Many Little Things

Archived from groups: microsoft.public.windowsme.general (More info?)

For the last two weeks I have been plagued with viruses and threats.
I managed to get rid of several, identified after a scan with Ad-Aware SE.
Most of them infected with Dialer.WSV and Dialer.Webview.
The one thats nags me, because it always return even if I click Delete
as I'm prompted to do by the Wizard. My question: can I get rid of the
whole file: c:Windows\madopew.dll infected with Adware.MainSearch? Seems
it regenerate itself! The end effect is that whenever I start my I.E. the
Home Page has been changed to: About.blank or is that another thing
altogether. Geez.

Here are some files that are now in quarantine, can I deleted them?;
c:\Windows\fierm.exe; c|w|scins.exe; C|W|System\124511.exe

I know its a lot to ask, and I feel like abusing. Tks in advance for any help


--
cogito ergo sum

Archived from groups: microsoft.public.windowsme.general (More info?)

Paul,

None of the files you mention are part of the Win Me operating system
(madopew.dll, fierm.exe, scins.exe,124511.exe).

That you mention your home page being switched to About:Blank suggests
that you might have one of the more virulent versions of the CoolWebSearch
parasite on board.

Unfortunately neither AdAware or SpyBot seem to be able as yet to fully
detect all the various versions of the CoolWebSearch parasite as it keeps
changing. The latest version of CWShredder can be downloaded (free) from
http://www.intermute.com/spysubtra [...] nload.html

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html).
Create a folder called HJT on C: (not on your desktop nor in your temp
folder) and copy the file you downloaded to that folder. Close as many
applications as you can including all instances of Internet Explorer.
Enable Explorer to see all files and folders (Tools | Folder Options |
View and check "Show hidden files and folders" and uncheck "Hide protected
operating system files" ) and then run hijackthis.exe and post back the log
to either the HijackThis Forum at http://forums.spywareinfo.com/ or
alternatively http://forum.aumha.org/viewforum.php?f=30 and hopefully this
will enable someone to identify the cause of your problem.

See also: Dealing with Unwanted Malware, Parasites, Toolbars and Search
Engines http://mvps.org/winhelp2002/unwanted.htm and also Browser
Hijacking http://www.spywareinfo.com/articles/hijacked/
--
Mike Maltby MS-MVP
mike.maltby@gmail.com


PAT (Paul) <PATPaul@discussions.microsoft.com> wrote:

> For the last two weeks I have been plagued with viruses and threats.
> I managed to get rid of several, identified after a scan with
> Ad-Aware SE. Most of them infected with Dialer.WSV and Dialer.Webview.
> The one thats nags me, because it always return even if I click
> Delete as I'm prompted to do by the Wizard. My question: can I get
> rid of the whole file: c:Windows\madopew.dll infected with
> Adware.MainSearch? Seems it regenerate itself! The end effect is
> that whenever I start my I.E. the Home Page has been changed to:
> About.blank or is that another thing altogether. Geez.
>
> Here are some files that are now in quarantine, can I deleted them?;
> c:\Windows\fierm.exe; c|w|scins.exe; C|W|System\124511.exe
>
> I know its a lot to ask, and I feel like abusing. Tks in advance for
> any help

Archived from groups: microsoft.public.windowsme.general (More info?)

Mike (and Joan and Jack) those "little things" are all gone now including
the 'About.blank'. Tks you all.
Paul

"Mike M" wrote:

> Paul,
>
> None of the files you mention are part of the Win Me operating system
> (madopew.dll, fierm.exe, scins.exe,124511.exe).
>
> That you mention your home page being switched to About:Blank suggests
> that you might have one of the more virulent versions of the CoolWebSearch
> parasite on board.
>
> Unfortunately neither AdAware or SpyBot seem to be able as yet to fully
> detect all the various versions of the CoolWebSearch parasite as it keeps
> changing. The latest version of CWShredder can be downloaded (free) from
> http://www.intermute.com/spysubtra [...] nload.html
>
> Finally if you still continue to experience problems download a copy of
> HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html).
> Create a folder called HJT on C: (not on your desktop nor in your temp
> folder) and copy the file you downloaded to that folder. Close as many
> applications as you can including all instances of Internet Explorer.
> Enable Explorer to see all files and folders (Tools | Folder Options |
> View and check "Show hidden files and folders" and uncheck "Hide protected
> operating system files" ) and then run hijackthis.exe and post back the log
> to either the HijackThis Forum at http://forums.spywareinfo.com/ or
> alternatively http://forum.aumha.org/viewforum.php?f=30 and hopefully this
> will enable someone to identify the cause of your problem.
>
> See also: Dealing with Unwanted Malware, Parasites, Toolbars and Search
> Engines http://mvps.org/winhelp2002/unwanted.htm and also Browser
> Hijacking http://www.spywareinfo.com/articles/hijacked/
> --
> Mike Maltby MS-MVP
> mike.maltby@gmail.com
>
>
> PAT (Paul) <PATPaul@discussions.microsoft.com> wrote:
>
> > For the last two weeks I have been plagued with viruses and threats.
> > I managed to get rid of several, identified after a scan with
> > Ad-Aware SE. Most of them infected with Dialer.WSV and Dialer.Webview.
> > The one thats nags me, because it always return even if I click
> > Delete as I'm prompted to do by the Wizard. My question: can I get
> > rid of the whole file: c:Windows\madopew.dll infected with
> > Adware.MainSearch? Seems it regenerate itself! The end effect is
> > that whenever I start my I.E. the Home Page has been changed to:
> > About.blank or is that another thing altogether. Geez.
> >
> > Here are some files that are now in quarantine, can I deleted them?;
> > c:\Windows\fierm.exe; c|w|scins.exe; C|W|System\124511.exe
> >
> > I know its a lot to ask, and I feel like abusing. Tks in advance for
> > any help
>
>

Archived from groups: microsoft.public.windowsme.general (More info?)

Paul,

Just for the record, which tool, if any, did you use to remove the crud -
CWShredder?
--
Mike Maltby MS-MVP
mike.maltby@gmail.com


PAT (Paul) <PATPaul@discussions.microsoft.com> wrote:

> Mike (and Joan and Jack) those "little things" are all gone now
> including the 'About.blank'. Tks you all.

Archived from groups: microsoft.public.windowsme.general (More info?)

Mike:
re about:blank. Did so many things, heres a list not necessaryly in
that order:

- updated virus definition
- ran a full NAV system scan
- ran CWShredder
- ran Ad-Aware SE
- ran spybot-S&D
- ran another full NAV system scan but directly from Symantec
Security Response; it seems that both the Security and Virus
scans from that site are much more complete?? took 2hrs 15 mins
and then got removed, guess my computor was too slow or they have a
time limit...got as far as 42481 files and feel that may be half of
it.

That last scan gave me 8 files infected One of them was in C|w|madopew.dll
was infected with Adware.MainSearch (which does similar things than
about:blank) and when you said I could remove it, (along with the other
files) seems almost everything came ok.
Sorry I should have kept a more rigid log (but I'm going by memory
(for what its worth).
Regards, Paul

"Mike M" wrote:

> Paul,
>
> Just for the record, which tool, if any, did you use to remove the crud -
> CWShredder?
> --
> Mike Maltby MS-MVP
> mike.maltby@gmail.com
>
>
> PAT (Paul) <PATPaul@discussions.microsoft.com> wrote:
>
> > Mike (and Joan and Jack) those "little things" are all gone now
> > including the 'About.blank'. Tks you all.
>
>