WARNING - Intelligent Explorer Virus

12/7/03 | TC

[Tumbleweed_Connection]

I sat dont at my station over an hour ago and responded to an Explorer upgrade option without thinking.

This ISN'T a normal option, it was simply a pop-up. Without thinking I responded to upgrade and downloaded a nightmare.

I have yet to break this.

It consists of an additional bar which creates a new home page, http://find.intelius.com with files I've deleted in addition to wwd.ieplugin[1] - and proceeds to iniate infinite pop-ups of EVERY type out of http://www.n-case.com.

ANYTHING internet related will be tattooed with the new bar. View - Toolbars - Intelligent Explorer" will eliminate the bar from your current page but each new one you bring up will require you to go through the process of removing it again.

[Squantos]

You feelin better FT ?.............:o)

[Free Trapper]

If you don't have Spyware Blaster,IIRC it did not take long to install,(I'm on a landline)and it keeps all kinds of things from ever getting in.

Also,it will tell you what each of the things it blocks can do.Spooky.That'll turn you into a believer in the"safetys"pretty quick.

It gets updates all the time that are quick and simple to get.

After getting a bunch of those downloads,I was kind of wishing I'd gotten it first because as little as I know about computers it was easy to download and would have been a good one to break in on.

It keeps Spybot and Addaware from having to get rid of so much,too.

[Free Trapper]

Sure thing,and a big thank you.

I'll drop you a note after I rest up and get on my feet a little more.

"Some" folk are a sure bet to be dependable here for late night cleanup,don't you know.:o)

[visualops]

The Google toolbar popup blocker is very effective. It's also easy enough to click the popup-blocker-button when at a particular website, to allow popups at that site only. For instance, for the message notifier here at FR.
As far as "upgrades", suffice it to say, don't download anything that you yourself didn't seek out at Windows Update.

[visualops]

The entry will have to be removed from the registry, as well as the actual program(s). Ad Aware or another spyware-finding program can help you get rid of it if you don't know where to look or what to get rid of.

[visualops]

They are also likely in your IE temp file folder.

[gatorgriz]

Like you I use both Spybot and Ad-aware and I've had great luck with both of them... I run each of them about once a week to scrub the spyware and garbage from my PC...

I'd never, ever install anything based on a pop-up or e-mail message...

[Holly_P]

I have zone alarm but it's the free version. How much is the one you have? I like the zone alarm and am wondering if the version that costs is worth it?

[raybbr]

I switched a month ago. What a difference. Firebird is the best. (I always liked it better than the Camaro)

[general_re]

Unfortunately, I "downloaded" the Sunday night updates, but fortunately, I did NOT "install" them. How can I get the "downloaded" files off my computer?

Why do you want to do that? Are you thinking it's the update that broke the program?

Anyway, it's possible, I suppose, but the easiest way to proceed from here would probably be to take your computer offline, uninstall Norton, reboot, and reinstall it. Then, once you've got it reinstalled, reconnect to the network and re-run LiveUpdate. 95 times out of 100, that'll clear up the problem, and it's easier than tracking down whatever the specific issue is.

[muggs]

I have that problem too. I downloaded Spybot and ran it and still have the problem.

[Happy2BMe]

If you are running windows xp, you need to go to the Microsoft web site, find both the blaster and the melissa virus cleaners and run them.

Then you need to make sure you download and install each and all of the security updates found during the autoscan of your windows update.

[TheBattman]

AdAware - I picked up viruses every time I did an AdAware scan.

You do realize that it was not AdAware giving you viruses.

[hmmmmm]

I use the Google toolbar and have the pop-up blocker working. It didn't work on the banner ad on Drudge's site because that ad was based on a computer's mouse. If scrolled over, the pop-up appeared.
Your warning about "upgrades" is good but maybe it should be taken a step further.... don't click the "no" button, click the X in the upper right corner. In other words, don't trust anything you didn't ask for.

[Malsua]

I posted this same message to a similar thread. It's a similar synthesis to Martin_fierro's post, but more about getting rid of hijack'd browsers rather than protection. Everything in this post is also posted in the thread, but this is a laundry list.
------
There are several things to be done, and you can clear these blights without too much trouble.

First, get "Hijackthis". It will list all the objects affecting IE. There are forums that can help you decypher what is what. You've probably got an evil BHO installed.

http://mjc1.com/mirror/hjt/

Then get and run CWS Shredder.

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Get and run Spyware blaster:

http://www.javacoolsoftware.com/spywareblaster.html

Run Adaware:
http://www.lavasoft.de/

Run Spybot Search and destroy and thereafter immunize with it.

http://www.safer-networking.org/index.php?lang=en&page=download

And once you've done all that. Get Mozilla Firebird and use it instead :)

http://www.mozilla.org/projects/firebird/

[varina davis]

Bookmark

[Free Trapper]

Thanks for the links.:)

Besides running the scandisk and defragmenter are there any other basic practices or cleanups for keeping a computer healthy?(for the computer illiterate-me)

[bicycle thug]

Man, your headache is familiar and I sympathize. I caught a Lop.com install strategically placed in the line of fire for another download and I installed the same sort of curse on my machine.

I am a believer now, ad ware and other parasitic crap are dangerous and I have no toleration of it. Webroot's Spy Sweeper is also a good program, but to get the latest definitions you have to subscribe to get them.

I refused to use the Lop.com uninstall to get my affliction of it removed as I correctly assumed any company who would do that to people like me would not put out an uninstall that would remove all their crap.

Xupiter.com is a mirror image of Lop.com and both these people have generated a great deal of material that can be found on a search telling about thousands of people who also hate them at least as passionately as I do.

Do NOT go to these sites on your machine BTW. Stay away from them. IF Ad Aware and Spybot show you an ad ware program you had previously liked to be spyware, remove it.

Many people think they like Gator for example because it fills out forms for them and stores personal information on them. Get over it if thast is true of anyone reading this, there are at least two freeware programs that do the same thing and don't steal use of your machine for a third party's financial betterment.

Some ad ware replace Windows files with their own .DLL files that make your machine run poorly and can give you BSOD (blue screen of death) headaches.

Your computer is your private property, get Spybot and Ad Aware at the very least, and definitely get a decent firewall like Zone Alarm.

At home I have four machines on my network. One of them is my firewall the others have to go through to get to the Internet. It is a 486 and it basically employed as my hardware firewall. I also have some nasty surprises for script kiddies and other jerks who are clever enough to break into it.

I make it as difficult as humanly possible to get to my best computer these days. I'm sure glad I never threw it away, if the Internet gets much worse I am ready for it, I hope. ;-)

[Kenny Bunk]

The number of problems I once had took a dramatic downturn when I went to a router.

Problem: Hi-Speed Internet Service Providers HATE routers and ping them several times a day to kick you off service. It is a PIA, but a mildly inconvenient one, once you figure out a quickie router re-boot sequence.

The Marketing genii that run Road Runner are particularly obnoxious about it, as they have invented their own router service ... Commercial Hi-Speed. So here, a router and a continuously updated Norton AV have done the trick.

[biblewonk]

ping