Help me on this virus? spyware?

[///MPower]

There's a service included in Windows XP called "windows messaging service" or "winpopup." It allows a person to send a simple messages over a network. There are programs out there that allow people to spam hundreds and thousands of IP's at a time with links to whatever product they are selling. It was so rampant at one point, the Microsoft fixed it in SP2.

If you don't have SP2, I'm inclined to say that you are probably just the victim of a harmless prank. The fact that someone knows you're located in the Philippines and that they've heard of Baguio seems to indicate it was probably just someone on your LAN, or someone with the same ISP messing around.

Anyone who has done any programming knows that dialog boxes look nothing like that thing above. In fact, the only thing that really resembles that window is "winpopup."

[IIE]

Eto lumalabas, bago mag startup ang windows.

_Bumabagal ang PC
-di modouble click and HD
-may file na makulit exiplorer.exe
-di sya mdetect ng some antivirus. PLS help,. TY

bro, ngayon ko lang na-encounter yun ganun virus? vuris ba talaga yun? may tanong ako hope ok lang. hindi ba sya pede ma-cancel using your keyboard? if not. i agree with them format mo na your HD. and after mo ma-install all the software you need. install virus detector with capable to update everyday. like AVG, NOD, etc.

[Jun aka Pekto]

Anyone who has done any programming knows that dialog boxes look nothing like that thing above. In fact, the only thing that really resembles that window is "winpopup."

Obviously I'm no programmer. So excuse me if I used the wrong terminology.

[///MPower]

Sorry. I didn't mean to make that sound condescending. I was simply making a point that the two were different, and you'd actually have to go out of your way to make a window that looked like that.

[Jun aka Pekto]

Sorry. I didn't mean to make that sound condescending. I was simply making a point that the two were different, and you'd actually have to go out of your way to make a window that looked like that.

Bah. It's probably just the lack of sleep on my end.

I'm still puzzled though. I could've sworn I used winpopup back when I had W2k Pro. I remember it looking like a stripped down messenger app, not like what's on the photo unless it's a 3rd-party winpopup clone. Still a question mark to me.

Last time I saw something that customized was when I watched a friend program in Delphi years ago.

Add: Just OT a bit. That guy (ex-USAF) programmed this. Digital Atmosphere:
http://www.weathergraphics.com/

Sorry again. I blame it on lack of sleep.

[denier13]

Try mo po i-scan during safe mode with AVG anti-virus and Ad-Aware spyware remover. Free po ito, just update it first! This is my weekly maintenance with my PC! HTH!

[TH23]

I have a cure for that virus.....
Please email me at thsison*yahoo.com

[///MPower]

I have a cure for that virus.....
Please email me at thsison*yahoo.com

I wouldn't, if I were you.

[170kphlang]

seems to be more like a hacker to me than a virus, but i could also be wrong.

[Jun aka Pekto]

I haven't had a similar problem yet so far. I'm also wondering what action did the thread starter ultimately take..... Reformat and start over? Found and used a good antivirus program? Sold his pc and got a Mac? Well, maybe not so much that last one. But, it was suggested....

[mikaztro]

I suggest you use the msconfig or regedit.

-Go to START button and run "msconfig"
-Go to startup tab and remove the run apps that you think is doubtful.
-Run a multiple Os in your system so that when one OS fails, you can still diagnose your pc or run Anti-virus software that's not infected.
-Backup all your data in a DVD or extra HD.
-Try to delete all the cookies in your temp directory in your Documents & Settings folder.
-Use a more stable and safe browsers like Firefox or Netscape 8.1.
-Install Norton Anti-virus software or its equivalent. Update your virus DAt file every as often as possible. If NAV can't delete the virus file BUT can identify it's location, all you need is copy the path(location) of the virus file, then use the "regedit" command and search the virus file in your registry. After the regedit search found the location of the file in your registry, you can delete the registry of the virus.

[rudyphoto]

Nasolve ko na spyware na to>
try this from Tipidpc.com member

actually 2 files yan isang Autorun.inf at exiplorer. ngkaroon ung pc ko dahil ginamit ng misis ko ung usb niya sa netopia hayun meron na ako... try mo hijack this..

pero ako mano-mano.


ganito gawin mo..

open mo ung task manager mo [ctrl-alt-del] tapos punta ka sa Processess, hanapin mo ung exiplorer.exe, pag meron ka nakita, END Process mo.. tapos punta ka sa Folder Options-->choose Show Hidden FIles, tapos unchecked mo ung 2 options pa sa baba nun - Click mo OK..

check mo ung mga HDD mo kung meron mang Autorun.inf at exiplorer pag meron delete mo na..

then open regedit

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] then hanap mo eto

"LegalNoticeCaption"=""
"LegalNoticeText"=""

delete mo lang ung value, wag ung mismong registry data, then

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]

hanapin mo kung nakalist ung exiplorer.exe then delete pag meron


haba ng method ko, pero try mo HIJACK THIS mas mabilis

[Jun aka Pekto]

Nasolve ko na spyware na to>
try this from Tipidpc.com member

actually 2 files yan isang Autorun.inf at exiplorer. ngkaroon ung pc ko dahil ginamit ng misis ko ung usb niya sa netopia hayun meron na ako... try mo hijack this..

pero ako mano-mano.


ganito gawin mo..

open mo ung task manager mo [ctrl-alt-del] tapos punta ka sa Processess, hanapin mo ung exiplorer.exe, pag meron ka nakita, END Process mo.. tapos punta ka sa Folder Options-->choose Show Hidden FIles, tapos unchecked mo ung 2 options pa sa baba nun - Click mo OK..

check mo ung mga HDD mo kung meron mang Autorun.inf at exiplorer pag meron delete mo na..

then open regedit

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] then hanap mo eto

"LegalNoticeCaption"=""
"LegalNoticeText"=""

delete mo lang ung value, wag ung mismong registry data, then

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]

hanapin mo kung nakalist ung exiplorer.exe then delete pag meron


haba ng method ko, pero try mo HIJACK THIS mas mabilis

I like the longer solution better. I'm often leery of installing more software to fix a problem. Seems like you had the better solution after all. You should share it though, in case one of us here comes across the same problem.

I guess I should say, "Thanks!"

[rayzstyle123]

* Rudyphoto


as in po ba nawala na ung mga hidden files nung ginawa nyo yan? about dun po sa last part . ung value po ng NTWindow is "exiplorer.exe" tatanggalin ko lang po ba ung value or pati ung NTWindow? sry po newb lang me salamat po

[rudyphoto]

* Rudyphoto


as in po ba nawala na ung mga hidden files nung ginawa nyo yan? about dun po sa last part . ung value po ng NTWindow is "exiplorer.exe" tatanggalin ko lang po ba ung value or pati ung NTWindow? sry po newb lang me salamat po

yes pati yung NTwindow. ang idelete mo lang sa hidden files ay yung autorun.inf at exiplrer.

[rudyphoto]

any software that can prevent this kind of spyware? kapag yung mga staff ko ang gumagamit ng pc, napapasukan pa din eh. TIA.

[JMV]

any software that can prevent this kind of spyware? kapag yung mga staff ko ang gumagamit ng pc, napapasukan pa din eh. TIA.

Pre, if you windows is validated, try downloading Windows Defender.

[Jun aka Pekto]

any software that can prevent this kind of spyware? kapag yung mga staff ko ang gumagamit ng pc, napapasukan pa din eh. TIA.

Stay away from warez, P2P, pr0n, some gaming, and other ad-crazy sites. I could've sworn I've even picked one or two spyware from this site (plus a number of other sites from RP) although I can't remember what or when. I do remember having a suspicious certificate error from one of the threads (Hot Chicks?) at the Pitstop Subforum. I saved a screencap for future reference.



Not sure what it is. It may be nothing. But, seeing stuff like this makes me quite wary.

Most browsers nowadays should have effective ad-blockers. For realtime spyware protection, I do agree with using Windows Defender. It's free and it works well. There are of course, the freebie spyware removal apps or even retail Internet Security software.

Add: if you must have an unmonitored internet pc, make sure it's a dedicated pc not connected to the rest of the network

[ayan30]

mga tol n dale n nyo po b nyo un
PROMISE??
i am still waiting for strawberry from bagiuo


kung di pa
eto po sgot

download kyo ng SOPHOS anti virus
khit un free ok lang kaya nya linisin un
tapos
REGEDIT kyo
punta kayo s
HKEY_LOCAL_MAHCINE
SOFTWARE
Microsoft
Windows NT
Winlogon


dun makikita nyo un script
burahin nyo lang

pang ktapos nyo clena ng SOPHOS anti virus

kasi di nya kaya tanggaling un script


hope na na tanggal nyo yan pa cute n VIRUS