Adware/Malware ?

[Vince]

Here is what is happening.When openeng IE 6 my home page
comes up but I also get a pop up to the
website "casinopalozzo" This only seems to happen twice a
day,I haven't seen a pattern so it's not occuring each
time I open my browser.When this happens I also get these
internet shortcuts automatically added to my favorites
menu (Best Search,Casino,Easy Search,Gift Certificate,Pop
Up Blocker,Spyware Removal,Viagra & Web Hosting).Also when
I look in Task Manager after this happens there is
something called "taskmgn.exe" running,and this is the
only time it runs.All critical updates have been
applied,Lavasoft Adaware and Spybot S&D find nothing.I'm
using Trend Micro AV and it finds no viruses.I'm
firewalled and it scores great on tests I've ran from some
of the best security sites.Also when I do a Serch to find
the file "taskmgn.exe" nothing is found.
Any suggestions on what to try next ?
Thanks,Vince

 

[Jan Il]

Hi Vince

OkieDokie..pick yer pi'son. <G>

Start with the CWShredder and see what happens. If no joy, then work your
way through the programs and see if they will help. I sounds like it could
be a combination of things going on a once. If you've run SpyBot and
AsAware, both with the latet updates and it still pesists, then these should
help clean it up for you.

CWShredder: Free
http://tinyurl.com/2l9kl

Trend Micro Housecall - Free
http://housecall.trendmicro.com/housecall/start_corp.asp

McAfee Avert Stinger
http://tinyurl.com/2esu7
or
http://vil.nai.com/vil/stinger/

HiJackThis: - Free

Go to
http://computercops.biz/downloads-cat-14.html ,
or
http://www.aumha.org/a/parasite.php#hjt
and download HiJackThis. Unzip to a folder other than your Desktop or the
Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open the copy of your log in NotePad and make a copy. Then you can go here
to post you log:

Jim Eshelman's site here:
AumHa Forums - HiJackThis section:
http://forum.aumha.org/

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

<<DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

HJT Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42


Hope this helps.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.

 

[Vince]

Thank's for the quick response Jan! I'll try your
recommendations.
Vince

 

[Kelly Cotter]

Here is what is happening.When openeng IE 6 my home page
comes up but I also get a pop up to the
website "casinopalozzo" This only seems to happen twice a
day,I haven't seen a pattern so it's not occuring each
time I open my browser.When this happens I also get these
internet shortcuts automatically added to my favorites
menu (Best Search,Casino,Easy Search,Gift Certificate,Pop
Up Blocker,Spyware Removal,Viagra & Web Hosting).Also when
I look in Task Manager after this happens there is
something called "taskmgn.exe" running,and this is the
only time it runs.All critical updates have been
applied,Lavasoft Adaware and Spybot S&D find nothing.I'm
using Trend Micro AV and it finds no viruses.I'm
firewalled and it scores great on tests I've ran from some
of the best security sites.Also when I do a Serch to find
the file "taskmgn.exe" nothing is found.
Any suggestions on what to try next ?
Thanks,Vince

to start with i'd download and run these be sure to update them

http://www.lavasoftusa.com/software/adaware/ adaware

http://www.safer-networking.org/index.php?page=download spybot

http://www.safer-networking.org/index.php?page=download cwshredder

http://www.webattack.com/dlnow/rdir.dll?id=105693 spyware blaster

http://www.spywareinfo.com/~merijn/downloads.html some other usefull removal
tools

also do a full virus scan

 

[Vince]

Jan,CWShredder found the trojan Cool Web Search and
removed it.Since I am running some of the best internet
security programs this just proves that ocasionally
something can slip thru them.Thank's again for the
CWShredder program.
Vince

 

[Jan Il]

Hi Vince

Thank's for the quick response Jan! I'll try your
recommendations.

You're very welcome. Give a holler If you need help.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.

 

[Jan Il]

Hi Vince

Jan,CWShredder found the trojan Cool Web Search and
removed it.Since I am running some of the best internet
security programs this just proves that ocasionally
something can slip thru them.Thank's again for the
CWShredder program.

You're very welcome. Good work! Glad to hear you are up and running
properly again.

Thank you for letting us know what worked to solve your problem, and for the
benefit of other posters as well.

Jan

 

[H Leboeuf]

Follow these recommendations.

Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051