strange virus, help needed!

I have strange virus in my computer, when I go to www.altavista.com this appears to my screen:


It also appears some times when I go to other pages.
Antivirus program(antivir) doesn't find any viruses from my computer.. :/

and don't say that I must use mozilla firebird or netscape!




My photo gallery: [viltzu86.deviantart.com]

it also appears everytime when I go to google.com :/
luckily I can still use google.fi.



Post Edited (12-27-03 16:25)


My photo gallery: [viltzu86.deviantart.com]

Probably not a virus. You get many many spyware/adware programs which screw around with IE. Change the home page and settings and stuff

download and run adaware and see if it finds anything. Often that clears it




Racing Is Life. Anything that happens before or after is just waiting
Jesus may be able to heal the sick and bring the dead back to life, but he can't do shît for low fps

I have ad-aware and it doesn't help. :/




My photo gallery: [viltzu86.deviantart.com]

Have you got the latest reference file?

have a go at "spybot search and destroy" and also "Cwshredder" as adaware doesn't always pick them up (altho it is prob the best)



Band of the week: Muse
Game of the week: Call of Duty

Beardless2

AMD XP 2700+ | Asus A7N8X nForce 2 Deluxe | 1 GB PC2700 RAM DC | ATI RADEON 9800 | WD 120GB 8MB | NEC 16x DVD | Lite-on 48x24x48 | XP

[www.privacyoutpost.com]

Looks like I have it, too.

Apparantly they can spell, though. There is an "e" too many in "You're beeing watched".

This is what I found at another forum:

[www.cspacezone.net]


It's an ad trying to scare you so they can sell you stuff. The stuff displayed on that page is simple to access - it's either a small JavaScript, or maybe even just HTML. Whatever it is, it's simple code that's readily available.

Getting into your cache and other stored files is a different story. It would be illegal, and require a fair bit of cracking.

I checked the link with @nonymouse (which also demonstrates how easy that info is to get), and it's just idiots trying to hock their crap at people who don't know what they're doing (I'm not referring to you).

Screw them; go get Ad-Aware and Spybot Search-and-Destroy.

Use Search-and-Destroy. It's better than Ad-Aware IMO.



Post Edited (12-27-03 16:43)

---

REHAB IS FOR QUITTERS

I used spybot, and now I can use MSN.com. but I still can't use altavista or google.




My photo gallery: [viltzu86.deviantart.com]

Do you have enemies or evil-wishers? Maybe your wife is trying to find any cause to divorce you and take all your money! Maybe somebody wants to settle an old score or purposely set out to ruin your reputation or to take over your identity for their own personal gain! Then YOU SHOULD KNOW that the information stored in your computer will make it very easy for them!!!

Man, someone is suffering from paranoia there! Why didn't they mention the lesbian nazi hookers abducted by UFOs and forced into weight loss programs?

---

REHAB IS FOR QUITTERS

[www.privacyoutpost.com]

LOL! I have never read so much crap!




My photo gallery: [viltzu86.deviantart.com]

Just what I said - this is paranoia³.

---

REHAB IS FOR QUITTERS

damn spybot! It decided that my ATI TV IE-plugin was spyware, and now I must reinstall my videocard drivers to get it work again. :S




My photo gallery: [viltzu86.deviantart.com]

its probably a redirect in your HOST file to a webpage/script.
Just like said...nothing to worry about.
Restore the HOSTS file by hand, or with the help of another program and you're fine

---

I'd rather have a bottle in front of me than a frontal lobotomy

some more help:
open %windir%\system32\drivers\etc\hosts with notepad
it should look like this:

---

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

---

if you see anywhere altavista just delete the line.
You can also copy this one above. If you are not comfertable with it then make a backup first.
It only tells windows to redirect to other DNS names/IP's



Post Edited (12-27-03 21:34)

---

I'd rather have a bottle in front of me than a frontal lobotomy

WOW. Dodgy virus. Don't know what to say. Try rebooting your O.S.



___________________________



Sorry guys, my forum is down.

not a virus kimi. read the thread :P

---

If your internet explorer home page now starts on some obscure search site or "god forbid" at some porno site your internet explorer has been HIJACKED!!!! If you reset this in internet options to :about blank and when you reboot it does the same thing your registry has been hacked. If you wish to lock your start page to "blank" let me know and I will give you a registry file to import to your registry. Hijacking of your start page is the latest tool used by unscrupulous domains to inflate the "hit" count for advertising revenue. Some of these sites lock your start page buttons in your options so that you cannot reset to blank or start page of your choicee and even if you could reset your start page the hacked registry will reset it back when you reboot your computyer anyway! The page you see is a load of absolute bollocks and any "script kiddie" could write a page that produces
a page that records the ip address of the machine that accesses the domain, in this case one that is trying to trick you into buying their crap software that you can in anycase get for free anywhere on the web, ie: do a warez search for Evidence Eliminator Please download and use Adaware from www.lavasoft.de and Spybot S&D from [www.safer-networking.org] also if you're still having dramas use HijackThis from [www.tomcoyote.org] but be careful as HijackThis directly accesses your registry and it would be advisable to record a log and send it to me or to another security expert to determine the nature and extent of the registry hacks before deleting anything, all these anti-trojan and anti-spyware tools are freely available on the net. If you're really pissed of with all of the hassles and the endless popup ads and those wont go away porn windows give the crappy "way full of holes and far too easy to exploit internet explorer" the arse and use MOZILLA which loads web pages faster anyway! I would put money on HijackThis being able to show what scripts have been loaded to your registry!! You do not have a virus as such, a trojan from the advertising site has written to you registry and this sort of behaviour majorly sux imho. Of coursde had you been using a firewall and Mozilla it probably wouldn't have happened in the first place, let us know how you get on, this sort of thing interests me very much. Cheers Mortal
P.S. Paranoid???? you bet......the only way to be on the net, and are you using a firewall??? if not get ZoneAlarm NOW!!!

---

[www.mediafire.com] Some say you should click it, you know you want to. [www.gp4central.com] <----GP4 Central

I restored hosts files manually and now it works.

ps. I'm using zonealarm.



Post Edited (12-28-03 12:41)


My photo gallery: [viltzu86.deviantart.com]