Has anyone else ever had this Virus/Spyware? - GoFuckYourself.com

StickyGreen · 12-30-2005, 02:00 PM

This shit is fucked up. Everytime I click one of my thumbnails on my sites, or any other TGP out there for that matter, the links go to the virus' tgps and random search querys to google. like it will open a google window with the term "rabbit vibrator" and other random ass sex shit. none of my spyware or virus programs can get rid of this shit! anyone got rid of this before?

gfx3 · 12-30-2005, 02:28 PM

Just run adware/spyware remover tool, it's a trojan running on your system so the anti spyware tool should detect it. Perhaps it's CWS related, those are the hardest to get rid of.
Good luck with it, I hate that crap, takes hours and hours to get it from your pc.

nudecanada · 12-30-2005, 02:31 PM

StickyGreen, I never heard of that one but had a really nasty trojan a few weeks ago that nothing would remove.

I downloaded Panda Antivirus and it completely got rid of it, and I tried about half a dozen different programs. http://www.pandasoftware.com/

The free demo works great, I used Panda Platinum 2006 Internet Security.

StickyGreen · 12-30-2005, 02:36 PM

Quote:

Originally Posted by nudecanada

StickyGreen, I never heard of that one but had a really nasty trojan a few weeks ago that nothing would remove.

I downloaded Panda Antivirus and it completely got rid of it, and I tried about half a dozen different programs. http://www.pandasoftware.com/

The free demo works great, I used Panda Platinum 2006 Internet Security.

thanx man! i'm gonna give it a try right now...

StickyGreen · 01-02-2006, 07:10 PM

I still can't get rid of this shit, anyone know how?

SleazyDream · 01-02-2006, 07:11 PM

post the tgp names it goes to

StickyGreen · 01-02-2006, 07:18 PM

Quote:

Originally Posted by SleazyDream

post the tgp names it goes to

for some reason the tgps aren't coming up anymore...but all these are...

random sites:
http://slyfind.net/search.php?q=notebook
http://anewsearchengine.net/in.php
http://executivejobsearch.biz/go.php
http://casino-trix.com/search.php?qq=poker

and it also opens up random google links like these...

http://www.google.com/search?hl=en&q=adult%20sex
http://www.google.com/search?hl=en&q=sexy20granny
http://www.google.com/search?hl=en&q=sex%20toy
http://www.google.com/search?hl=en&q...acial%20dating

Doc911 · 01-02-2006, 07:52 PM

sound like cool web search to me.. who got that cool swiss army knife a few weeks ago for sending them installs?

Harmon · 01-02-2006, 07:59 PM

This is a new trojan and is now in the wild. If you find a fix, please post it here. Thanks.

Zverka · 01-02-2006, 08:38 PM

you can try McAfee virus scan online
hit this link McAfee scan online

SmokeyTheBear · 01-02-2006, 08:55 PM

got any of these

atl_helper.exe
uio.exe
Netsurf.exe
new32.exe
dePloy.exe
Brong32.exe

SmokeyTheBear · 01-02-2006, 08:58 PM

go to c:\windows and right click and sort by "last modified" look for new files .. also look in c:\ and c:\windowsroot\system32 searching the same way

StickyGreen · 01-02-2006, 11:53 PM

still there....

reed_4 · 01-03-2006, 01:50 AM

looks like format c:\ is badly needed dude.

Harmon · 01-03-2006, 02:02 AM

I'm getting the same thing now. It seems to be popping into where ever php is used or sponsor hosted galleries.

I'm getting this domain lodaing up:
www.handfind.net which loads http://www.yourlust.com (tgp)
http://www.google.com/search?hl=en&q=sexy%20mature
http://www.searchthissite.net/ which is loading up some Asian Mysteries TGP but all links go to bank foreclosures shit such as:
http://search.lycos.com/?src=kn&loc=...sures&nlubid=1
http://www.monstermarketplace.com/go...k+foreclosures
http://www.uploading.com/
http://search.ebay.com/bank-foreclos...QQfkrZ1QQfnuZ1
http://www.upspiral.com/index.php?tp...2bforeclosures

Also another tgp labeled http://www.dreamQueens.com

StickyGreen · 01-03-2006, 02:04 AM

Quote:

Originally Posted by Harmon

I'm getting the same thing now. It seems to be popping into where ever php is used or sponsor hosted galleries.

I'm getting this domain lodaing up:
www.handfind.net which loads http://www.yourlust.com (tgp)
http://www.google.com/search?hl=en&q=sexy%20mature
http://www.searchthissite.net/ which is loading up some Asian Mysteries TGP but all links go to bank foreclosures shit such as:
http://search.lycos.com/?src=kn&loc=...sures&nlubid=1
http://www.monstermarketplace.com/go...k+foreclosures
http://www.uploading.com/
http://search.ebay.com/bank-foreclos...QQfkrZ1QQfnuZ1
http://www.upspiral.com/index.php?tp...2bforeclosures

Also another tgp labeled http://www.dreamQueens.com

yep, sounds like the same shit. i've been trying for like 3 days to get rid of it...

SmokeyTheBear · 01-03-2006, 02:10 AM

Quote:

Originally Posted by Harmon

which is loading up some Asian Mysteries TGP but all links go to bank foreclosures shit such as:

lol i wonder what this is all about.. it look slike all those links run to paid sponsor ads on those sites ( the bak foreclosure ) so im thinking the "hacker" must be trying to run clicks thru competition ad links ( or he paid for those links , but sounds more like click fraud

)

SmokeyTheBear · 01-03-2006, 02:11 AM

Quote:

Originally Posted by StickyGreen

yep, sounds like the same shit. i've been trying for like 3 days to get rid of it...

did you try what i said

SmokeyTheBear · 01-03-2006, 02:13 AM

if your on the net while your trying to clean the comp you may have some problems

( especially if you have fast connection ) best to shutdown and do the steps above.

Damian_Maxcash · 01-03-2006, 02:18 AM

Try going to live.com and downloading the beta of Windows OneCare - it has the new virus scanner from microsoft and it seems to a good job.

I was running Nortons - I ran this and it picked up an extra 5 problems.

StickyGreen · 01-03-2006, 02:24 AM

Quote:

Originally Posted by SmokeyTheBear

did you try what i said

the only suspicious file was a file named WPA.DBL, which was the only file modified today in the system32 folder.

Damian_Maxcash · 01-03-2006, 02:26 AM

Quote:

Originally Posted by StickyGreen

the only suspicious file was a file named WPA.DBL, which was the only file modified today in the system32 folder.

Thats something to do with MS activation I think..........

IceMaster · 01-03-2006, 02:28 AM

Spyware Search & Destroy is my favourite, it will remove that spyware.

SmokeyTheBear · 01-03-2006, 02:32 AM

Quote:

Originally Posted by StickyGreen

the only suspicious file was a file named WPA.DBL, which was the only file modified today in the system32 folder.

that is the windows activation program its not harmfull.. did you also check c:\ and c:\windows ?

i think your nameservers have been messed with possibly..

SmokeyTheBear · 01-03-2006, 02:39 AM

check in your registry in local machine\system\currentcontrolset\services\tcpip\

also when your looking for files make sure you viewing ALL files ( like hidden and system files )

Nilsy42 · 01-03-2006, 02:40 AM

Quote:

Originally Posted by StickyGreen

I still can't get rid of this shit, anyone know how?

Sounds like some form of Spyware etc.
Try Spybot.
http://www.download.com/Spybot-Searc...-10122137.html

That gets stacks of stuff, and fixes up all sorts of crap on your machine. An amazing tool!
Normal virus progs are aiming at virus stuff, and take Trojans etc secondary it seems.
I had Panda too... hehe, until a virus fucked it!
The same happened to my Norton. Now I've been using AVG and haven't had a problem since on the virus side.
Of course with Spybot running secondary, and Ad-Aware at startup.

freepussy · 01-03-2006, 02:41 AM

that is funny

chaze · 01-03-2006, 02:42 AM

Viruses are clever now-a-days, if you can't clean out your registry and track recently modifies files in your windows config folders then you may need to format.

Good luck,

StickyGreen · 01-03-2006, 03:30 AM

Quote:

Originally Posted by freepussy

that is funny

what's funny is your gay ass nick. is it your pussy or your mom's pussy that's free you fag...

Nilsy42 · 01-03-2006, 03:50 AM

Quote:

Originally Posted by StickyGreen

the only suspicious file was a file named WPA.DBL, which was the only file modified today in the system32 folder.

Check this out:
http://netsecurity.about.com/od/wind...twinxp0829.htm

That guides you through the process.

reynold · 01-03-2006, 04:16 AM

have you tried the Microsoft Anti-Spyware beta?

Harmon · 01-03-2006, 06:15 AM

Quote:

Originally Posted by reynold

have you tried the Microsoft Anti-Spyware beta?

Yes... whatever this is, NOTHING is picking up. In fact, MS Spyware beta is running as I type this.

Nilsy42 · 01-03-2006, 06:21 AM

Quote:

Originally Posted by reynold

have you tried the Microsoft Anti-Spyware beta?

It's not a spy, it's the activation code in Microsoft.
Just follow the previous instrctions.

Harmon · 01-03-2006, 06:29 AM

Quote:

Originally Posted by Nilsy42

It's not a spy, it's the activation code in Microsoft.
Just follow the previous instrctions.

wtf are you talking about? This has nothing to do with the activation code dude. You're on crack. This IS some sort of spyware/malware. Don't rip on people trying to help like you know it all... you apparently know jack shit

StickyGreen · 01-03-2006, 02:41 PM

Quote:

Originally Posted by Harmon

wtf are you talking about? This has nothing to do with the activation code dude. You're on crack. This IS some sort of spyware/malware. Don't rip on people trying to help like you know it all... you apparently know jack shit

lol...i'm still having no luck. i downloaded the windows onecare beta and all it did was slow my system down dramatically and freeze every time it scanned for viruses...

BlazingBucks_Ryan · 01-03-2006, 03:13 PM

I had some NASTY viruses and trojans hit my comp about a week back or so - Downloaded a program called Spyware doctor - It did a tremendous job... You should check it out, I believe the first removal and scan are free .. I went ahead and paid the $30 for it

StickyGreen · 01-03-2006, 05:30 PM

Quote:

Originally Posted by BlazingBucks_Ryan

I had some NASTY viruses and trojans hit my comp about a week back or so - Downloaded a program called Spyware doctor - It did a tremendous job... You should check it out, I believe the first removal and scan are free .. I went ahead and paid the $30 for it

i tried that one too, didn't find it either. i think i've tried almost every program out there by now lol...

12-30-2005, 02:00 PM	#1
StickyGreen . Industry Role: Join Date: Oct 2003 Posts: 13,076	Has anyone else ever had this Virus/Spyware? This shit is fucked up. Everytime I click one of my thumbnails on my sites, or any other TGP out there for that matter, the links go to the virus' tgps and random search querys to google. like it will open a google window with the term "rabbit vibrator" and other random ass sex shit. none of my spyware or virus programs can get rid of this shit! anyone got rid of this before? __________________ Refer Cam Girls and Take Home 10% of Everything They Make For Life

12-30-2005, 02:28 PM	#2
gfx3 Confirmed User Join Date: Nov 2005 Posts: 1,685	Just run adware/spyware remover tool, it's a trojan running on your system so the anti spyware tool should detect it. Perhaps it's CWS related, those are the hardest to get rid of. Good luck with it, I hate that crap, takes hours and hours to get it from your pc. __________________

01-02-2006, 07:10 PM	#5
StickyGreen . Industry Role: Join Date: Oct 2003 Posts: 13,076	I still can't get rid of this shit, anyone know how? __________________ Refer Cam Girls and Take Home 10% of Everything They Make For Life

01-02-2006, 07:11 PM	#6
SleazyDream I'm here for SPORT Industry Role: Join Date: Jul 2001 Location: Phone # (401) 285-0696 Posts: 41,470	post the tgp names it goes to __________________ This dog, is dog, a dog, good dog, way dog, to dog, keep dog, an dog, idiot dog, busy dog, for dog, 20 dog, seconds dog! Now read without the word dog.

01-02-2006, 07:52 PM	#8
Doc911 Confirmed User Join Date: Feb 2004 Location: If i was up your ass you'd know Posts: 3,695	sound like cool web search to me.. who got that cool swiss army knife a few weeks ago for sending them installs? __________________ For PHP/MySQL scripts ICQ 161480555 or email [email protected]

12-30-2005, 02:31 PM	#3
nudecanada Confirmed User Join Date: Jan 2004 Location: Canada Posts: 793	StickyGreen, I never heard of that one but had a really nasty trojan a few weeks ago that nothing would remove. I downloaded Panda Antivirus and it completely got rid of it, and I tried about half a dozen different programs. http://www.pandasoftware.com/ The free demo works great, I used Panda Platinum 2006 Internet Security.

01-02-2006, 07:59 PM	#9
Harmon ( ͡ʘ╭͜ʖ╮͡ʘ) Industry Role: Join Date: Mar 2004 Posts: 20,010	This is a new trojan and is now in the wild. If you find a fix, please post it here. Thanks. __________________ [email protected]

01-02-2006, 08:38 PM	#10
Zverka Confirmed User Join Date: Jun 2005 Location: EU Posts: 281	you can try McAfee virus scan online hit this link McAfee scan online __________________

01-02-2006, 08:55 PM	#11
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	got any of these atl_helper.exe uio.exe Netsurf.exe new32.exe dePloy.exe Brong32.exe __________________ hatisblack at yahoo.com

01-02-2006, 08:58 PM	#12
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	go to c:\windows and right click and sort by "last modified" look for new files .. also look in c:\ and c:\windowsroot\system32 searching the same way __________________ hatisblack at yahoo.com

01-02-2006, 11:53 PM	#13
StickyGreen . Industry Role: Join Date: Oct 2003 Posts: 13,076	still there.... __________________ Refer Cam Girls and Take Home 10% of Everything They Make For Life

01-03-2006, 01:50 AM	#14
reed_4 Confirmed User Join Date: Jul 2005 Posts: 9,640	looks like format c:\ is badly needed dude. __________________

01-03-2006, 02:02 AM	#15
Harmon ( ͡ʘ╭͜ʖ╮͡ʘ) Industry Role: Join Date: Mar 2004 Posts: 20,010	I'm getting the same thing now. It seems to be popping into where ever php is used or sponsor hosted galleries. I'm getting this domain lodaing up: www.handfind.net which loads http://www.yourlust.com (tgp) http://www.google.com/search?hl=en&q=sexy%20mature http://www.searchthissite.net/ which is loading up some Asian Mysteries TGP but all links go to bank foreclosures shit such as: http://search.lycos.com/?src=kn&loc=...sures&nlubid=1 http://www.monstermarketplace.com/go...k+foreclosures http://www.uploading.com/ http://search.ebay.com/bank-foreclos...QQfkrZ1QQfnuZ1 http://www.upspiral.com/index.php?tp...2bforeclosures Also another tgp labeled http://www.dreamQueens.com __________________ [email protected]

01-03-2006, 02:13 AM	#19
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	if your on the net while your trying to clean the comp you may have some problems ( especially if you have fast connection ) best to shutdown and do the steps above. __________________ hatisblack at yahoo.com

01-03-2006, 02:18 AM	#20
Damian_Maxcash So Fucking Banned Join Date: Oct 2002 Location: MaxCash.com Posts: 12,745	Try going to live.com and downloading the beta of Windows OneCare - it has the new virus scanner from microsoft and it seems to a good job. I was running Nortons - I ran this and it picked up an extra 5 problems.

01-03-2006, 02:28 AM	#23
IceMaster Confirmed User Join Date: Jan 2005 Posts: 8,920	Spyware Search & Destroy is my favourite, it will remove that spyware.

01-03-2006, 02:39 AM	#25
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	check in your registry in local machine\system\currentcontrolset\services\tcpip\ also when your looking for files make sure you viewing ALL files ( like hidden and system files ) __________________ hatisblack at yahoo.com

01-03-2006, 02:41 AM	#27
freepussy Registered User Join Date: Oct 2005 Posts: 33	that is funny __________________ 100% free Gallery submitter try it today!

01-03-2006, 02:42 AM	#28
chaze Confirmed User Industry Role: Join Date: Aug 2002 Posts: 9,752	Viruses are clever now-a-days, if you can't clean out your registry and track recently modifies files in your windows config folders then you may need to format. Good luck,

01-03-2006, 04:16 AM	#31
reynold Too lazy to set a custom title Join Date: Oct 2002 Location: Global Traveler Posts: 51,271	have you tried the Microsoft Anti-Spyware beta?

01-03-2006, 03:13 PM	#36
BlazingBucks_Ryan Confirmed User Join Date: Dec 2005 Posts: 203	I had some NASTY viruses and trojans hit my comp about a week back or so - Downloaded a program called Spyware doctor - It did a tremendous job... You should check it out, I believe the first removal and scan are free .. I went ahead and paid the $30 for it __________________ BLAZING BUCKS - Leading The Fight Against Saturation! 1000's Of Pics For Your TGP Submissions, Pre-Built Free Sites, and Dynamically Changing Tours Assuring Your Traffic Is ALWAYS Converting The Best It Possibly Can! ICQ : 253483920 or [email protected]