🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #26

Re: Hijacker - advice sought on how to get rid of this - OFF TOPIC

#26
From: Big Will
Date: Sat, 08 Jan 2005 09:33
68 lines
3807 bytes
Bruce wrote:
> sh4d03 <sh4d03@TPG.com.au> wrote in news:41d733af$1@dnews.tpgi.com.au:
> 
> 
>>A Whiteford wrote:
>>
>>>My background has reset to a black screen with a title "Warning
>>>You're in Danger" and a blurb about spyware etc.  If I click on the
>>>screen it takes me to the following web site:
>>>http://213.159.117.130/?affid=NAT-12
>>>
>>>which basically is urging me to buy their product to remove spyware.
>>>
>>>I've run AdAware and it's made no difference.  I've also tried
>>>resetting the desktop from the Display within the Control Panel.  If
>>>I choose a Windows theme it uses only the sounds/pointers and doesn't
>>>change the desktop to the theme.
>>>
>>>Advice from anybody who knows how to get rid of this hijacker
>>>appreciated. 
>>>
>>>Thanks
>>>
>>>
>>
>>Don't assume that AdAware is the be-all and end-all of anti-spyware 
>>programs. Yes I use it myself but I also use SpySweeper, SpyBot and 
>>Spyware Blaster. Have a look at some of these products as well and see
>>if they can help you. But also as -max has suggested look at running a
>>check for viruses as well.
>>
>>Sh4d03
> 
> 
> Yes, indeed.  I'm no expert, but I just finished cleaning a teenager's 
> machine, and I had to use AdAware, Spybot, Hijackthis, Trend Sysclean, 
> Bitdefender, and McAfee to do the job.  
> 
> I had no viruses, but plenty of spyware, adware, and trojans.  What 
> worked the best for me was manually deleting registry entries that 
> Bitdefender and Hijackthis found, examining the startup tab in msconfig, 
> and the running processes in the task manager.  
> 
> I sometimes felt like I was chasing my tail, as it was an iterative 
> process.
> 
> Good luck,
> Bruce
Run the following in order (from safe mode with networking if on an NT 
based system).
housecall.trendmirco.com
www.pandasoftware.com/activescan (but don't give them your real e-mail)
Lavasoft (www.lavasoft.nu)
Spybot (www.safer-networking.org)
The Cleaner (www.moosoft.com)
CWShredder (www.spywareinfo.com/~merijn or 
http://computercops.biz/downloads-cat-14.html)
www.ravantivirus.com
security.symantec.com

Than post a Hijack This log to an HJT forum.  Some HJT forums are 
www.spywareinfo.com, www.computercops.biz, www.tomcoyote.com/forums. 
You can download HJT from www.tomcoyote.com.
------------ And now a word from our sponsor ------------------
For a quality usenet news server, try DNEWS, easy to install,
fast, efficient and reliable. For home servers or carrier class
installations with millions of users it will allow you to grow!
----  See http://netwinsite.com/sponsor/sponsor_dnews.htm  ----
Technical Details
Message-ID: <41dfaa18@darkstar>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!newshub.sdsu.edu!tethys.csu.net!news-hog.berkeley.edu!newsfeed.berkeley.edu!ucberkeley!darkstar!not-for-mail
References: <%vABd.98953$K7.79699@news-server.bigpond.net.au> <41d733af$1@dnews.tpgi.com.au> <Xns95D1BAB3B52C9parcxmannetscapenet@216.148.227.77>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,f57b018056746121
X-Google-Thread: 10d683,f57b018056746121
X-Google-Attributes: gidfcd68,gid10d683,public
X-Google-Language: ENGLISH,ASCII-7-bit
Date: Sat, 08 Jan 2005 01:33:14 -0800
From: Big Will <ALL_YOUR_BASE@ARE_BELONG_TO_US>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910
X-Accept-Language: en-us, en
MIME-Version: 1.0
Newsgroups: alt.comp.virus,aus.computers.ibm-pc
Subject: Re: Hijacker - advice sought on how to get rid of this - OFF TOPIC
References: <%vABd.98953$K7.79699@news-server.bigpond.net.au> <41d733af$1@dnews.tpgi.com.au> <Xns95D1BAB3B52C9parcxmannetscapenet@216.148.227.77>
In-Reply-To: <Xns95D1BAB3B52C9parcxmannetscapenet@216.148.227.77>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: utc-d0032.resnet.ucsc.edu
Message-ID: <41dfaa18@darkstar>
X-Trace: darkstar 1105177112 169.233.44.32 (8 Jan 2005 01:38:32 -0800)
Lines: 68
Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!newshub.sdsu.edu!tethys.csu.net!news-hog.berkeley.edu!newsfeed.berkeley.edu!ucberkeley!darkstar!not-for-mail