Help

[Courteney Brown]

when I try to open a program... a pop-up-box comes up and
says...

An exception occured while trying to
run "C:\WINDOWS\System32\btiein.dll,Download"

what does that mean? and how can I get that not to come
up?
Can anyone please help me?
Thanks,
Courteney

 

[Sharon F]

when I try to open a program... a pop-up-box comes up and
says...

An exception occured while trying to
run "C:\WINDOWS\System32\btiein.dll,Download"

what does that mean? and how can I get that not to come
up?
Can anyone please help me?
Thanks,
Courteney

The file BTIEIN is a part of a browser parasite known as Huntbar. You can
read about it here: http://www.doxdesk.com/parasite/HuntBar.html
There are also directions for removing Huntbar on that page.

 

[Guest]

Thanks soo much...

-----Original Message-----

 

[Courteney]

OK help!! when I try to remove it... a another pop-out
box comes up and says:
Error loading C:\PROGRA~1\Toolbar\toolbar.dll
Access is Denied.

What does that mean?And what can I do?
thanks
Courtney

-----Original Message-----

 

[Sharon F]

OK help!! when I try to remove it... a another pop-out
box comes up and says:
Error loading C:\PROGRA~1\Toolbar\toolbar.dll
Access is Denied.

What does that mean?And what can I do?
thanks
Courtney

Courtney, this particular nasty is always evolving. Sometimes faster than
the removal directions can be updated. The message you're seeing - does it
happen at startup? If yes, the good news is you've removed the unwanted
file. The bad news is that there is an entry somewhere (probably a RUN key
in the registry) that still needs to be removed.

Doug Knox has a a startup tracker program. You can find it here:
http://www.dougknox.com/xp/utils/xp_starttrack.htm
Follow his directions for installing and running. When you get the list of
startup items for the program, look for the ones that mention toolbar.dll.
Doug's program will tell you where this is loading from and which registry
key the command is located in. If you need help deciphering the path for
the toolbar.dll startup, let us know.


PS: Also, if you use the "search this site" option at
http://www.spywareinfo.com/ (another site that specializes in removal of
these parasites), you will come up with a list of recent discussions and
references to huntbar that occur on their site.

 

[Courtney]

ok there is no toolbar.dll..... but there is a
DLLHOST.EXE C:\WINDOWS\System32\wins\DLLHOST.EXE
I'm soo helpless right now.... please help me....
Courtney

 

[Sharon F]

ok there is no toolbar.dll..... but there is a
DLLHOST.EXE C:\WINDOWS\System32\wins\DLLHOST.EXE
I'm soo helpless right now.... please help me....
Courtney

Oh boy, do you have a mess on your hands. Spyware and now a virus. When
dllhost.exe shows up in the location that you've mentioned it means that
you probably have the Welchia worm on this system:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

NOTE: There is a link on that page to a tool that removes this worm. Also,
be sure to follow up on any manual steps in the removal description.

After cleaning that up, check that system thoroughly with an up to date
antivirus program. If you do not have an up to date antivirus program or if
you suspect your antivirus program is being blocked by an infection of
virus, worm or trojan - you can use one of the online scanners:

http://security.symantec.com/default.asp?productid=symhome&langid=ie&venid=sym
http://housecall.trendmicro.com/
http://www.avp.ru/remoteviruschk.html
http://www3.ca.com/virusinfo/virusscan.aspx

And be more careful in the future about what you click on! While the number
of viruses that can be installed without any user intervention haave
increased recently, most still require the user to download and double
click on something. Be suspicious of all email attachments, even those from
the people you know as their machine may be infected. They haven't sent you
a virus on purpose, they just aren't aware that they are infected yet.

 

[Courtney]

ok with that address.....
(http://securityresponse.symantec.com/avcenter/venc/data/w
32.welchia.worm.html) what would I go to... It makes no
since to me.... and the reason I have a virus would that
be because someone took out the norton virus thingy?
Please help me.... sorry for all of this...
Courtney

 

[Sharon F]

ok with that address.....
(http://securityresponse.symantec.com/avcenter/venc/data/w
32.welchia.worm.html) what would I go to... It makes no
since to me.... and the reason I have a virus would that
be because someone took out the norton virus thingy?
Please help me.... sorry for all of this...
Courtney

Courtney, the link I gave you before goes to a page that gives information
about what this virus does and the directions for removal. This link goes
directly to the page where you can downnload the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

The reason you have the virus is because someone clicked on something they
shouldn't have. If your antivirus program had still been installed, it
could not stop someone from clicking. But it would have detected the virus
and would have tried to clean it up. If it couldn't clean the virus, it
would have at least told you that there was one.

 

[Courtney]

Thanks.... now I did....W32.Welchia worm Remove tool(the
scan) and a box came up read this....
W32.Welchia worm has been sucessfully removed from your
computer!
Does that mean that that virus and the pop up box won't
come up any more?
Courtney

 

[Sharon F]

Thanks.... now I did....W32.Welchia worm Remove tool(the
scan) and a box came up read this....
W32.Welchia worm has been sucessfully removed from your
computer!
Does that mean that that virus and the pop up box won't
come up any more?
Courtney

Am glad to hear that you got this virus removed. I'm hoping that you don't
get anymore popup boxes but we'll have to wait and see I guess. You've
removed one virus and one batch of spyware so far. Lets hope that's all
there was and that you're done.

You can get free antivirus program if you'd like. It's called "AVG" and you
can get it from www.grisoft.com Quite a few of the folks that hang out in
these newsgroups use this product and like it.

Also, EzTrust is offering to Microsoft users, a free one year subscription
to their EzArmor (antivirus, firewall and email protection):
http://www.my-etrust.com/products/productpage.cfm?productName=Antivirus

Personally, I currently use this company's antivirus program on all of my
home computers. I didn't like their firewall too much but it has been
redesigned since I tried it.

Suggestions for you:
-- Pick an antivirus program. Install it. Update it on a regular basis. As
new viruses are discovered, new "definitions" are released and you must get
these if you want the system to be protected. Run the auto-protection for
daily safety. Once a week do a check all of the files on the system for
viruses (often referred to as a "full system scan").
-- Use a firewall. The XP firewall is fine for protecting you against
incoming attacks. If you choose to use a third party firewall instead,
these usually include outgoing monitoring as well.
-- Download AdAware. This gets updated regularly too. I don't allow this to
run in the background like my antivirus program but once a week, I check
for updates and then run a system scan with it. "Spybot Search & Destroy"
is another program that helps to detect and remove spyware. I think it's a
little harder for beginners to use than AdAware but it has very good help
files.

 

[Courteney]

I spoke too soon... it still comes up!! HELP!!
Courtney

 

[Sharon F]

I spoke too soon... it still comes up!! HELP!!
Courtney

What still comes up? You've given us several startup errors so far in this
thread. If it's the message about the toolbar, did you follow the steps
exactly for its removal? If yes, visit the spywareinfo forums. These folks
are experts on the current spyware (am remembering that the one you
had/have is one with many, many variations).

http://forums.spywareinfo.com/