NON BS THREAD>>>> sp2chk.exe....new adaware virus?? - GoFuckYourself.com

Juicy D. Links · 02-22-2005, 01:21 AM

Windows>System32 folder setting off as a trojan....

Anybody have 411 on this shit?

Juicy D. Links · 02-22-2005, 01:23 AM

hiiiiiiiiiiiiiiiiiiiiiiiii

sonofsam · 02-22-2005, 01:23 AM

some of these wiggers on gfy can't understand normal english... let me translate for you

juicy : whats the dizzle with this adwizzle, my nortonizzle detectizzled some shizzle....

Triple 6 · 02-22-2005, 01:23 AM

your fucked!

sonofsam · 02-22-2005, 01:23 AM

*waits for sickbeatz*

lol jk

pornguy · 02-22-2005, 01:24 AM

How did you find it. norton? ot spybot or what?

Triple 6 · 02-22-2005, 01:25 AM

im just counting down before Persius spams this thread with his metrowned pic

its going on at least 100 threads strong tonite!

Juicy D. Links · 02-22-2005, 01:26 AM

http://computercops.biz/startuplist-6983.html read it yo

pornguy · 02-22-2005, 01:30 AM

Juicy. Try this anti virus

housecall.trendmicro.com

It is a web based virus scan, and it is kick ass.

Top Jimmy · 02-22-2005, 01:31 AM

Quote:

Originally Posted by sonofsam

some of these wiggers on gfy can't understand normal english... let me translate for you

juicy : whats the dizzle with this adwizzle, my nortonizzle detectizzled some shizzle....

LOL Classic.

facialfreak · 02-22-2005, 01:34 AM

THis is a program installed by a variant of CoolWebSearch Juicy.

It is an Internet Explorer BHO that acts as a backdoor. Stored in the System32 folder under the name ?msXXX.dll? where XXX is three random lower-case letters; uses a random class ID. When a new IE window is open, it contacts its controlling server which directs it to install further software including sp2chk.exe (a rootkit-like hook that makes other CWS files invisible to the Windows file Explorer), tlntadmnx.exe (which puts the site 63.219.181.7 in the IE Trusted Sites Zone, then calls it to install the OnlineDialer/Ole parasite, which loads Richfind/Q) and tcpsvcss.exe (which hijacks the DNS server settings of all internet connections to 69.50.188.180 and 195.225.176.31, allowing these servers to redirect access to any site to an attacker). It can also load the CoolWebSearch/WinProtect, Freshbar and WareOut parasites.

THIS IS A STARTUP PROGRAM AND NOT A TASK MANAGER PROCESS ITEM !!
Field Value
Name sp2chk.exe
Command sp2chk.exe
Description Added by the Aluroot.A TROJAN!

Juicy D. Links · 02-22-2005, 01:39 AM

Quote:

Originally Posted by pornguy

Juicy. Try this anti virus

housecall.trendmicro.com

It is a web based virus scan, and it is kick ass.

cool Norton detects it....but i cant get rid of it

facialfreak · 02-22-2005, 01:42 AM

Here is the latest version of CWShredder ... should get rid of it for ya!

http://dev2.gamarays.com/CWShredder.zip

MAKE SURE YOU DISABLE SYSTEM RESTORE BEFOR YOU RUN THIS!!

My Computer ... RIGHT CLICK your C drive and select MANAGE >> Services >>System Restore [DISABLE]

Run CWShredder ... UNPLUG your power cord for 1-2 mins to kill the memory, then reboot ... run PANDA Active Scan ONLINE www.pandasoftware.com ... if it comes up clean, restart System Restore, and MAKE A NEW RESTORE POINT RIGHT AWAY ...

pornguy · 02-22-2005, 01:45 AM

I gave up norton when HP told me to run my norton, and then run that one. Norton told me the pc was clean. that one found 5 trojans. And it removed them. I got rid of norton, and started using them. They have a great anti and fire wall built into one. Give them a try.

Dagwolf · 02-22-2005, 01:46 AM

I hate CoolWebSearch. If I got my hands on the people responsible for that piece of crap I'd probably start removing some limbs. Starting with the head.

facialfreak · 02-22-2005, 01:49 AM

Norton used to be the shit maybe 3 years ago but Symantec turned it into a cash cow, and banked on the name Norton's had built ....

Panda PLATINUM is the best protection you can have these days, as it removes viruses, spyware, malware, AND Trojans .... but is not free.

AVG ( www.grisoft.com ) 7.0.300 Free Edition is 5 times the software that Nortons is, and is free updates for life .... use AVG on your machine, and run Panda ActiveScan ONLINE every week or two at the longest!

pornguy · 02-22-2005, 01:52 AM

Howcome no legal issues ahve been raised against them. Too busy chasing porn people to stop the real problems?

Juicy D. Links · 02-22-2005, 01:55 AM

Quote:

Originally Posted by facialfreak

Norton used to be the shit maybe 3 years ago but Symantec turned it into a cash cow, and banked on the name Norton's had built ....

Panda PLATINUM is the best protection you can have these days, as it removes viruses, spyware, malware, AND Trojans .... but is not free.

AVG ( www.grisoft.com ) 7.0.300 Free Edition is 5 times the software that Nortons is, and is free updates for life .... use AVG on your machine, and run Panda ActiveScan ONLINE every week or two at the longest!

I agree Norton is crap.

facialfreak · 02-22-2005, 01:57 AM

You can also download a 30 day FULL PRO version of SpySubtract Pro here

http://download.intermute.com/downlo...pysubtract.exe

SpySubtract Pro was written by MERJIN (of merjin.org) .... a well known authority on spyware removal.

It will find TONS of things that neither AdAware SE or Spybot S&D will ....
And partway through your trial (3-4 days maybe) it will give you the option to buy it for $14.95 (instead of 29.95) .... Very good value for a piece of mind!

Juicy D. Links · 02-22-2005, 01:57 AM

Quote:

Originally Posted by pornguy

Howcome no legal issues ahve been raised against them. Too busy chasing porn people to stop the real problems?

politics..........

Juicy D. Links · 02-22-2005, 01:59 AM

Quote:

Originally Posted by facialfreak

You can also download a 30 day FULL PRO version of SpySubtract Pro here

http://download.intermute.com/downlo...pysubtract.exe

SpySubtract Pro was written by MERJIN (of merjin.org) .... a well known authority on spyware removal.

It will find TONS of things that neither AdAware SE or Spybot S&D will ....
And partway through your trial (3-4 days maybe) it will give you the option to buy it for $14.95 (instead of 29.95) .... Very good value for a piece of mind!

I have that , very Juicy

Triple 6 · 02-22-2005, 02:00 AM

i couldnt find the free version of AVG last time i went to their site - unless im blind, they dont have a free version anmore... its $30 now

Triple 6 · 02-22-2005, 02:01 AM

yea, im blind..... fucking link on the left that says 'AVG free edition'

sigh

facialfreak · 02-22-2005, 02:04 AM

hehehehe

hydro · 02-22-2005, 02:51 AM

Norton sucks, check out kaspersky. All us hackers use it cause its updated daily and can unpack just about anything.

02-22-2005, 01:21 AM	#1
Juicy D. Links So Fucking Banned Industry Role: Join Date: Apr 2001 Location: N.Y. -Long Island -- Posts: 122,992	NON BS THREAD>>>> sp2chk.exe....new adaware virus?? Windows>System32 folder setting off as a trojan.... Anybody have 411 on this shit?

02-22-2005, 01:23 AM	#3
sonofsam Too lazy to set a custom title Join Date: Dec 2004 Location: Vancouver Posts: 18,638	some of these wiggers on gfy can't understand normal english... let me translate for you juicy : whats the dizzle with this adwizzle, my nortonizzle detectizzled some shizzle.... __________________ I like turtles.

02-22-2005, 01:23 AM	#4
Triple 6 Confirmed User Join Date: Feb 2002 Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: isN'T everything Posts: 5,394	your fucked! __________________ SIG TOO SMALL! Maximum 1200x600 button and no more than 30 text lines of ALL SIZES and COLORS. Unless your sig is for a GFY top banner sponsor, then you may use a 6240x4800 instead of a 1024x800.

02-22-2005, 01:23 AM	#5
sonofsam Too lazy to set a custom title Join Date: Dec 2004 Location: Vancouver Posts: 18,638	waits for sickbeatz lol jk __________________ I like turtles.

02-22-2005, 01:24 AM	#6
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	How did you find it. norton? ot spybot or what? __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

02-22-2005, 01:25 AM	#7
Triple 6 Confirmed User Join Date: Feb 2002 Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: isN'T everything Posts: 5,394	im just counting down before Persius spams this thread with his metrowned pic its going on at least 100 threads strong tonite! __________________ SIG TOO SMALL! Maximum 1200x600 button and no more than 30 text lines of ALL SIZES and COLORS. Unless your sig is for a GFY top banner sponsor, then you may use a 6240x4800 instead of a 1024x800.

02-22-2005, 01:26 AM	#8
Juicy D. Links So Fucking Banned Industry Role: Join Date: Apr 2001 Location: N.Y. -Long Island -- Posts: 122,992	http://computercops.biz/startuplist-6983.html read it yo

02-22-2005, 01:30 AM	#9
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	Juicy. Try this anti virus housecall.trendmicro.com It is a web based virus scan, and it is kick ass. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

02-22-2005, 01:34 AM	#11
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	THis is a program installed by a variant of CoolWebSearch Juicy. It is an Internet Explorer BHO that acts as a backdoor. Stored in the System32 folder under the name ?msXXX.dll? where XXX is three random lower-case letters; uses a random class ID. When a new IE window is open, it contacts its controlling server which directs it to install further software including sp2chk.exe (a rootkit-like hook that makes other CWS files invisible to the Windows file Explorer), tlntadmnx.exe (which puts the site 63.219.181.7 in the IE Trusted Sites Zone, then calls it to install the OnlineDialer/Ole parasite, which loads Richfind/Q) and tcpsvcss.exe (which hijacks the DNS server settings of all internet connections to 69.50.188.180 and 195.225.176.31, allowing these servers to redirect access to any site to an attacker). It can also load the CoolWebSearch/WinProtect, Freshbar and WareOut parasites. THIS IS A STARTUP PROGRAM AND NOT A TASK MANAGER PROCESS ITEM !! Field Value Name sp2chk.exe Command sp2chk.exe Description Added by the Aluroot.A TROJAN! __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

02-22-2005, 01:42 AM	#13
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	Here is the latest version of CWShredder ... should get rid of it for ya! http://dev2.gamarays.com/CWShredder.zip MAKE SURE YOU DISABLE SYSTEM RESTORE BEFOR YOU RUN THIS!! My Computer ... RIGHT CLICK your C drive and select MANAGE >> Services >>System Restore [DISABLE] Run CWShredder ... UNPLUG your power cord for 1-2 mins to kill the memory, then reboot ... run PANDA Active Scan ONLINE www.pandasoftware.com ... if it comes up clean, restart System Restore, and MAKE A NEW RESTORE POINT RIGHT AWAY ... __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

02-22-2005, 01:45 AM	#14
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	I gave up norton when HP told me to run my norton, and then run that one. Norton told me the pc was clean. that one found 5 trojans. And it removed them. I got rid of norton, and started using them. They have a great anti and fire wall built into one. Give them a try. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

02-22-2005, 01:46 AM	#15
Dagwolf President of Canada Join Date: Sep 2003 Location: Leaving Hell, Entering Limbo Posts: 23,141	I hate CoolWebSearch. If I got my hands on the people responsible for that piece of crap I'd probably start removing some limbs. Starting with the head. __________________ Sleep well, and dream of large women.

02-22-2005, 01:49 AM	#16
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	Norton used to be the shit maybe 3 years ago but Symantec turned it into a cash cow, and banked on the name Norton's had built .... Panda PLATINUM is the best protection you can have these days, as it removes viruses, spyware, malware, AND Trojans .... but is not free. AVG ( www.grisoft.com ) 7.0.300 Free Edition is 5 times the software that Nortons is, and is free updates for life .... use AVG on your machine, and run Panda ActiveScan ONLINE every week or two at the longest! __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

02-22-2005, 01:52 AM	#17
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	Howcome no legal issues ahve been raised against them. Too busy chasing porn people to stop the real problems? __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

02-22-2005, 01:57 AM	#19
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	You can also download a 30 day FULL PRO version of SpySubtract Pro here http://download.intermute.com/downlo...pysubtract.exe SpySubtract Pro was written by MERJIN (of merjin.org) .... a well known authority on spyware removal. It will find TONS of things that neither AdAware SE or Spybot S&D will .... And partway through your trial (3-4 days maybe) it will give you the option to buy it for $14.95 (instead of 29.95) .... Very good value for a piece of mind! __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

02-22-2005, 02:00 AM	#22
Triple 6 Confirmed User Join Date: Feb 2002 Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: isN'T everything Posts: 5,394	i couldnt find the free version of AVG last time i went to their site - unless im blind, they dont have a free version anmore... its $30 now __________________ SIG TOO SMALL! Maximum 1200x600 button and no more than 30 text lines of ALL SIZES and COLORS. Unless your sig is for a GFY top banner sponsor, then you may use a 6240x4800 instead of a 1024x800.

02-22-2005, 02:01 AM	#23
Triple 6 Confirmed User Join Date: Feb 2002 Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: isN'T everything Posts: 5,394	yea, im blind..... fucking link on the left that says 'AVG free edition' sigh __________________ SIG TOO SMALL! Maximum 1200x600 button and no more than 30 text lines of ALL SIZES and COLORS. Unless your sig is for a GFY top banner sponsor, then you may use a 6240x4800 instead of a 1024x800.

02-22-2005, 02:04 AM	#24
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	hehehehe __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

02-22-2005, 02:51 AM	#25
hydro Confirmed User Join Date: Dec 2003 Location: Dirty 3rd Posts: 4,216	Norton sucks, check out kaspersky. All us hackers use it cause its updated daily and can unpack just about anything.