11-01-2004 04:21									#1
	Evil script killing my comp Inflate your Upload Space

I visited an "alternative site" and within seconds, an evil script entered my system and took over. It puts the file mshp.dll into my Windows file whenever I enter the net, and reinstalls it there whenever it gets the chance, despite that I remove it all the time. This mshp.dll redirects me to a marihuana/pr0n/viagra/whatever crap portal every 15 minutes of surfing or so. Extremely annoying. It has also changed my system folder into a playlist, so that all system files are listed as MP3:s with song title, album, endurance, etc instead of system files info like changing date and similar things that would help me trace the virus/worm. The bad-ass software makes Norton Antivirus and the regedit crash as soon as I try to reach the problem. Anyone seen this? What did you do to solve it?

	11-01-2004 04:26									#2
	Support Apolyton, buy Galactic Civilizations: Deluxe Edition

Install Mozilla.
But I admit this can only hepl prevent this crap, not solve it.

	11-01-2004 04:29									#3
	Got spare money?

Would Spybot or Lavasoft's Ad-ware be effective in eliminating this? Might be worth a try.

	11-01-2004 04:33									#4
	Inflate your Upload Space

The few times I've had malicious files causing problems, I've done a search from the Start Menu for all files that were changed the particular day the problem started. I sort these files chronologically and find the approximate time of the day the problem first occured, then delete whatever files I find to look suspicious. Clues for possible culprits include name, file type, and where the file is located.

Don't know if this will help, just that it's worked for me so far.

	11-01-2004 04:39									#5
	Browse Apolyton AD-FREE

Winston, that was the first thing that entered my mind. I tried that and it did not help. (Just by the way, a DANISH site did this, www.adultlust.dk) Dont go there, I warn you!!!!

	11-01-2004 04:46									#6
	Support Apolyton

Danish...figures.

	11-01-2004 04:50									#7
	Lose 30 kilos (of popups)

quote: Originally posted by Chemical Ollie (Just by the way, a DANISH site did this, www.adultlust.dk)

How do you know this site is the culprit? I went there (my comp needs a good format anyway), and there wasn't anything abnormal...

	11-01-2004 04:51									#8
	Support Apolyton, buy GURPS/ Alpha Centauri

You have to make sure that all files are displayed, also the hidden ones and system files. But I'm sure you've thought of that already.

Maybe a search for all .exe, .pif, .scr files etc. regardless of date would be worth a shot? There has to be a bad apple somewhere on your C: drive.

	11-01-2004 04:56									#9
	Lose 30 kilos (of popups)

Spybot

Adaware

both do well by me

	11-01-2004 05:04									#10
	Enter the AD-FREE zone

quote: Originally posted by Spiffor How do you know this site is the culprit? I went there (my comp needs a good format anyway), and there wasn't anything abnormal...

There isn't anything abnormal - that's the problem. But clicking the links is like Russian roulette. Most of them are harmless, but a few are evil. Historicially, Norton took care of the problem for me and stopped the scripts, but this time it happened to chrash at exactly the wrong time AARRGGHH.

I did a new search of the kind Winston suggested and found 9 files that was changed at excactly the same minute this problem entered my comp. I've removed them all, but two particular files seems too be badder than the rest. My system says " these files are in use and can't be removed". They are named msiesh.dll and iefeatsl.dll, located in the "wellknown" iefeatsl folder of my application data folder. How do I kill these bastards? ?

	11-01-2004 05:10									#11
	Tired of ads?

If you have difficulty rooting it out, I recommend 'Start-Up Mechanic' (it's free from the maker). It roots out programmes that like to 'run in the background' and have that nasty habit of silently installing themselves or other things over your connection.

Just make sure you don't use start-up mechanic to 'quarantine' anything you actually want like explorer!

	11-01-2004 05:12									#12
	Suffering from ads?

If you're under winxp, try ctrl+alt+suppr, and go for the "process" tab. Kill suspicious processes on sight. I don't think you can do anything harmful to your computer here, but this may lead to a disconnect or a restart.

If you have another computer in your home, connect both computers through a Network cable, and have the folders with suspicious files shared with writing-rights. Delete the files from the other computer.

	11-01-2004 05:12									#13
	Support Apolyton, buy Civilization 2

quote: Originally posted by Chemical Ollie How do I kill these bastards? ?

Restart the computer, this should allow you to delete the folder with the two files.

	11-01-2004 05:21									#14
	Suffering from ads?

I keep getting unwanted pop-ups about adult personals ads, Viagra, gambling, marijuana and whatever annoying or illegal stuff there is, every 15 minutes or so, apart fram the already annoying "Britney images and US green-card" pop-ups Marko already added to this site.

How could I be so stupid that I:
1) didn't reinstall and update Norton for 9 months?
2) Entered a pr0n portal I already knew had started to link to idiotic scripted sites, just ot watch some harmless amateur tits I could watch in my bedroom every night anyway?

	11-01-2004 05:25									#15
	Remove this text

Ending 'suspicious' looking processes when you don't really know what you're looking for is a great way to see the 'Remote Call Procedure Terminated' error message in XP.

Same thing for manually opening up regedit and deleting suspicious Registry Entries....they may simply be re-installed the next time you restart your computer if the Bad Stuff in question is well hidden.

General tips:
1. Start-up mechanic

2. Apolyton's front-page uses some good web based detectors that pick up a lot (it might be SB S &D?)

3. Make sure your frequently make system back ups, once a month, so that if you ever have to do an XP restore, you don't lose too much.

4. Lavasoft adaware picks up a lot of dialers.

5. Last resort: If you INSIST on visiting those places which WILL try to install junk (i.e. warez pages) get a router where you can watch, monitor, and controll all traffic in real-time via the software that comes with your router. You can of course do this just with your computer alone, but a router is an extra layer of foolproof protection if you really think someone has been executing commands or whatever and you haven't been able to find out how.

	11-01-2004 05:26									#16
	Support Apolyton buy from Amazon

quote: Originally posted by Spiffor If you're under winxp, try ctrl+alt+suppr, and go for the "process" tab. Kill suspicious processes on sight. I don't think you can do anything harmful to your computer here, but this may lead to a disconnect or a restart. If you have another computer in your home, connect both computers through a Network cable, and have the folders with suspicious files shared with writing-rights. Delete the files from the other computer.

I did this. I killed mslaugh.exe and about 5 other suspects, one by one, and there's no suspects left now. 8 hours since I rebooted now. Earlier this afternoon, msblast went out the same way and did not come back, but I soon realised that the Blaster Worm was only ONE of the problems. When msblaster was on, I had to reboot every second minute to keep the comp alive. That problem is gone.

	11-01-2004 05:28									#17
	Get a bigger avatar today!

When confronted with these problems, I usually save the few necessary files on a CD or two, then start all over re-installing everything. It doesn't save me any time but it isn't half as annoying as getting those ridiculous pop-ups and the adventures of a Danish nun and three Dutch sailors thrown at me when I least expect it.

	11-01-2004 05:32									#18
	Suffering from ads?

quote: Originally posted by Monk When confronted with these problems, I usually save the few necessary files on a CD or two, then start all over re-installing everything. It doesn't save me any time but it isn't half as annoying as getting those ridiculous pop-ups and getting the adventures of a Danish nun and three Dutch sailormen thrown at me when I least expect it.

My family photo album would probably fit on one CD, but I have about 30 or so GB of music and video that would be gone if I did what you suggest. I would rather buy an new hard disk and keep the old as a slave. But then the worm/virus would just transfer, right?

	11-01-2004 05:40									#19
	Increase the size of your Attachments

This sort of stuff worries me like hell. But i am not personally good with PC's
I dunno how to rptect myself, i have spybot, but don't really know what I am doing, and most stuff out there isn't free, and i am not a rich man

advice?

	11-01-2004 05:41									#20
	Enter the AD-FREE zone

"advice?"

Read this thread.

	11-01-2004 05:43									#21
	Support Apolyton

I am, but as i said, can't aford adaware

Also, as i said, I dunno what i am doing with spybot

	11-01-2004 05:48									#22
	Support Apolyton, buy Galactic Civilizations: Deluxe Edition

Start-up mechanic is free.

So is whatever Apolyton uses on the frontpage.

These things are in the thread.

Shields-Up! Test is free, and they have links and reams of advice on that site.

	11-01-2004 05:55									#23
	Increase Your PM Length

thx, i will goto the fron page now and refesh furiously

	11-01-2004 05:55									#24
	Inflate your Upload Space

quote: Originally posted by Seeker Ending 'suspicious' looking processes when you don't really know what you're looking for is a great way to see the 'Remote Call Procedure Terminated' error message in XP. Same thing for manually opening up regedit and deleting suspicious Registry Entries....they may simply be re-installed the next time you restart your computer if the Bad Stuff in question is well hidden. ---

This is something I have seen about 30 times this afternoon

	11-01-2004 06:06									#25
	Support Apolyton, buy Civilization: The Boardgame

Any chance you'd remember which registry entries or processes (if any) you ended?

How often do you have system restore set to save your system?

Also: Do you keep a keystoke log of yourself? A 1-Day keystroke log can be helpful to find out how you managed to put your &#$% in your own !@#%.

	11-01-2004 06:17									#26
	Support Apolyton buy from Amazon

If you purchase a new hard drive, and do a clean install of Windows and this should fix your problems. Make sure you old hard drive is disconnected while you do this. As soon as you boot up, install Norton, get the updates, and scan your old hard drive. You can then use something like Norton Ghost to run a mirror (RAID level 1) of the other hard drive, or actually run a RAID level one if you motherboard supports it. It still doesn't solve the problem I had - a capacitor blew in my power supply, and blew both hard drives .

	11-01-2004 06:23									#27
	Support Apolyton, buy Call to Power 2

the hting i'd like to know is who actually benefits from all these virus' and spyware and stuff

	11-01-2004 06:36									#28
	Support Apolyton, buy Civilization III: Complete

Certainly, I don't. I've been off-line for 3 days until now. I'm quite sure the msiesh.dll 1.0.0.4 SearchHook Module ilocated in the otherwise empty iefeatsl folder s the culprit, but I don't know. At least it matches the occurance of the problem on the minute and my system will not let me remove it even after I removed the write-protection.

And my system still wants to reboot every time I get get even close to solving the problem, just to make life harder to me

	11-01-2004 06:41									#29
	Put an end to popups!

do you have to reboot every few minutes without choice?

	11-01-2004 06:44									#30
	Support Apolyton, buy Call to Power 2

Formatting your copy after having saved the archivable content is the way to go then. This is the kind of thing that very rarely fails. Unfortunately, it takes time, and it's difficult if you're not experienced.