Possible malware imbedded here?

[wiegeabo]

What browser are you using?

 

[Silicon Surfer]

Firefox

 

[SuperZer0]

I think you should delete everything, not just cache. Try to delete your browsing history and cookies.

 

[wobbly]

If the original problem screwed up your browser and acrobat then that might remain even after clearing the cache and the virus itself. Try uninstalling/re-installing both Firefox and Acrobat to see if that helps.
Another option is to look at your start-up items and delete anything you know shouldn't be there.

 

[Drakon]

Wobbly and SuperZer0 speak the truth.

 

[Silicon Surfer]

I don't have acrobat and my startup menu is fine. I checked that yesterday and again just now. The skin just changed again right after Drakon's last post. I may end up reinstalling Firefox but that would be a pain.

 

[MessenjahMatt]

It's definitely not a problem on my end, I'm guessing the perpetrators heard how the forums were switched to the uninfected Classic skin and decided to hack that one now. Since I switched back to forum default that you guys fixed I haven't had any problems.

 

[Silicon Surfer]

I have run rootkitrevealer and found the following entries. I cannot interpret them so I am posting them here. The bottom eight entries I have never seen before when I have run this program.


HKLM\SECURITY\Policy\Secrets\SAC* 3/31/2007 6:46 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 3/31/2007 6:46 PM 0 bytes Key name contains embedded nulls (*)
C:\Documents and Settings\Chuck\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\parent.lock 12/18/2008 10:07 PM 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Chuck\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\sessionstore.js 12/18/2008 10:12 PM 4.88 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Chuck\Local Settings\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\Cache\5DED211Ad01 12/18/2008 10:12 PM 73.06 KB Hidden from Windows API.
C:\Documents and Settings\Chuck\Local Settings\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\Cache\7B409E0Ed01 12/18/2008 10:12 PM 30.80 KB Hidden from Windows API.
C:\Documents and Settings\Chuck\Local Settings\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\Cache\8B1B81E7d01 12/18/2008 10:12 PM 20.77 KB Hidden from Windows API.
C:\Documents and Settings\Chuck\Local Settings\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\Cache\8DD99651d01 12/18/2008 10:12 PM 33.01 KB Hidden from Windows API.
C:\Documents and Settings\Chuck\Local Settings\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\Cache\E61CC877d01 12/18/2008 10:12 PM 19.41 KB Hidden from Windows API.
C:\Documents and Settings\Chuck\Local Settings\Application Data\Mozilla\Firefox\Profiles\er5eartr.default\Cache\FB9C0D4Dd01 12/18/2008 10:12 PM 25.62 KB Hidden from Windows API.

 

[wobbly]

Try deleting all those hidden entries with the 12/18/2008 dates.

If that still doesn't work then I'd re-install Firefox if I were you.

 

[Silicon Surfer]

They do delete when I empty the cache but they come back every time I come here. I came here with the Safari browser and ran the scan and got 34 suspicious hits. The first two on the list are ok. I don't recall what they are but I have checked them out in the past.

 

[Drakon]

Have you un/reinstalled your browser since this happened?

 

[Hunter Rider]

IVe cleaned the cache, ran crapcleaner and resinstalled Firefox and I still keep getting this page popping up.

 

[wiegeabo]

Have you tried Spyboy Search and Destroy. That can run a scan on bootup before anything loads.

A big problem with nasty pieces of malware like this is, even though you clean the files, it hides in another active file that can't be cleaned because your operating system is still using it. So once your done cleaning, the hidden file just reinfects the system. The trick is to kill the infected files before they load.

 

[Hunter Rider]

I have the program but how do I set it to do the sweep on start up ?

 

[Mister J]

Click on the Settings tab (left hand column), Scheduler, Edit, Schedule tab, New, highlight 'At System Startup' under Schedule Task.

 

[Hunter Rider]

Click on the Settings tab (left hand column), Scheduler, Edit, Schedule tab, New, highlight 'At System Startup' under Schedule Task.

I don't seem to have that tab J

 

[wiegeabo]

Click mode from the menu bar, then advanced mode. Settings will be one of the options on the side. Scheduler in that.

 

[Mister J]

I see what it is. You need to switch from Default Mode to Advanced Mode. That heading should be next to the File menu near the top of the screen.

 

[Hunter Rider]

Got it! thanks guys.

 

[wobbly]

Another thing to try for anyone having trouble removing the problem is to boot into 'safe mode', then run your cleaning software (to get into safe mode press F8 just after your first boot screen, then select that option from the menu that comes up).

You can also try 'system restore' from safe mode and go back to a time before the problem occurred.

 

[Hunter Rider]

Ok, everytime I boot up my anti virus program finds a trojan and removes it, but my mouse pointer permanently has the hourglass next to it as if something is loading, how do I fix that ?

 

[Hunter Rider]

Ok, everytime I boot up my anti virus program finds a trojan and removes it, but my mouse pointer permanently has the hourglass next to it as if something is loading, how do I fix that ?

Any help ?

 

[wobbly]

From the sounds of it your system has something nasty locked into the windows start-up routine that your AV software cannot shift (it's kicking in before the AV software is, and though you should be able to 'deny access', the program will always stay there)

Have you tried booting into safe mode and running your AV software then, or going for a system restore from safe mode (choose a date before the problem occurred)?

*Doing a system restore in safe mode should work better than from normal windows as some programs can prevent a restore from completing.

If not then that is usually the best way to sort out a problem like this. If you have done this and the problem is still there then you might be looking at having to do a full re-install. That being said I've never known the safe mode fix to not work in getting rid of persistent crap that AV software might struggle to remove.

 

[Hunter Rider]

From the sounds of it your system has something nasty locked into the windows start-up routine that your AV software cannot shift (it's kicking in before the AV software is, and though you should be able to 'deny access', the program will always stay there)

Have you tried booting into safe mode and running your AV software then, or going for a system restore from safe mode (choose a date before the problem occurred)?

*Doing a system restore in safe mode should work better than from normal windows as some programs can prevent a restore from completing.

If not then that is usually the best way to sort out a problem like this. If you have done this and the problem is still there then you might be looking at having to do a full re-install. That being said I've never known the safe mode fix to not work in getting rid of persistent crap that AV software might struggle to remove.

I'm not actually sure how to initiate my AV software from safe mode, Ive never done it before.

 

[wobbly]

I'm not actually sure how to initiate my AV software from safe mode, Ive never done it before.

Well some AV software wont run in safe mode, so it can depend on what kind you have. Whatever the case there you can find out by going the av control center from the 'start menu>programs' in safe mode. If it can run then do a full scan on your primary (OS) hard drive (and scan within archives* if you can), and if it can't run then you should go for the 'system restore'.

*I mention this as it looks like the file creating the problem at start up is not the virus itself, but something that creates/unpacks the trojan every time you reboot: this is why it keeps coming back after deletion when you start up again.

Also look at your start up items and delete anything that looks suspicious (you can download a trial version of "Tune Up Utilities" that has a decent and easy to use start menu editor)