HELP!!!!!!!!!

Jessicado · Post by **Jessicado** » Thu Apr 21, 2005 1:10 am

OK, so the other day I was researching color coding of car stero wires when I cam on this website and immediately my computer started acting strange. It didn't even finish downloading the page and then all these popups started appearing and it was really slow. I went and checked the processes that were running, and there was a new one: netev32. I ended it and then went and searched it and deleted all the files. Immediately it was replaced by something else, which I deleted, which was then replaced by something else. javoua or something like that. Then it added all these links to porn sites on my favorites list, as well as a folder with all sorts of links to misc stuff, and a link to www.lookfor.com. My webpage automatically is set for about:blank. I have tried resetting it many times and putting about.com in my restricted sites, but it immediately changes it back. So now everytime I get online, I am directed to their webpage. Also if I search for something on the web, a $*&@##^@& popup will come on the side with suggested websites. Yeah, like I am going to visit any websites you are forcing down my throat!!!!!! How is it doing this even after I cancel the processes? I have tried emptying my temp files and my prefetch folder and any dll files in Windows 32, but am still back to square one.

Which leads me to my topic: HELP!!!!

Any info would be much appreciated.

Fenix · Post by **Fenix** » Thu Apr 21, 2005 1:15 am

you need to reformat. or you can download addaware that will remove all the spyware from your computer. but reformat wil eliminate everything.

Jessicado · Post by **Jessicado** » Thu Apr 21, 2005 1:21 am

Doesn't that mean I need to go through and save ALL of my files? I really don't want to have to do that

, because I have a ton of MP3's and saved game progress and genealogy research etc saved. Also, when I got SIMS 2, the 4th disk was defective and instead of taking it back, I just spent like 3 hours finagling (I have no idea how to spell that

) around with it to finally get it to install.

Perhaps I shall try this addaware thing and pray it works so I don't have to take the time right now to save everything. Although I really need to do that anyways........

Thanks!

Sarah · Post by **Sarah** » Thu Apr 21, 2005 8:27 am

jessicado wrote:Doesn't that mean I need to go through and save ALL of my files? I really don't want to have to do that , because I have a ton of MP3's and saved game progress and genealogy research etc saved. Also, when I got SIMS 2, the 4th disk was defective and instead of taking it back, I just spent like 3 hours finagling (I have no idea how to spell that ) around with it to finally get it to install.

Perhaps I shall try this addaware thing and pray it works so I don't have to take the time right now to save everything. Although I really need to do that anyways........

Thanks!

It really helped mine! I used the lavasoft ad-aware, and spybot: search and destroy.

It got rid of a lot, but I still had some problems. If all else fails, try getting a jump-drive and putting all of your stuff on there... Unfortunately, I don't think there is any way to save the games...

Good luck!
Sarah

Trent DeWhite · Post by **Trent DeWhite** » Thu Apr 21, 2005 8:48 am

Yeah, you should most definitely sweep your hard-drive with some type of adware program. I use SnipeRight, Spy Sweeper, Spybot: Search and Destroy, and Xoft Spy. You might want to do a search for some other free adware software.

Any other 'symptoms' beside your homepage default page being changed?

The Top Crusader · Post by **The Top Crusader** » Thu Apr 21, 2005 2:05 pm

I had a similar experience... I've ran Ad-Aware, Spybot Search and Destroy, and one other thing... it helped, but its ran slower ever since, and I still get a lot of pop ups.

It's very said.

Ruthie · Post by **Ruthie** » Thu Apr 21, 2005 2:07 pm

The Top Crusader wrote:I had a similar experience... I've ran Ad-Aware, Spybot Search and Destroy, and one other thing... it helped, but its ran slower ever since, and I still get a lot of pop ups.

It's very said.

Said?

Trent DeWhite · Post by **Trent DeWhite** » Thu Apr 21, 2005 2:10 pm

What you could also try is doing a search online for the specific problem. You mentioned netev32. I did a quick search on it and couldn't find much, except for the fact that a few people had to remove it (no specific reason). Could you perhaps give more details on the files which are causing the problem? Once you get a spyware program installed on your machine (and I would suggest you install several, since not all of them catch the same things), let me know what files show up after the adware scan. Make sure to give the full extension (*.exe, *.pif, or whatever it is).

The Top Crusader · Post by **The Top Crusader** » Thu Apr 21, 2005 2:24 pm

Simbelmyne34 wrote:
The Top Crusader wrote:I had a similar experience... I've ran Ad-Aware, Spybot Search and Destroy, and one other thing... it helped, but its ran slower ever since, and I still get a lot of pop ups.

It's very said.
Said?

Very said, indeed.

Me · Post by Me » Thu Apr 21, 2005 11:26 pm

You also need to run a virus scan immediately. There is a good free one at http://housecall.trendmicro.com. After running this and a adware/spyware search, your computer should be clean. I would then recommend installing a firewall if you are not already running one. This way you can prevent adware most progs from accessing the internet even if they get on your system again. Zone Alarm is a good free one and is available at http://www.zonelabs.com.

From the description of your problem, it sounds like you are using Internet Explorer. I would highly recommend a switch to Firefox. Not only is it smaller in filesize, it is far more secure than IE ever has been. It is also highly customizable. It is avaliable at http://www.mozilla.org.

Hope you can get the problem fixed.

Jessicado · Post by **Jessicado** » Fri Apr 22, 2005 12:03 am

Thanks for the tips. I went and downloaded a supposedly free adaware thing last night, but then after I ran it and it found all the viruses, it informed me it would charge me $29.95 to continue. It was so nice NOT to inform me of that before I downloaded it........I have 33 infected files! Yay me! Aren't I so lucky? Bet you wish you were me.....

So after I just got on here, I went to the website Me suggested, and then my Internet closed. So now I am going to go and attempt to defeat this stupid @&#@&@#&@#^! lovely present that about has gifted me with. Thankyou about. Yes, this will def make me want to come and visit your website. I especially love all the porn links that keep appearing in my favorites. That makes me look really good.

So, gonna go attempt more tips. Thanks!

Jessicado · Post by **Jessicado** » Fri Apr 22, 2005 2:07 am

AUGH!!!!!!!! So, I downloaded Ad-Aware and Spybot: Search and Destroy, which both said they eliminated many threats. I tired to go and download the virus scan that Me suggested, but everytime I try it, my internet crashes after about 30 secs. I got rid of all of the porn links, all my temp files, my prefetch folder and all suspiscous files in the Windows 32 folder. Exited the netev32 application (EVEN THOUGHT I HAD ALREADY DELETED THIS!!!!!!!) and deleted it again. Ran both of the debugger programs just to make sure. restarted the computer--same problems again. And everytime I delete a process, a new one begins with a different name: dvov32, netso32, winog32, susff32 (all .exe) went and tried to delete all of these, and they just keep reappearing. They are all in the Windows 32 folder and one in prefetch, even though I just deleted them. Oh, and Spybot keeps finding the same DSO files, 5 of them and then it says it fixes them but the next time I go back, they are still there. The same porn links are back, AUGH!!!!!!!! Let me reiterate: A-U-G-H!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

I am so tired, I am giving up for tonight and going to bed

Me · Post by Me » Fri Apr 22, 2005 3:45 pm

You won't be able to permanently get rid of the DSO stuff in SBS&D. As far as I know, they really don't do anything and are not security holes.

As for the recurring processes, they keep on coming back, likely due to a registry key that is still in the registry somewhere. The key checks to see what a process is doing, and if it has been shut down, it will connect to the internet, and pull down another one.

I have to go, but will post further details and things to try when I get home.

Trent DeWhite · Post by **Trent DeWhite** » Fri Apr 22, 2005 4:02 pm

Me wrote:As for the recurring processes, they keep on coming back, likely due to a registry key that is still in the registry somewhere. The key checks to see what a process is doing, and if it has been shut down, it will connect to the internet, and pull down another one.

Indeed, what's happened is that a registry key has been altered by a worm, and thus, will continue to create those *.exe files until it, the registry key, has been restored. What I've done when I had a similar problem is check to see what the source of the problem is . . . which can generally be find through the spyware programs. But like I said earlier, not all of them catch everything. At any rate, what you might want to try doing is checking out SpywareRemove.com and look up the specific file(s) which are causing the problem. Even you only know the names of the files generated as a result of the worm, they can still help you trace the problem and potentially help you eliminate the worm.

Me · Post by Me » Fri Apr 22, 2005 8:40 pm

I have done a little research on this problem, and whatever hijacked your browser seems to be fairly rare.

From my research, it seems that the only people who have had this problem and successfully removed it used a program called Hijack This. I did, however, find a rather lenghty tutorial on virus and spyware removal, which can be found here:
http://forums.majorgeeks.com/showthread.php?t=35407

The reason I do not reccommend using Hijack This, except as a last resort, is that is a highly technical program, and I'm not sure quite how computer savvy you are. If all else fails, I can probably walk you through the process.

It would also help if we could have some more info about your computer. What operating system? What browser are you using? Do you use a firewall?

In regard to Housecall not working, I have noticed that it is rather finnicky, especially when you have a virus, etc. There are, however, some excellent free progams that should work. I would recommend trying AntiVir http://www.free-av.com I used it before I discovered Housecall, and it's pretty good.

Let me know how it goes.

Jessicado · Post by **Jessicado** » Fri Apr 22, 2005 11:55 pm

Thank you so much for taking the time to research it! I will try your suggestions and let you know what happens.....I am not very computer savvy, but I like learning. I've gotten little viruses before and I almost enjoyed to process of learning how to fix it. It's kinda like a puzzle to me and then I am always proud when I learn new stuff. However, this virus is like a 5000 piece puzzle and I feel like I am 6....

To answer your ?s: I have Windows XP, I use IE, although I am gonna check out firefox later. I don't have a firewall that I know of. I used to have McAffee, or something like that, and had all sorts of problems and a firend deleted it or disabled it or something.......

Jessicado · Post by **Jessicado** » Sat Apr 23, 2005 12:44 am

WOOHOO!!!!!!!!!

No more porn links!!!! No more unknown processes!!!!! I have thetoo as my homepage and it STAYED there!!!! No more little popup thingy when I do searches!!!!!!!

THANKS SO MUCH!! I used hijack this and ad-aware and sybot. I am so happy!!!!!!!!! $\:D/$

Jonathan · Post by **Jonathan** » Sat Apr 23, 2005 1:01 am

jessicado wrote:Thanks for the tips. I went and downloaded a supposedly free adaware thing last night, but then after I ran it and it found all the viruses, it informed me it would charge me $29.95 to continue. It was so nice NOT to inform me of that before I downloaded it........I have 33 infected files! Yay me! Aren't I so lucky? Bet you wish you were me.....

You and I did the same thing, and I had 222 infected files

I got another free one, and the number was down to 86. I'm doing a virus scan now.

-Jonathan

Samwise · Post by **Samwise** » Sat Apr 23, 2005 2:58 am

To delete system files... if you need to in any case, do ctrl + alt + delete and exit the explorer. Before you do so make sure that you made hidden items visible. Go into the Windows folder and you should be able to delete system files.

Glad you had it fixed.

As Me said, IE is filled with security holes and I would highly recommend Firefox which you can download from Mozilla Firefox.

Trent DeWhite · Post by **Trent DeWhite** » Sat Apr 23, 2005 8:56 am

Jonathan wrote:You and I did the same thing, and I had 222 infected files I got another free one, and the number was down to 86. I'm doing a virus scan now.

It's pretty amazing. Most people have lots of 'infected' files without knowing it. Those files aren't necessarily harmful or malware, but it's definitely good to do a file sweep with an adware program once a week.

Ray wrote:To delete system files... if you need to in any case, do ctrl + alt + delete and exit the explorer. Before you do so make sure that you made hidden items visible. Go into the Windows folder and you should be able to delete system files.

One, thing that should be noted. All you should worry about are unknown exe files. DON'T just go deleting all unknown *.exe files. If you don't know what it does, do some research by typing it into Google or some other search engine. You don't want to mistakedly delete an important file.

There are several good worm-remover sites that'll let you know what do you if you encounter a particular worm or an infected *.exe file. SpywareRemove.com.