Porn Removal Programs?

[wreckgar]

Yeah I can hear the jokes now . . but what happened was I have a computer
that I leave open for anybody to get on. My friends, My roomate, my
roomates friends. We all come and go at various times. I moved and still
have my computer. ANd for the longest time I have been trying to fix it
(Yes this was the reason I wanted to reformat my drives in one of my posts,
but still have not done so).

Before I go through the whole reformating process, which I appreciate the
past help with and printed out those notes , are there any programs that
will remove stuff that is just making odd things happen.

The problems:
Pop up windows for casino
pop up windows for porn stuff
porn websites pop up

in my Start/Programs something called SEX is always there (I know what sex
is thats not how I mean to type it), but it's a dialer program that will not
go away.

I've gone through and gotten rid of the dialer thing attached to that
program which was 127021.dlr, and then TIBS was associated with it, so was
Website Viewer . . all those were either .exe files, or folders.

I downloaded a Windows WASH program that did not work . . the dilars pop up
after the next start up/next day even when I delete them. I tried Hyper
Wiper demo . . same deal . . spybot search and destroy, contentpurity.com,
adaware, Norton Anti Virus 2005 . . NOTHING has worked so far.

What to do? And I've heard of these types of problems, even reformating
them does not get rid of the stuff sometimes . . or so I have read.

I know the first thing I'm doing is setting up a password on my computer so
from now on NO ONE gets on here while i'm not around.

In the same response can you instruct me how to do that, and suggest a good
program like a Nany Watch program to also lock down my computer? A free one
hopefully?

Thanks for any help, and go ahead and let the jokes fly
WreckGar

 

[wreckgar]

And whatever is sticking on my computer, no pun intended, will not let me
access the Windows Update page either.

 

[David H. Lipman]

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt406.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode and shutdown as many applications as possible
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point


* * * Please report your results ! * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html






| Yeah I can hear the jokes now . . but what happened was I have a computer
| that I leave open for anybody to get on. My friends, My roomate, my
| roomates friends. We all come and go at various times. I moved and still
| have my computer. ANd for the longest time I have been trying to fix it
| (Yes this was the reason I wanted to reformat my drives in one of my posts,
| but still have not done so).
|
| Before I go through the whole reformating process, which I appreciate the
| past help with and printed out those notes , are there any programs that
| will remove stuff that is just making odd things happen.
|
| The problems:
| Pop up windows for casino
| pop up windows for porn stuff
| porn websites pop up
|
| in my Start/Programs something called SEX is always there (I know what sex
| is thats not how I mean to type it), but it's a dialer program that will not
| go away.
|
| I've gone through and gotten rid of the dialer thing attached to that
| program which was 127021.dlr, and then TIBS was associated with it, so was
| Website Viewer . . all those were either .exe files, or folders.
|
| I downloaded a Windows WASH program that did not work . . the dilars pop up
| after the next start up/next day even when I delete them. I tried Hyper
| Wiper demo . . same deal . . spybot search and destroy, contentpurity.com,
| adaware, Norton Anti Virus 2005 . . NOTHING has worked so far.
|
| What to do? And I've heard of these types of problems, even reformating
| them does not get rid of the stuff sometimes . . or so I have read.
|
| I know the first thing I'm doing is setting up a password on my computer so
| from now on NO ONE gets on here while i'm not around.
|
| In the same response can you instruct me how to do that, and suggest a good
| program like a Nany Watch program to also lock down my computer? A free one
| hopefully?
|
| Thanks for any help, and go ahead and let the jokes fly
| WreckGar
|
|

 

[Guest]

You can try going to www.lavasoftusa.com and getting ADAWARE SE. D/L it and
update the defs. Run a full system scan and see what it can pull off. Also
might want to try gettiing SPYBOT Search and Destroy (can't remember the web
addy, but just GOOGLE it and it is one of the 1st there), and do the same
thing...install, update and run. That should pull most of the spyware (and
hopefully moast or all of the popup problems you are having) off the comp.

 

[wreckgar]

What about software to keep people from going to those sites . . something
like besafe.com or cyber nany . . but free?

And how do I set my computer up to where I can lock it up and only open it
with a password?

Thanks for the replies and lack of jokes : )
WreckGar

 

[Guest]

If I remember correctly, IE has access controls built in. In IE, go to
Tools/Internet options. From there, you can set the level of security and
privacy. There is also a BLOCK sites list that you can edit as well.

If you don't have it, I suggest that you get SP2 (can't remember if you said
you had it or not) as that beefs up the security for IE a bit (POP-UP
Blocker, etc...).

If you are an AOL user, look at getting the 9.0 SE (Security Edition) and
going to KEYWORDarental Controls. No only does that help prevent your kids
getting access to the nasty sites, but you can control how much time they
spent online...plus it comes with McAfee Anti-virus for free!!

Good Luck!!

 

[Guest]

As for locking the comp..several things you can do...

1) Sign on as the administrator, go to control panel and open user accounts.
Kill any that you don't need. then select your admin acct. and add a pasword.
reboot. Windows should ask for a password to enter desktop.

2) right click on the desktop and select properties. Click on the
screensaver tab. Check "require a password" and set one. When the screensaver
comes on, it will require the pass to unlock the system. I'm not sure where
it is, but I think that you can set a "no pass needed" time frame...like set
it for one minute and if you move the mouse or hit a key within one minute of
the screensaver starting, you don't have to put in the pass. Might want to
set you screen saver to a low start time...5-10 min with no activity to start
it running and a 60 second grace period.

Good Luck!

 

[wreckgar]

Thanks Matrix and to the rest.

I must not have downloaded those programs properly.

I went to each site listed (I already had the lates Adaware), and then
downloaded:

Damage Cleanup Engine / Template 1.5MB


At the Trend Micro system site

And then lpt408.zip (AS/400, S/390, Windows) 5.9MB
MD5 checksum: 40f75adb8c439b15bfc7cf29e1854ea9

At the latest trend site.

Created a folder called CLEANING on my desktop . . unzipped both those
files, and the only clickable thing in there was 1 thing called TSC. It ran
in side an open black box, a ton of info ran by and then it stopped. No
confirmation or anything.

So I ran ADAWARE SE got everytyhing deleted out that it found. Then
restarted my computer and the stupid SEX program was there in my start up
programs, and as a shortcut on my desktop. And now when I double click my
IE my default site is no longer www.yahoo.com , it's
www.quickmetasearch.com It's like there is some type of hidden seed that
resprouts each time I restart my computer.

 

[wreckgar]

And the casino gambling pop up ads are still flying all over the place. I
think somebody else was logging into a lot of those online poker games.
I'll go into my IE and add the sites for it to block as recommended.

Thanks,
WreckGar

 

[Malke]

And whatever is sticking on my computer, no pun intended, will not let
me access the Windows Update page either.

Until you clean up your computer, you will continue to have the popups,
hijackings, and inability to access sites like WU. Here are malware
removal steps. It is crucial that you use updated tools and do all
scans in Safe Mode. If the process is daunting, don't hesitate to take
your machine to a good local professional (not a BestBuy or CompUSA
type of store). Go do something fun while they fix your computer.

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix (or WinSockFix for XP which you
can get from MajorGeeks) - see links below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and About:Buster works well in removing the
About:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke

 

[wreckgar]

I went to each link that was provided, did everything that the instructions
said, and no more pop ups, no more quickmetasearch as my home page . . but
the dialer is still there 127021.dlr

 

[David H. Lipman]

The dialer is where ?

--
Dave




| I went to each link that was provided, did everything that the instructions
| said, and no more pop ups, no more quickmetasearch as my home page . . but
| the dialer is still there 127021.dlr
|
|

 

[Guest]

Hi

Oh well your not the only one. I think I've got rid of most of the nasty
stuff however can't get rid of "quickmetasearch"

How did you do it please I can't stand it anymore!!!


Regards

IR

 

[Guest]

I had exactly the same porn spyware installed on my system and I got rid of
it using these tow programs as you describe.
Thanks.

 

[David H. Lipman]

From: "takosm" <[email protected]>

| I had exactly the same porn spyware installed on my system and I got rid of
| it using these tow programs as you describe.
| Thanks.
|


You're welcome !

 

[Fitz]

Since the post you refer to is no longer on the servers, it would help to
know what your problem is. Also helpful would be any error messages, OS
used, and what program you're trying to get rid of. The answer may not be
short or easy.

 

[David H. Lipman]

| hiya everyone
|
| i am new to this site.......n i found here very useful......coz i have
| the same problem as wreckgar ....... i've read every of the
| reply......but i don't still know how to get rid of that
| program.......plz tell me how to get rid of that.....n in a short n
| fast way plz.......or even if it's long can do i will try everything to
| get rid of that program......plz reply......plz help thankz
|
|
| --
| rosey
| ------------------------------------------------------------------------
| rosey's Profile: http://www.iamnotageek.com/member.php?userid=11758
| View this thread: http://www.iamnotageek.com/showthread.php?t=816277


You can start by writing properly in English and not like -- "n in a short n
fast way plz.."

There is no fast way except through practicing Safe Hex and prevention. Short of that is
requires much work on YOUR part to erradicate malware.

Please follow these instructions...

Dump the contents of the IE Temporary Internet Folder cache (TIF)

Start --> Settings --> Control Panel --> Internet Options --> Delete Files


Dump the contents of the Mozilla FireFox Cache

Tools --> Options --> Privacy --> Cache --> Clear


1) Download TrendMicro Sysclean by one of the following 2 methods

Trend Sysclean Method 1
---------------------------------------
Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Create a directory.
On drive "C:\"
(e.g., "c:\sysclean")

Download SYSCLEAN.COM and place it in that directory.
Download the signature files (pattern files) by obtaining the ZIP file.
For example; lpt576.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

Trend Sysclean Method 2
---------------------------------------
Download the utility SYSCLEAN_FE at the following URL --
http://www.ik-cs.com/got-a-virus.htm
SYSCLEAN_FE automates the download and execution process of the Trend Sysclean Package.
Direct URL --
http://www.ik-cs.com/programs/virtools/Sysclean_FE.exe

2) Download Ad-aware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Update Ad-aware with the latest definitions.
3) Reboot your PC into Safe Mode and shutdown as many applications as possible.
4) Using both the Trend Sysclean utility and Ad-aware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
5) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware

* * * Please report back your results * * *

 

[Richard Urban]

Get rid of what program?

--
Regards,

Richard Urban

aka Crusty (-: Old B@stard

If you knew as much as you thought you know,
You would realize that you don't know what you thought you knew!

 

[David H. Lipman]

From: "rosey" <[email protected]>

| hi... Dave
| i have follow the methods you told me .. ( method 1) but it is keep on
| saying that Pattern file "LPT$VPN.*" is missing .. so can me tell me
| what to do or where to find this file..
|
| Thankz alot for your help...
|
| waiting for your reply..
|
| bye bye
|
| --
| rosey
| ------------------------------------------------------------------------
| rosey's Profile: http://www.iamnotageek.com/member.php?userid=11758 View this thread:
http://www.iamnotageek.com/showthread.php?t=816277


Hi Rosey:

It means the Pattern File was not extracted from the ZIP file and then placed in the same
folder as SYSCLEAN.COM.

You can use the Sysclean Front End I wrote that simplifies that process.

Download SYSCLEAN_FE.EXE at...

http://www.ik-cs.com/programs/virtools/Sysclean_FE.exe

Execute; SYSCLEAN_FE.EXE
Choose; Unzip
Choose; Close


Execute; c:\sysclean\SYSCLEAN_FE.BAT
{ or Double-click on 'SYSCLEAN_FE Link' in c:\sysclean }

This will download all the needed components and when you use the Front End, will keep the
files up-to-date as well.

Reboot the PC into Safe Mode [F8 key during boot]

Shutdown as many applications as possible in Safe Mode !
It would also help for you to read - "How to perform a clean boot in Windows XP"
http://support.microsoft.com/kb/310353

Then Execute; c:\sysclean\SYSCLEAN.COM