caz1562

Right the PC is doin ma heed in AAARRRGGGHHHHH

Problem begun last Tuesday, something got via my firewall (i think otherwise it was some resident file on my HD) and installed spyware items and ad pop ups. I blamed MSN messenger plus for this (this was the last thing I installed), however since last week, there's files attempting to gain access to the internet from my temp folder. These files are in the form of 3 letters and a number (eg ZXY1.exe) and all are 415kb in size. As my Norton blocks these & promts me I say use this action all the time. However these files stay in the temp folder.

I've double clicked one of these and a pop appears saying

"Bad Elmo" You must install the proper program to continue.

Now since this all happened, the internet has been kind of slow, my homepage had changed, my toolbars all vanished and the worst thing is I cannot use any links on the web that are javascript. This is now p1ssing me off big time.

Has anyone else had problems like this ?? If so what the hell did you do to sort it, without formatting the HD.

So far I've virus checked - clear & defragged the HD. I've also deleted a few MSN messenger add-ons and Cursormedia for adware/spyware.

Nicks VR4

What Virus checker are you using ? have you got the latest signature files ?

You might want to run a scan for all files not just the default ones
Or download and run http://vil.nai.com/vil/stinger/
and ad-ware and spybot search and destroy go to download.com for these 2

caz1562

running NAV2003 - latest definition dated 23/01/2004 being used.

Every file on PC is open to scan, nothing is excusable

RichWalk

Ive had something similar- the virus's were found by Norton but not removed- I had to start the computer in Safe Mode then run Norton again- this did the trick.

Nicks VR4

Mmm odd have you actually tried deleting these files
When you say temp folder you mean IE temp folder ?

I would suggest a complete deletion of all items in that folder
and get Ad ware and search / Destroy and run make sure you download the updates too

Hope this helps



[Edited by Nicks VR4 - 1/26/2004 4:11:17 PM]

DemonDave

iTrader: (13)

Have a look at this

http://www.google.co.uk/search?q=cache:qAIVvPderpwJ:www.pchelper.nl/forum/index.php%3Fshowtopic%3D2519%26view%3Dold+%22Bad+E lmo%22+virus&hl=en&ie=UTF-8

through this http://www.freetranslation.com/web.asp

may provide some starting info

Dave.

caz1562

SORTED - WinPatrol & Spybot removed all the crap and got rid of the unknown file trying to access the net.

As for the javascript issue, for some reason Norton Internet Security had restored itself back to default and removed the properties I'd setup for various sites I access.

Mick

iTrader: (1)

CWShredder has found some stuff on my machine when I had similar problems.

Mick

EvilKyote

Muppet!

Thats one of the quickest ways to ensure your comp gets infected! don't execute unknown files, don't open e-mail attachments etc unless *YOU KNOW* what they are and that they are safe!