Error - template LAYOUT-DATA-WRAPPER not found

A configuration error was detected in the CGI script; the LAYOUT-DATA-WRAPPER template could not be found.

Error - template STYLE-SHEET not found

A configuration error was detected in the CGI script; the STYLE-SHEET template could not be found.

Error - template SUB-TOP-BANNER not found

A configuration error was detected in the CGI script; the SUB-TOP-BANNER template could not be found.
Subject:
From:
Toomas Piibe <[log in to unmask]>
Reply To:
PCSOFT - Personal Computer software discussion list <[log in to unmask]>
Date:
Tue, 18 Jan 2005 17:46:27 +0200
Content-Type:
text/plain
Parts/Attachments:
text/plain (128 lines)
Uninstalling IE and reinstalling , eve if this is possible
would not help.Hijacker like this works that way.
When computer is infected, part of it writes code
so when computer starts program starts also and
changes homepage. It also checks time to time
if homepage is changed and set it back its version.
It also checks isn't loaded code removed from startup.

To clean is first identify it's process in memory.
You can try to identify it from Windows task manager
pressing Ctrl-Alt-Del right click on process and
select End Process. But this would not stop it
load again when computer is restarted unless You
remove it.

HijackThis log file is good for identifying it.
You can post log to forums and/or Usenet or
send to someone who maybe could point out
suspicious programs.

Toomas



----- Original Message -----
From: "David Grossman" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Sunday, January 16, 2005 3:15 AM
Subject: Re: [PCSOFT] Hijacked browser, continued.


> Hello, Toomas,
>
> Your suggestions were excellent! There is definitely progress (although I'm
> not out of the woods yet).
>
> Apparently, one of the malware programs deleted my System Restore points.
> I've never seen anything like this before! I restored it to the only Restore
> point that I had - the day in which the problems began. I hoped that the
> time was before my problems started. However, that restore caused all of the
> original problems to return. Since I *have* made progress removing some
> malware since then, I undid the Restore.
>
> I ran System File Checker, as you suggested, and my Hebrew was restored!
> Thank you very much, Toomas!
>
> Apparently, the only issues remaining are frequent large popups and the
> start page hijacking. I'll delete and put back the Google toolbar, and I
> hope that will eliminate the popups.
>
> --> Toomas, if I delete IE and re-install it, could that eliminate the start
> page hijacking? <--
>
> David Grossman
>
>
>
>
> ----- Original Message -----
> From: "Toomas Piibe" <[log in to unmask]>
> To: <[log in to unmask]>
> Sent: Friday, January 14, 2005 6:49 PM
> Subject: Re: [PCSOFT] Hijacked browser, continued.
>
>
>> BCC directly to David
>>
>> Seems that You allowed HijackThis delete some
>> needed parts of OS. HT detects all software
>> started at bootup and Browser Helper Objects.
>> Support for Hebrew is not malware but is
>> listed by HT.
>>
>> Do System Restore for date before You run it
>> and try again with Spybot. Then run system file
>> checker (Start -> Run -> sfc /scannow)
>>
>>
>> Toomas
>>
>>
>>
>> ----- Original Message -----
>> From: "David Grossman" <[log in to unmask]>
>>
>>
>> > Hello, Toomas,
>> > I ran Spybot and HijackThis in safe mode, as you recommended. HijackThis
>> > found a lot of problems and I deleted many of them.
>> > However, I probably missed some, since I still have problems:
>> > 1. I still get an endless delay in opening IE6, followed by a large menu
>> > screen (the Windows logo next to "Home Search")
>> > 2. The large menu screen tries (endlessly!) to download picture
>> > http://searchxp.com/pop/img/b1.gif
>> > 3. IE6 sometimes locks up when starting
>> > 4. MS Config does not work right any more. It opens and closes before I
> can
>> > click on any of the tabs
>> > 5. I lost my Hebrew foreign language support in Word and IE6
>> > 6. IE6 is now more fussy about addresses. It will not work at all (it
> just
>> > sits and waits) if I type geocities.com instead of
> http://www.geocities.com
>> > Should I try something else before just giving up and re-loading Windows
> XP?
>> >
>> >> From: "Toomas Piibe" <[log in to unmask]>
>> >> Run Spybot and HijackThis in safe mode.
>> >
>> >               The NOSPIN Group Promotions is now offering
>> >              Mandrake Linux or Red Hat Linux CD sets along
>> >             with the OpenOffice CD...  at a great price!!!
>> >             http://freepctech.com/goodies/promotions.shtml
>> >
>>
>>                          PCSOFT's List Owner's:
>>                       Bob Wright<[log in to unmask]>
>>                        Drew Dunn<[log in to unmask]>
>
>             PCSOFT maintains many useful files for download
>                     visit our download web page at:
>                  http://freepctech.com/downloads.shtml
>

             Do you want to signoff PCSOFT or just change to
                    Digest mode - visit our web site:
                   http://freepctech.com/pcsoft.shtml

ATOM RSS1 RSS2

LISTSERV.ICORS.ORG Secured by F-Secure Anti-Virus CataList Email List Search Powered by LISTSERV