarm for a very long time but I think thats the problem
Edit :
Do you get any popups or any warnings ?
Greeting's
I found this on google. Its a comprehensive guide to configure zonealarm.
http://www.dslwebserver.com/main/sbs...configure.html
You might want to take a look at it and see if you missed out on anything. Also if you can post screen shots of different screens of your firewall. or even the event log. don't forget to sanitize the log's
Could be you've got a rogue file in your LSP, which is part of Windows TCP/IP (winsock).
Spyware will sometimes add a file to the winsock, in effect corrupting it.
There's a small app that will fix it, but you need to be very careful with it. You don't want to remove anything it finds. I've got notes on it, but not in front of me at this moment. I'll try to post later today or tonight.
http://www.cexx.org/lspfix.htm
Hmmm, I'm back sooner than I thought. Here's the deal on that app, LSP-Fix. Just download the .exe, it's small, about 182kb. Run it from anywhere, your desktop, whatever. You'll have a small window with two boxes along the bottom, one saying "Keep" and the other "Remove".
The "Keep" box will show all the files in your LSP stack. There should only be four of them there if you're running Windows 2000 (different versions of Windows have varying LSPs). They are:
rnr20.dll
winrnr.dll
msafd.dll
rsvpsp.dll
If there's any other files in there, they are rogue and need to be removed. To remove a file with this app, check the "I know what I'm doing" box, highlight the file-to-be-removed in the "Keep" column and move it to the "Remove" column. Then click "Finish" and LSP-Fix will remove any rogue files in your LSP.
DO NOT REMOVE THE FOUR FILES MENTIONED ABOVE. Anything else is safe to go though. If your LSP is corrupted, this should fix it. Like I said, this is not uncommon with spyware.
I think further discussion is a moot point.
In a newer thread, she (?) says the laptop is now corrupted to the point of no booting.
:(
ZT3000 is right :)
I simply love this group... there is a forum for each kind of IT related query... my second Google :D
thanks for help ppl.. atleast i came to know about so many softwares and tools.