[Yavo Lem]

I’ll try to keep this as short as possible. For about 1-2 months, my Windows 98 SE OS on both my Ibex computer and my Gateway computer, has, I believe, become infected by an unknown virus. I do not use Interet Explorer or Outlook Express on either computer, although of necessity I have ver. 5 on both, which I wish I could get rid of. For browsing I use Firefox ver. 1.5.0.7 and for mail I use Thunderbird ver. 1.5.0.7, so I am up-to-date in that respect.

With regard to the “virus’, nothing detects it and I used AVG, AdAware SE Personal, CW Shredder, A-squared, Avast, AntiVir PE Classic, SpyBot S&D, SpywareBlaster, FireLite Scanner, Norton System Works 2001, Bazooka, Ccleaner, EasyCleaner, G-Remover, HiJack This, PC Pitstop Extirminate, a number of registry cleaners and lastly, Trojan Hunter today, but Windows Explorer keeps reporting IPFs and occasionally immediately follows that with a message saying something to the effect that “a program has cause an internal error and will close. You may have to contact [some other organization].” But all that happens is that the Task Tray loses some icons and if I have anything open in the System Tray, and I usually have at least 4 applications and 4 internet sites open, under Firefox, the System Tray boxes are reordered right to left, which is really annoying because I need to know what is where, as I am working on a translation project and the boxes don’t carry much identifying information. Recently, I have had two occasions when Thunderbird was attacked and immediately closed, but not before sending error messages to home base. Maybe I will hear from them, but I am not too hopeful. So far, Firefox seems to be immune. Two other possible symptoms: Microsoft Works Spreadsheet loses its “Existing Documents” list every time I restart, and Norton System Works virus scanner can’t read the boot sectors for either drive, which it reports as 0, 1, C & D, but otherwise it runs a full scan, I think. BTW, I think this is a virus because shortly after I transferred some files, Tbird e-mail, an MS Works spreadsheet and a small application data file, on different days, by floppy from my Ibex computer to my Gateway, that one began exhibiting the same problem, but to a much lesser degree, perhaps because I do not use it for the same purposes as this one, or as much.

Below is a sample of what I get in the Window Explorer Error Message Box on the Ibex:

IPF in module <unknown> at 0000:024e32dc
IPF in module <unknown> at 0000:01e73232dc
IPF in module <unknown> at 0000:025632dc
IPF in module <unknown> at 0000:023e32dc (when I double-clicked on my ISP icon)
IPF in module <unknown> at 0000:01ce32dc (when I clicked on Start)
IPF in module <unknown> at 0000:03bf32dc(when I right clicked on a file with Explorer open and called A-squared to scan a file. I got the error message, Explorer closed, but A-squared wasn’t affected and finished its process.
IPF in module <unknown> at 0000:022032dc
IPF in module <unknown> at 0000:034732dc
IPF in module <unknown> at 0000:020832dc (when I double-clicked on an app., from the Desktop, then the message “Explorer caused a GPF in module User.exe at 0003:00008fb3
MSWksCal caused an IPF in module <unknown> at 0000:75d81f00
IPF in module <unknown> at 0000:020432dc
IPF in module <unknown> at 0000:01b532dc

All the errors were caused by Windows Explorer, not Internet Explorer, except as noted.
Two things are immediately obvious: all error modules begin with 0000 (with one exception), and with two exceptions, they all end with 32dc. However, having no technical knowledge whatever, and wanting none, I offer this information for the benefit of anyone who might be able to divine something from it. I haven’t kept a record of the stack dump (a very suggestive and perhaps appropriate term) part of the error messages, but if it is necessary, I can do so for any future problems.

So, over the past 6-8 weeks, I have downloaded and run all kinds of cleaning programs, I have reinstalled Windows, removed Windows, reformatted drives, written zeros to Drive C and D and done more clean installs than I care to recall. But still the same problem. I can’t download any “Critical Updates” because of Microsoft’s ill-advised decision to cease supporting what is probably their most popular OS on July 11, 2006. In addition, the version I am using came with the Gateway computer and Microsoft says I have to talk to Gateway for support. But Gateway didn’t write the software on Microsoft’s disk, nor did they give it the serial number. At any rate, both Microsoft and Gateway are out of the picture, and my only hope is that someone here can help. Actually, until this episode 6-8 weeks ago, everything was working fine and I was happy. Now I am mad as a hornet and am ready to take a hammer to both computers, but I am also intelligent enough to know that that is a very immature thing to do. I will not let this “virus” problem get the best of me.

If you need to contact me, feel free to send an e-mail.

Thanks in advance.

YL

[Advertisements]

Click start, programmes, accessories, system tools, system information, tools, system file check, replace any it asks for from the Windows CD

[Retired Tech]

Click start, programmes, accessories, system tools, system information, tools, system file check, replace any it asks for from the Windows CD

[Yavo Lem]

Keith,

Thanks for your quick response. Alas, I tried the very thing you suggested and reinstalled a whole lot of files, not from CABS, but from the original CD, twice last week, to no avail. Believe me, it was a very tiresome process, both times.

Being retired, I have devoted a lot of time searching the Web, looking for an answer to my computer's problem, but so far, it is continuing, and the fact that similar symptoms are now appearing on my other computer makes me very suspicious that it is something in the "virus" class, as the computers are not networked.

I'm open to other suggestions, though, so feel free to make them. I've got the time, some of the patience, but none of the skills.

YL

[Retired Tech]

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum

[Yavo Lem]

Keith,

I posted my HiJack This log on the Malware Forum. I have done all the things requested on the instructions you posted, with the exception of the Trend Online Scan, which wouldn't go past the point where they wanted me to download a free trial of another of their products. This is where I draw the line, especially with Trend, which stiffed me before with a product downloaded from their site, after paying for it, only to discover that it would not run under my OS. When asked for a reversal of the charge to my credit card, I got the royal runaround via the Philippines. They tried to push me off on Intermute, which they had acquired and from whom I had purchased the original software, but the new version had nothing to do with Intermute. It was Trend that charged my card, it is their name on my statement, and it was their responsibility to refund the good money I paid for a product that I couldn't use. I never did get my money back, and I will NEVER purchase anything from Trend again, but I did try to follow your advice.

At this point, I am beginning to lose faith in the ability of this site to provide a solution to my computer's problem, but I hope that is a false impression. This being my hope, I will continue to await further instructions that do not include sending me to sites that try to sell me something. I have too much in the way of ostensible, remedial software already, and being on a very limited budget (actually, I can't even afford a budget, as I exist from day to day), I can't and won't purchase any pie-in-the-sky "miracle" cleaners, etc.

Thank you for your help to this point. I await further developments.

YL

P.S. - As to the Trend problem, I believe I still have the e-mail messages that passed between us, if they are of any interest, but unfortunately, they are locked up in an inaccessible Thunderbird file, that I don't know how to open. Once I find out, you are welcome to them, and Trend.

[Retired Tech]

You can try this for trend

http://uk.trendmicro...housecall/v6.5/

It should only need to install an active x for the scan engine

[Yavo Lem]

Keith,

I followed the instructions for the UK link you provided above. Trend proceeded to update my Java installation, which I had just reinstalled. The reason I reinstalle it is because to go the Active X route, I would have to download and reinstall IE 6, which I did a few weeks ago, in the hope it would cure the problem. It did't, so I uninstalled it. If I could get rid of both IE 5 AND Windows Explorer, I wouldn't hesistate, as I have found other substitutes for Windows Explorer, such as Free Commander 2006, which works, but unfortunately is susceptible to the same problem as Windows Explorer, at least at this point.

At any rate, just so you don't think I am paranoid and am making this up, I enclose below the screen at which Trend stopped performing and went Idle. I clicked the right-hand 'next' button, but all that happened was that these 'offers' and a 'survey' kept cycling. This is what one Trend screen said:

======================================================================

Just Relax?

Yes, just lean back and let HouseCall check, if viruses and worms infected your computer.
HouseCall will find and remove all known varmints. Consequential and unsparing!

And then? Will you restart HouseCall tomorrow and the day after tomorrow, next week, in a month? Wouldn't it be great to work, surf through the web and to play internet games without worrying about the security of your computer? Trend Micro has an offer for you: And you can just relax
Just Malicious?

The internet can be fraught with malice. Viruses and worms infect your computer, trojans invade through the back-door and steal any capacity from your computer by mostly illegal operations. Spam mails bother you with more than a rather unmoral business. Spyware spies your personal and confidential data - from private emails to bank transactions. Phishing attacks worm any information out of you to harm you!

Hands off the internet? No way!
We offer reliable solutions against all these kind of attacks for your PC or laptop, for your network and wireless network/LAN! Simple and safe!
Your Computer Is Not a Peep Show!

More than 15 million potential virtual eyes at all PCs, servers and laptops in the internet: Your private life for the world to see! 15 million possible spys are a pretty good reason to protect oneself NOW.

PC-cillin - Internet Security seals your PC, your laptop, your network hermetically. Your can feel safe from Viruses, Worms and Trojans. PC-cillin rings alarm when an unknown "guest" gains access to the network, blocks thieves of bandwidths and unwanted invaders.

PC-cillin - Internet Security is available both as single license version and as network solution for 3 or 5 licenses- beginning from only 59 EUR - Available easily right now!

Download. Install. Feel safe!

======================================================================

FYI, I have a copy of PC-cillin, which came with the software for my Ibex system. I installed it and tried it, but it only garbaged up my system, so I uninstalled it. I don't remember now if that was one of the reasons I had to reformat my C drive and reinstall Windows, but I will NEVER use anything from Trend again.

So, should I give up? Or should I plod onward with something else?

YL