few questions in one message

[Guest]

hi, its my first time here.
first, here are the specs, i am using windows xp with service pack 2, and
internet explorer 7, version 7.0.5730.11


first question, this started a few days ago, and it is happening even now
as i am typing this message, i get pop ups coming out of nowhere. what's up
with this?
another example, i just went to yahoo.com to check my email and i get a pop
up from this adult site, dvd-explorer.com , it's a disgusting site, showing
naked women that spread their legs, you get the idea. yeah, i am a man and i
find that offensive, because it's spam, it's un called for, i mean non
requested.
so this dvd-explorer is one of them, the other is, this windows doctor, and
then another, error fixer, and then, another about smileys.

secon question, i am using this little program, ccleaner, it's neat, i read
about it, in either pc world or pc magazine. i performed a registry scan,
ccleaner calls it 'scan for issues and shows the registry icon', it found the
following executable, .exe, file in \windows\system32\mbaekiwbah.exe
i cannot find any information about it. i googled it, and i also typed it
in the search box at support.microsoft.com
this same file, mbaekiwbah.exe also appears in my startup, as i discovered
by running the msconfig command. any ideas what this file does?

third question, i performed a virus scan, it didn't found any threats,
instead it found two files that where 'changed'. the files are
\windows\system\32\user32.dll
and \windows\system32\ntoskrnl.exe
any ideas as of what this status, 'changed', means?
is it possible for me to replace these files? can i download them from
somewhere, such as downloads.microsoft.com? if that is possible, please
provide me with the link.

fourth question,
i stumbled by accident while browsing the pcworld site security downloads,
upon the rootkits detector programs. i don't know why but i decided to try
this one called 'ice sword'. i actually didn't do anything bad with it. i
don't really know what rootkits are, though thanks to wikipedia i did get
some info there.
i was talking to a co worker and he suggested that i do a crc check. now i
know about crc, i remember this file 'crc.exe' was included with zipped
files, back in the days of dos 6.22 and such, and maybe even windows 3.1 and
win 95.
i don't remember if once the file was unzipped if the crc file woul
automatically run.
anyway, currently i am confused by crc and checksum, are these one and the
same? i mean do they refer to the same thing?
i tried to find a crc file that would check a rar file but i couldn't. most
crc checks i saw were for some file extensions i am not familiar with, i
remember something to do with unix.
so, recap, is there a crc file i can downlad somewhere that would check rar
and zip and lzh, and these kind of archived files? or does a crc check exist
for the archive file types i just mentioned?

i try to be very careful in general, in terms of privacy and security. i
just find it odd that noadware detects dialers such as instant access dialer,
that adaware doesn't, and the third one i am using is free avg anti-spyware,
every time i perform a registry scan with the latter, it never detects
anything.

well no one program is perfect, i do know that.

i hope i have been clear enough. i am not a techie, far from that, though i
took some computer science many years back. currently i am employed in an
unrelated field.

this is everything for now. thanks for reading. you contact me by email with
your suggestions, as i don't visit this forum often.

thank you

 

[You Know Who ~]

Hi
you might consider asking just one question at a time, or least one one per
discussion. Kind of hard to follow all of that.
Look at mbaekiwbah.exe (link below, got this through a google search.

http://www.symantec.com/security_response/writeup.jsp?docid=2005-070113-4118-99

Frankly, it sounds like you are installing and configuring some stuff that
had best be left alone unless you are certain of what you are doing.
Stumbling across programs and downloading them is really not a good idea,
and in the long run you could disable your computer.

Unfortunately, virus detectors and registry cleaners have something in
common: a lot of false positives. They will say that something might or
could be or even is dangerous when it really isn't. So when they point to a
file, the file isn't necessarily "guilty" of anything.

I would learn to use the popup blocker and also learn how to completely
block certain domains. Internet Explorer is quite good at that. I would
also download Ad-Aware and do a scan (the program is free and quite good).


--
YKW~
`````````````````````````````````````````````
" It wasn't until late in life that I discovered how easy
it is to say 'I don't know'." W. Somerset Maugham

 

[PA Bear]

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Rock]

Replies are in line

hi, its my first time here.
first, here are the specs, i am using windows xp with service pack 2, and
internet explorer 7, version 7.0.5730.11

first question, this started a few days ago, and it is happening even now
as i am typing this message, i get pop ups coming out of nowhere. what's
up
with this?
another example, i just went to yahoo.com to check my email and i get a
pop
up from this adult site, dvd-explorer.com , it's a disgusting site,
showing
naked women that spread their legs, you get the idea. yeah, i am a man
and i
find that offensive, because it's spam, it's un called for, i mean non
requested.
so this dvd-explorer is one of them, the other is, this windows doctor,
and
then another, error fixer, and then, another about smileys.

Do a thorough scan for malware. You haven't been practicing safe hex
otherwise the system wouldn't have gotten infected.

Malware Removal
http://www.elephantboycomputers.com/page2.html#Removing_Malware

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper’s Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm

secon question, i am using this little program, ccleaner, it's neat, i
read
about it, in either pc world or pc magazine. i performed a registry scan,
ccleaner calls it 'scan for issues and shows the registry icon', it found
the
following executable, .exe, file in \windows\system32\mbaekiwbah.exe
i cannot find any information about it. i googled it, and i also typed it
in the search box at support.microsoft.com
this same file, mbaekiwbah.exe also appears in my startup, as i discovered
by running the msconfig command. any ideas what this file does?

Google gives no hits on that file which is suspicious and suggests it's
associated with malware, possibly what's causing the pop ups, or even
another infection.

On a separate note, though ccleaner is a good program for deleting temp
files, I recommend you do not use it for registry scanning or cleaning.
There is no need to run a registry cleaner. They can cause more problems
than they fix.

third question, i performed a virus scan, it didn't found any threats,
instead it found two files that where 'changed'. the files are
\windows\system\32\user32.dll
and \windows\system32\ntoskrnl.exe
any ideas as of what this status, 'changed', means?
is it possible for me to replace these files? can i download them from
somewhere, such as downloads.microsoft.com? if that is possible, please
provide me with the link.

What did you scan with? AVG? It could be these files were changed because
of recent updates from windows update. It doesn't necessarily mean those
files are infected.

fourth question,
i stumbled by accident while browsing the pcworld site security downloads,
upon the rootkits detector programs. i don't know why but i decided to
try
this one called 'ice sword'. i actually didn't do anything bad with it. i
don't really know what rootkits are, though thanks to wikipedia i did get
some info there.

So what is the question?

i was talking to a co worker and he suggested that i do a crc check.

A crc check on what? Why?

now i know about crc, i remember this file 'crc.exe' was included with
zipped
files, back in the days of dos 6.22 and such, and maybe even windows 3.1
and
win 95.
i don't remember if once the file was unzipped if the crc file woul
automatically run.
anyway, currently i am confused by crc and checksum, are these one and
the
same? i mean do they refer to the same thing?
i tried to find a crc file that would check a rar file but i couldn't.
most
crc checks i saw were for some file extensions i am not familiar with, i
remember something to do with unix.
so, recap, is there a crc file i can downlad somewhere that would check
rar
and zip and lzh, and these kind of archived files? or does a crc check
exist
for the archive file types i just mentioned?

I'm not sure what you are asking here. Maybe someone else will jump on on
this issue. I haven't used a crc check in XP.

i try to be very careful in general, in terms of privacy and security.

This statement seems to be contradicted by the fact that your system is
infected.

http://www.claymania.com/safe-hex.html

So how did I get infected in the first place?
http://forums.spywareinfo.com/index.php?showtopic=60955

i just find it odd that noadware detects dialers such as instant access
dialer,
that adaware doesn't, and the third one i am using is free avg
anti-spyware,
every time i perform a registry scan with the latter, it never detects
anything.
well no one program is perfect, i do know that.

Not only are they not perfect, but they don't always look for the same
things. So it's not an issue of perfection. You need to use a variety of
programs. But more importantly you need to practice safe hex and common
sense. It's the progam that exists between the seat and the computer that
is most important.

i hope i have been clear enough. i am not a techie, far from that, though
i
took some computer science many years back. currently i am employed in an
unrelated field.

this is everything for now. thanks for reading. you contact me by email
with
your suggestions, as i don't visit this forum often.

This is not an email support forum. Asked here, answered here so that
everyone can benefit by the exchanges. You need to figure out some way to
come back to see your replies.

I suggest you use a newsreader to access what is actually a Usenet
newsgroup, not the awful web interface. XP comes with Outlook Express which
can be setup for newsgroup access. Here is a link on how to do that.
http://www.michaelstevenstech.com/outlookexpressnewreader.htm