Thanks for forwarding these.
You might want to also inform people that some
viruses/trojans/adware/spyware will block windows update. When the
original email on this thread came in, I was in the process of scanning
a drive for nastiness, of which ~80 different things were found, all
classified by Norton 2005 or Symantec AV CE v9 as being ad/spyware.
No official viruses. :)
My cleaning attempts.... after cleaning from the booted drive....
Plug it in as a secondary drive in a good system, thoroughly
scanned & cleaned with Symantec AV CE9.0 & Ad-Aware Pro (both with
current sig files)
Some files were found which could not be deleted in this
situation. I had to go change ownership of the files, then the attribs
could be changed and the files deleted.
Scanned it again. Appeared clean in both SAV & AdAware
Then booted and ran Norton 2005 & Ad-Aware, 2 items found.
Manual removal was possible. Rescanning looks clean.
Ran the toolbarcop
(http://www.mvps.org/sramesh2k/toolbarcop.htm) and removed everything.
Rescan everything looks clean. Homepage still hijacked and
windowsupdate fails, still stating that activex isn't allowed.
Needless to say, I've added all the appropriate sites to the 'trusted
sites', as well as tried with internet security settings set at low.
At this point the MSIE homepage still gets hijacked, and Windows Update
gets blocked.
Amazing.... no viruses... Just adware. It should be a crime.
I'm telling the guy to go home and burn copies of everything he needs,
without plugging into the net, and bring it back with the restore CDs.
All this because he let a nephew on his PC during a visit. This nephew
apparently likes casino sites. <g>
--
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such
that just hitting reply is going to result in the message coming to the list,
not to the individual who sent the message. This was done to help reduce the
number of Out of Office messages posters received. So if you want to send a
reply just to the poster, you'll have to copy their email address out of the
message and place it in your TO: field.
--
