IE comprimised

[Mike M]

Internet Explorer and my Earthlink Pop-Up Blocker were
compromised a day ago. Can anyone advise how to get rid
of this?
Symptoms: Web browser start page now defaults to
res://nuvps.dll/index.html#28129, Earthlink Pop-Up
blocker was disabled and now I get pop-up ads to sell me
Pop-up blocking software, slower connection, lots of
unwanted pop-up ads.
System: XP-Home
Steps already taken: Virus scan, Reload Earthlink,
attempted system restore date (says nothing changed),
downloaded Adaware. Still same problems

 

[LuckyStrike]

See here:

Welcome to Merijn.org
http://66.102.7.104/search?q=cache:qfdFBYoRvTcJ:www.spywareinfo.com/~merijn/+&hl=en

I'm having some difficulty finding the most recent "solutions" offered at
SpywareInfo Forums. With any luck, I should be able to find them and get
back to you.
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html

 

[LuckyStrike]

Here are another couple of links which will require some HeavyDuty reading.
<s>

http://forums.techguy.org/archive/index.php/t-240272.html
http://forums.spywareinfo.com/index.php?showtopic=7447&st=0

Many others by doing a Google search using the terms:
res -- random dll
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html

 

[H Leboeuf]

LuckyStrike, this is the latest that I know.

Read this topic if your infection is similar to this one.

res://<random>.dll/<random>.html#<random>
http://forums.spywareinfo.com/index.php?showtopic=8847


Quote

Ad-Aware should be file : v6.0 Build 6.181 and you should have reference
file: 01R324 22.06.2004 installed. Please update your copy of ad-aware and
boot into safe mode and run it, before posting a request for help. (How do I
boot into "Safe" mode?)

It appears that ad-aware is cleaning the files etc but not deleting the
registry entries associated with the clean so they may still show up in the
HijackThis log. If you still get the entries after booting into normal mode
and are not sure what to delete, post your log in the forum but mention what
version of ad-aware you run as well as the reference file version - This
will help in the resolution.

Also - If you request help, DO NOT reboot your computer until you receive a
response as the files change as soon as you reboot. If you receive no
response and you have rebooted - Post a new HijackThis log into your current
message - DO NOT start a new message again as we cannot keep up with all the
calls.
Unquote.

 

[LuckyStrike]

Greetings Henri -

Heh! Thanks for your concern; 'preciate it, but I was just having some
problem accessing that link to aid Mike M. who is having this "unique" <g>
problem. Depending upon how I read your post, I might think that you might
think (that newsgroup readers might think <BG>) that my machine is infected.
It isn't, but thanks again.

In fact, I posted that link multiple times, the earliest of which was back
on 24/June/04 to thread "HELP - BROWSER HIJ ACK!"
it just wasn't able to be
displayed first thing yesterday. I think I was having some problem with my
local DSL ISP provider, and my pages were kind of sluggish, or "couldn't be
displayed", during the early morning hours.(What th' ???) :-\

Nevertheless, I always appreciate to hear from you Henri, soooo... *Thanks*
.. <vbs>
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------

 

[LuckyStrike]

Oops... (heh-heh) I meant to Copy/Paste
That oughta work.