Help with computer problem please.....

HacheMan · Mar 13, 2004

Little help here please guys. Ive had my home page taken over.This has happened in the past, like it has many of you, and I usually just run Ad~aware or spybot and get rid of anything necessary, then reset my homepage. But this one is giving me fits though. It keeps resetting my home page, adding 5~6 links in my favorites, and even adding many in my address bar. I run ad~aware, spybot, delete those links that it added to my favorites, clear my history, cookies, etc., but comes back. Where and how can I find this file or program and get rid of it?!

The site is called "searchmyrequest".......Thanks a ton guys...

RPM · Mar 13, 2004

check the folder that tells you what programs start automatically when you start your computer.

TTinCO · Mar 13, 2004

Hache, you have a worm called "worm_agobot.cn".

Trend Micro instructions on removal

After you follow the instructions, you might also want to get "Spy Sweeper" off of download.com....Similar to Adaware, but actually better.

HacheMan · Mar 13, 2004

RPM....I actually forgot how to do that......lol

RPM · Mar 13, 2004

you can always count on ttin and lander for help with this stuff!~

HacheMan · Mar 13, 2004

Thanks, I'll try that guys......I appreciate it. It's been driving me crazy. These SOB's need their scrotums smashed.......

RPM · Mar 13, 2004

HacheMan · Mar 13, 2004

TT, the one you had me look for and it describes isnt there in my registry.........

These are the directions I followed:
Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup.

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Configuration Loader "ntdm.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Runservices
In the right panel, locate and delete the entry:
Configuration Loader "ntdm.exe"

Do I have to restart my computer first in safe mode like it says above these instructions? Or is that just another option? Sorry for my ignorance!

TTinCO · Mar 13, 2004

You probably have some type of variant of that worm.

Here's a "cover all" solution. Go to trend.com & download sysclean.zip (or tsc.zip) & the latest virus pattern file(from their main page). Put all the files in the same folder, unzip them & run sysclean.exe.

This should take care of everything

HacheMan · Mar 13, 2004

Thanks.......

1cheater · Mar 14, 2004

Also, helps to update your Spybot and Adaware on a somewhat regular bassis..

I updated it just 2 weeks ago and found a few brand new nasties!

TTinCO..

Got a question for you.. I'm not sure if I have a virus or not but there's spme programs running on me causing me all kinds of fits(changes my font back and forth from BIG to small, changes the encoding on the font and also ****s the ball scroller on my mouse) I've tried Adware and Spybot to no avale..

The only way I've been resolving it is by shutting down all but essential programs after I start my computer..

Here's the programs that are running that I think may be the culprit.. rmb20, Sxaua, Zubyl, and a few others..

Wondering if you recognize any of these programs as spyware or viruses?

Thanks for your help..

1cheater · Mar 14, 2004

I found a person having the very same problem as you over at the Spybot forum Hache.. here's the link spybot forum

HacheMan · Mar 14, 2004

TTinco, I dont see "SpySweeper" at download.com anywhere?? Also, #1cheater, I see that thread from rpat on page 2 where he has the exact same problem and site taking over as I do, but I dont understand all of the stuff he posted there for the guy who responds with the answer to the problem. He says he ran spysweeper also, is all of that info he posted from spysweeper?

http://forums.net-integration.net/index.php?showtopic=11845

HacheMan · Mar 14, 2004

Hey TT.......I downloded the tsc.zip & the virus pattern file, put them in the same folder and ran the tsc that was in the folder. It ran some type of scan............now what?!

TheGeneral+ · Mar 15, 2004

Did you get it repaired hache?

Dante · Mar 15, 2004

Hache...you have to LAY OFF the porn my friend

that way it won't change your home page

HacheMan · Mar 15, 2004

No Genral...I havent ...I need TTinco to Help me with those questions above. I knew how to do this long ago, but have just completely forgotten how to go deeper into my computer. Dante, that could be the reason....lol....I actually have no idea what caused this. Its not porn it keeps resetting my home page to and adding all of those extra pages to my Favorites and address bar, so Im not sure.......Oh Dante, whats that site you use to scan for viruses freely that is updated frequently?

1cheater · Mar 15, 2004

Hache, the easiest way I can think of fixing your problem would be to set your registery back to a previous date to before your troubles started..

I believe XP or a newer version of windows has a very easy way to "Goback" or turn back your registry to a previous date..

What's your OS?

Hache, also, you asked if you had to restart in "safe mode' above to edit the registry.. I would highly recomend doing that..

If your computer doesn't have an option to "Goback" or Turn back the registry I would follow the instructions above, in safe mode, but first get a registry program that will save your registry settings and clean it for you. I Regvac, it's a pretty good one.

Let me know how you make out.

MrsCheater · Mar 18, 2004

Hache? any luck?

HacheMan · Mar 18, 2004

Cheater (Mrs.).....I used that "House Call" Scan on my computer, and it found several Trojan viruses. Now, I havent looked that site over well enough yet, but does it or any other site have a program to remove them without having to do them all manually? How come Norton or some others don' catch viruses like these?