Cobster??

E

Esco!

Banned
Nov 10, 2004
12,603
1
0
Toront Ho
Cobster??

My many, many PC probs were solved except:

I got rid of all virii, spyware and adware, except for one tiny little chinese program thats stuck on my harddrive. :(

I'm gonna make a screenshot and post in this thread, OK??!




Gimme a minute, por favor
 
Esco! said:
Cobmeister, here's the little virus thats stuck in my program thingie

http://img235.imageshack.us/my.php?image=virusbitch7nv.gif

When I try to delete it the normal way (by simply clicking change/remove), I suddenly I get fowarded to some chinese website. (obviously not my intention)!

I'll post the damn homepage in a minute.....cheers! :)

(btw...its in chinese)
Click to expand...

http://netsquirrel.com/msconfig/

try typing msconfig at your start then run and type msconfig.

look for any programs at startup that don't belong there.

uncheck those that do not belong in the startup.

if you are unsure of file, then google it and if it is a windows file it will come up in google.

if there is any file you cannot delete then try unlocker.

http://ccollomb.free.fr/unlocker/

make note of the files you find in msconfig and you can try to delete those using unlocker and search for entries in the windows regsitry.

you will have to manually look for any entries in the windows registry as well.


I google and found this:

The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000

http://support.microsoft.com/?kbid=890830
 
http://www.spyany.com/program/article_spy_rm_CnsMin.html

Remove CnsMin
About CnsMin Spyware

CnsMin is another keyword-lookup provider that takes over the search feature of IE's address bar. It is aimed at providing keywords using Chinese characters.

Other than replacing the IE search feature with a Chinese site likely to be incomprehensible to non-Chinese users, CnsMin is not overtly harmful, but it uses extremely anti-social methods to make it difficult to uninstall.

CnsMin is installed by ActiveX drive-by-download at its company's site, 3721.com. Has also apparently been included in junk e-mail, which could be how some Western users have ended up with it.
 
http://en.wikipedia.org/wiki/Yahoo!_Assistant

Yahoo! Assistant
From Wikipedia, the free encyclopedia

Yahoo! Assistant, formerly named 3721 Internet Assistant, is a Browser Helper Object for Internet Explorer developed by Beijing 3721 Technology Co. Ltd, and was renamed to Yahoo! Assistant after Beijing 3721 Technology was acquired by Yahoo!.

3721 Internet Assistant, together with 3721 Chinese Keywords, are known as Spyware by Microsoft AntiSpyware, and malware or Browser Hijacker by some others, such as Panda.

Contents
1 Distrubution
2 Features
2.1 Blocking popup ads
2.2 Internet Explorer Extension Management
2.3 Concealing
3 Uninstall
4 Step to block 3721 websites
5 External links

Distrubution
3721 Internet Assistant was originally released as a normal client-server application. However, it turned to use ActiveX technology to install itself on client system later and was also shipped with many sharewares as default install options. 3721 Internet Assistant was also accursed for its using of a flaw in Microsoft Internet Explorer to install itself automatically when a user is browsing a wide array of 3721 sponsored personal and commercial websites with Microsoft Internet Explorer. Yahoo! Assistant is also included in 3721 Chinese Keywords and Yahoo! Mail Express, but sometimes the whole package of Internet Assistant, Chinese Keywords and Mail Express is named "Yahoo! Assistant" in some sharewares.



Uninstall
3721 Internet Assistant, together with 3721 Chinese Keywords, according to Interfax, are regarded by Chinese internet users as "Hooligan" or "Zombie" applications. The uninstall program of the pair provided by 3721 simply redirects users to the 3721 website (in Simplified Chinese thus not recognizable except by Chinese speakers), and the default option of the web page is to keep 3721 Internet Assistant after the uninstallation. After following the web uninstallation wizard and a reboot, many 3721 files will still remain on the client system. The pair were ranked #1 by Beijing Association of Online Media in its list of Chinese Malware at 2005.

Because the pair used several kernel technologies to protect themselves, it is very difficult for many anti-spyware applications or IT professionals to remove them completely. For example, a driver named CnsMinKP.sys/vxd is installed with them and loaded even in Windows safe mode, and many kinds of attempts that try to remove 3721 files or registrys will be circumvented by this driver. For another, an incomplete uninstallation will trigger the "self-repair" feature that downloads missing files from internet. As a result, Microsoft AntiSpyware will enter an infinite loop when it is trying to remove the 3721 applications.
 
Last edited:
Well, I just started deleting registry keys like crazy and it seems to be working (so far).

I also unchecked some startup programs and, even though I cant delete the malware, it seems to have stopped hijacking my IE (keeping my fingers crossed).

Thanks for everyone's help, its appreciated
 
the only issue i have with msconfig in the regedit, is, and it's true (some guys told me to test it) the benchmark (test results) of it.
if you uncheck anything there in the start-up it actually slows your computer down.
your better off using a 3rd party program to control programs that start up and what not.
ie - microsoft's antispyware program, has that option.
or sysinternals autorun program, but it's tricky unless you know what you're doing there. (can help you with that).
part of your problem is bearshare (trouble inviting POS) ;)
 
Well I spoke too soon, I just checked my IE homepage and guess what pops up?? :rolleyes:

http://www.9991.com/

It's not the end of the world I can live with it I suppose, but I'd rather not have it on my PC.

Going by what joebear wrote this virus is nearly impossible to get rid of. Even the Unlocker couldnt erase most of the files, and when I erase the folder its just pops right back up again.

Oh well, I guess I'll have to learn to live with my new virus friend
 
Esco! said:
Well I spoke too soon, I just checked my IE homepage and guess what pops up?? :rolleyes:

http://www.9991.com/

It's not the end of the world I can live with it I suppose, but I'd rather not have it on my PC.
Click to expand...

you have to block outgoing connections because when you uninstall the program there is an active X program that reinstalls the deleted programs from the internet.

you need to get a firewall that blocks programs from accessing the internet like sysgate pro.

if you dont want to get a fireall then get peerguardian 2.0, google for that and it can block IP's and it is easy to add bad IP's. This will stop the program from reinstalling itself so long as you block the ip's it is trying to access the internet.

second, make a note of all the files that were installed, those dam CnsMinKP.sys/vxd or similar files and boot into dos using your windows XP install disc and manually delete the files since even in windows safe mode that dam spyware is impossible to delete.
 
joebear said:
you have to block outgoing connections because when you uninstall the program there is an active X program that reinstalls the deleted programs from the internet.

you need to get a firewall that blocks programs from accessing the internet like sysgate pro.
Click to expand...
I have the Win XP firewall, is that not good enough???
 
Esco! said:
I have the Win XP firewall, is that not good enough???
Click to expand...

XP firewall is shit, it does not block outgoing connections when programs phone home.

a firewall that blocks outgoing connections comes in handy when spyware tries to phone home or when you borrow a program from the net for evaluation purposes.

If the program phones home, the keygen or crack, I mean, evaluation key will become invalid when it connects to the internet.
 
Last edited:
joebear said:
XP firewall is shit, it does not block outgoing connections when programs phone home.

a firewall that blocks outgoing connections comes in handy when spyware tries to phone home or when you borrow a program from the net for evaluation purposes.

If the program phones home, the keygen or crack, I mean, evaluation key will become invalid when it connects to the internet.
Click to expand...
I downloaded that sygate firewall before you edited your post, Joe.
Installed it and its working now.
It does seem to be blocking more outgoing calls.

BTW Why did you edit your post????:confused:
 
I'm thinking it's a winsock error, but that would also mean, you couldn't get online.
Hmmm... www.eset.com (best anti-virus out there), could fix it, but it's $30 a year. That's 2 lap dances that you don't treat yourself to.
 
ya tried it, it's beyond the hijackthis level
it's at the kernel level, whatever it is, that's on his comp.
 
You must log in or register to reply here.

Similar threads

E
Hijackthis log
Replies
8
Views
601
The Lounge
Esco!
E
J
How to stack Orgasms
Replies
4
Views
590
The Lounge
elmufdvr
E
Toronto Escorts
Top Bottom
Back