TechTalkz.com Logo

Go Back   TechTalkz.com Technology & Computer Troubleshooting Forums > Tech Support Archives > Security > Virus

Reply
 
Thread Tools Display Modes
Old 07-11-2007, 10:54 PM   #1
Fruit2O
Guest
 
Posts: n/a
Need help removing malware

I use BitDefender (it will not run in Safe Mode). During my last scan,
it found the following which it cannot delete or quarantine because
they are embedded:

1. Adware.Dogpile.l

C:\WINDOWS\Downloaded Program
Files\CONFLICT.1\Toolbar_cobrand.EXE=]wise0080

I cannot find CONFLICT.1

2. Adware.Dogpile.l

C:\WINDOWS\Downloaded Program
Files\CONFLICT.1\Toolbar_cobrand.EXE=](Embedded EXE r)=]wise0080

3. Backdoor.Dssdoor.C

D:\System Volume
Information\_restore(AB4B39B1-ECCC-40C6-B62403F7E55B5A)\RP850\Ao467860.exe=]RAR
Sfx o)=]RunSequence.exe

4. Backdoor.Dssdoor.C

D:\System Volume
Information\_restore(AB4B39B1-ECCC-40C6-B62403F7E55B5A)\RP850\Ao467860.exe=]RAR
Sfx o)=]_aps activator.exe

Can someone tell me how to get rid of them? Thanks............
  Reply With Quote
Old 07-11-2007, 10:54 PM   #2
VanguardLH
Guest
 
Posts: n/a
Re: Need help removing malware

"Fruit2O" wrote in message
newsuaii312brk4v7inct6c3snhnnfk9sif0a@4ax.com...
<snip - duplicate post multiposted instead of crossposted>

See replies to your same post in the other group to which you
multiposted.

Learn to cross-post.

http://en.wikipedia.org/wiki/Crossposting
http://www.cs.tut.fi/~jkorpela/usenet/xpost.html

A point not made is that N multiposted copies will consume N times the
disk space for each of the separate copies of the same post.
Crossposted messages have just *one* copy on the server with links in
the newsgroups back to the same single copy. Multiposting wastes disk
space on the server. Yes, your post may be small but remember that
you consume N times the space on one server and then do so again on
all the newsgroups servers worldwide. You waste more bandwidth
getting N copies of your multiposted message distributed to all the
newsgroups servers worldwide. Cross-posting has just one copy of the
message on an NNTP server, and only one copy gets propagated to other
NNTP servers.

To those visiting the newsgroups, crossposting helps them see ALL the
replies from those in the other RELATED newsgroup to which you linked
your post. That way, they don't waste their time duplicating similar
replies.

  Reply With Quote
Old 07-11-2007, 10:54 PM   #3
Kayman
Guest
 
Posts: n/a
Re: Need help removing malware

On Wed, 31 Oct 2007 21:29:19 -0400, Fruit2O wrote:

> I use BitDefender (it will not run in Safe Mode). During my last scan,
> it found the following which it cannot delete or quarantine because
> they are embedded:
>
> 1. Adware.Dogpile.l
>
> C:\WINDOWS\Downloaded Program
> Files\CONFLICT.1\Toolbar_cobrand.EXE=]wise0080
>
> I cannot find CONFLICT.1
>
> 2. Adware.Dogpile.l
>
> C:\WINDOWS\Downloaded Program
> Files\CONFLICT.1\Toolbar_cobrand.EXE=](Embedded EXE r)=]wise0080
>
> 3. Backdoor.Dssdoor.C
>
> D:\System Volume
> Information\_restore(AB4B39B1-ECCC-40C6-B62403F7E55B5A)\RP850\Ao467860.exe=]RAR
> Sfx o)=]RunSequence.exe
>
> 4. Backdoor.Dssdoor.C
>
> D:\System Volume
> Information\_restore(AB4B39B1-ECCC-40C6-B62403F7E55B5A)\RP850\Ao467860.exe=]RAR
> Sfx o)=]_aps activator.exe
>
> Can someone tell me how to get rid of them? Thanks............


Download David H. Lipman's MULTI_AV.EXE from the URL:
http://www.pctipp.ch/downloads/siche...ning_tool.html
Further information can be found here:
http://www.elephantboycomputers.com/page2.html#Multi-AV
Additional Instructions:
http://pcdid.com/Multi_AV.htm

SuperAntispyware - Free
http://www.superantispyware.com/supe...freevspro.html

Ad-Aware - Free
http://www.lavasoftusa.com/products/ad_aware_free.php
http://www.download.com/3000-2144-10045910.html
  Reply With Quote
Old 07-11-2007, 10:54 PM   #4
Fruit2O
Guest
 
Posts: n/a
Re: Need help removing malware

On Thu, 1 Nov 2007 02:30:32 -0500, "VanguardLH"
<VanguardLH@mail.invalid> wrote:

>"Fruit2O" wrote in message
>newsuaii312brk4v7inct6c3snhnnfk9sif0a@4ax.com.. .
><snip - duplicate post multiposted instead of crossposted>
>
>See replies to your same post in the other group to which you
>multiposted.
>
>Learn to cross-post.
>
>http://en.wikipedia.org/wiki/Crossposting
>http://www.cs.tut.fi/~jkorpela/usenet/xpost.html
>
>A point not made is that N multiposted copies will consume N times the
>disk space for each of the separate copies of the same post.
>Crossposted messages have just *one* copy on the server with links in
>the newsgroups back to the same single copy. Multiposting wastes disk
>space on the server. Yes, your post may be small but remember that
>you consume N times the space on one server and then do so again on
>all the newsgroups servers worldwide. You waste more bandwidth
>getting N copies of your multiposted message distributed to all the
>newsgroups servers worldwide. Cross-posting has just one copy of the
>message on an NNTP server, and only one copy gets propagated to other
>NNTP servers.
>
>To those visiting the newsgroups, crossposting helps them see ALL the
>replies from those in the other RELATED newsgroup to which you linked
>your post. That way, they don't waste their time duplicating similar
>replies.


Sorry, but I tried crossposting and it didn't work. I've had trouble
crossposting for years and haven't been able to figure it out yet -
even with a lot of help on the Forte newsgroup and Forte tech support.
I tried it again last night but it wouldn't post at all.
  Reply With Quote
Old 07-11-2007, 10:54 PM   #5
Fruit2O
Guest
 
Posts: n/a
Re: Need help removing malware

On Thu, 1 Nov 2007 15:33:19 +0700, Kayman <kaymanNoSpam@operamail.com>
wrote:

>On Wed, 31 Oct 2007 21:29:19 -0400, Fruit2O wrote:
>
>> I use BitDefender (it will not run in Safe Mode). During my last scan,
>> it found the following which it cannot delete or quarantine because
>> they are embedded:
>>
>> 1. Adware.Dogpile.l
>>
>> C:\WINDOWS\Downloaded Program
>> Files\CONFLICT.1\Toolbar_cobrand.EXE=]wise0080
>>
>> I cannot find CONFLICT.1
>>
>> 2. Adware.Dogpile.l
>>
>> C:\WINDOWS\Downloaded Program
>> Files\CONFLICT.1\Toolbar_cobrand.EXE=](Embedded EXE r)=]wise0080
>>
>> 3. Backdoor.Dssdoor.C
>>
>> D:\System Volume
>> Information\_restore(AB4B39B1-ECCC-40C6-B62403F7E55B5A)\RP850\Ao467860.exe=]RAR
>> Sfx o)=]RunSequence.exe
>>
>> 4. Backdoor.Dssdoor.C
>>
>> D:\System Volume
>> Information\_restore(AB4B39B1-ECCC-40C6-B62403F7E55B5A)\RP850\Ao467860.exe=]RAR
>> Sfx o)=]_aps activator.exe
>>
>> Can someone tell me how to get rid of them? Thanks............

>
>Download David H. Lipman's MULTI_AV.EXE from the URL:
>http://www.pctipp.ch/downloads/siche...l.htmlAd-Aware 2008, Spy Doctor and
>Further information can be found here:
>http://www.elephantboycomputers.com/page2.html#Multi-AV
>Additional Instructions:
>http://pcdid.com/Multi_AV.htm
>
>SuperAntispyware - Free
>http://www.superantispyware.com/supe...freevspro.html
>
>Ad-Aware - Free
>http://www.lavasoftusa.com/products/ad_aware_free.php
>http://www.download.com/3000-2144-10045910.html


I use Ad-Aware, Spyware Doctor, SpyBot and none of them even found
these malware.
  Reply With Quote
Old 07-11-2007, 10:54 PM   #6
VanguardLH
Guest
 
Posts: n/a
Re: Need help removing malware

"Fruit2O" <jz137xww@cox.net> wrote in message
news:kelji3tnv1ggjnqkp050gobji9ni8mc5a7@4ax.com...
> On Thu, 1 Nov 2007 02:30:32 -0500, "VanguardLH"
> <VanguardLH@mail.invalid> wrote:
>
>>"Fruit2O" wrote in message
>>newsuaii312brk4v7inct6c3snhnnfk9sif0a@4ax.com. ..
>><snip - duplicate post multiposted instead of crossposted>
>>
>>See replies to your same post in the other group to which you
>>multiposted.
>>
>>Learn to cross-post.
>>
>>http://en.wikipedia.org/wiki/Crossposting
>>http://www.cs.tut.fi/~jkorpela/usenet/xpost.html
>>
>>A point not made is that N multiposted copies will consume N times
>>the
>>disk space for each of the separate copies of the same post.
>>Crossposted messages have just *one* copy on the server with links
>>in
>>the newsgroups back to the same single copy. Multiposting wastes
>>disk
>>space on the server. Yes, your post may be small but remember that
>>you consume N times the space on one server and then do so again on
>>all the newsgroups servers worldwide. You waste more bandwidth
>>getting N copies of your multiposted message distributed to all the
>>newsgroups servers worldwide. Cross-posting has just one copy of
>>the
>>message on an NNTP server, and only one copy gets propagated to
>>other
>>NNTP servers.
>>
>>To those visiting the newsgroups, crossposting helps them see ALL
>>the
>>replies from those in the other RELATED newsgroup to which you
>>linked
>>your post. That way, they don't waste their time duplicating
>>similar
>>replies.

>
> Sorry, but I tried crossposting and it didn't work. I've had
> trouble
> crossposting for years and haven't been able to figure it out yet -
> even with a lot of help on the Forte newsgroup and Forte tech
> support.
> I tried it again last night but it wouldn't post at all.



It's been since February when I last trialed Forte Agent (the real
version which was a trial version, not the crippled version). You
should be able to simply add more newsgroups to the Newsgroups field
to do the cross-posting. Many NNTP clients will not cross-post if the
newsgroups are available only across different NNTP servers; that is,
they cannot cross-post if one NNTP doesn't have all the newsgroups. I
don't know if that is a limitation of Agent but you can check with its
users. There looks to be some newsgroups for that newsreader.

Typically what happens is you get a warning that not all newsgroups
were available on the NNTP server that you used but that doesn't stop
you from posting to the remaining newsgroups (i.e., skip past the
warning). Cross-posting only works within one NNTP server because
they are the one providing the links to the one copy of the article
that *they* have. Other NNTP servers have their own separate
cross-posting support for articles on their own host. You cannot
cross-post across NNTP servers. That is, the links to the same
article are for that article on the same NNTP server, not for links
across multiple NNTP servers. It looks like you are using Cox's NNTP
service to post. I don't know if you were trying to cross-post across
multiple NNTP hosts. You didn't describe what is your problem
(whether with the program or your understanding). Maybe you're just
using the wrong separator character in the Newsgroups field. Maybe
your instance of Agent is screwed up.

Agent used to suck for supporting multiple NNTP servers in that you
had to specify on the command-line which one to connect and open
another instance of Agent for each NNTP server. I think the freebie
or crippled free version still does that but their commercialware
version supports multiple NNTP servers now.

  Reply With Quote
Old 07-11-2007, 10:55 PM   #7
Fruit2O
Guest
 
Posts: n/a
Re: Need help removing malware

On Thu, 1 Nov 2007 12:15:54 -0500, "VanguardLH"
<VanguardLH@mail.invalid> wrote:

>"Fruit2O" <jz137xww@cox.net> wrote in message
>news:kelji3tnv1ggjnqkp050gobji9ni8mc5a7@4ax.com.. .
>> On Thu, 1 Nov 2007 02:30:32 -0500, "VanguardLH"
>> <VanguardLH@mail.invalid> wrote:
>>
>>>"Fruit2O" wrote in message
>>>newsuaii312brk4v7inct6c3snhnnfk9sif0a@4ax.com ...
>>><snip - duplicate post multiposted instead of crossposted>
>>>
>>>See replies to your same post in the other group to which you
>>>multiposted.
>>>
>>>Learn to cross-post.
>>>
>>>http://en.wikipedia.org/wiki/Crossposting
>>>http://www.cs.tut.fi/~jkorpela/usenet/xpost.html
>>>
>>>A point not made is that N multiposted copies will consume N times
>>>the
>>>disk space for each of the separate copies of the same post.
>>>Crossposted messages have just *one* copy on the server with links
>>>in
>>>the newsgroups back to the same single copy. Multiposting wastes
>>>disk
>>>space on the server. Yes, your post may be small but remember that
>>>you consume N times the space on one server and then do so again on
>>>all the newsgroups servers worldwide. You waste more bandwidth
>>>getting N copies of your multiposted message distributed to all the
>>>newsgroups servers worldwide. Cross-posting has just one copy of
>>>the
>>>message on an NNTP server, and only one copy gets propagated to
>>>other
>>>NNTP servers.
>>>
>>>To those visiting the newsgroups, crossposting helps them see ALL
>>>the
>>>replies from those in the other RELATED newsgroup to which you
>>>linked
>>>your post. That way, they don't waste their time duplicating
>>>similar
>>>replies.

>>
>> Sorry, but I tried crossposting and it didn't work. I've had
>> trouble
>> crossposting for years and haven't been able to figure it out yet -
>> even with a lot of help on the Forte newsgroup and Forte tech
>> support.
>> I tried it again last night but it wouldn't post at all.

>
>
>It's been since February when I last trialed Forte Agent (the real
>version which was a trial version, not the crippled version). You
>should be able to simply add more newsgroups to the Newsgroups field
>to do the cross-posting. Many NNTP clients will not cross-post if the
>newsgroups are available only across different NNTP servers; that is,
>they cannot cross-post if one NNTP doesn't have all the newsgroups. I
>don't know if that is a limitation of Agent but you can check with its
>users. There looks to be some newsgroups for that newsreader.
>
>Typically what happens is you get a warning that not all newsgroups
>were available on the NNTP server that you used but that doesn't stop
>you from posting to the remaining newsgroups (i.e., skip past the
>warning). Cross-posting only works within one NNTP server because
>they are the one providing the links to the one copy of the article
>that *they* have. Other NNTP servers have their own separate
>cross-posting support for articles on their own host. You cannot
>cross-post across NNTP servers. That is, the links to the same
>article are for that article on the same NNTP server, not for links
>across multiple NNTP servers. It looks like you are using Cox's NNTP
>service to post. I don't know if you were trying to cross-post across
>multiple NNTP hosts. You didn't describe what is your problem
>(whether with the program or your understanding). Maybe you're just
>using the wrong separator character in the Newsgroups field. Maybe
>your instance of Agent is screwed up.
>
>Agent used to suck for supporting multiple NNTP servers in that you
>had to specify on the command-line which one to connect and open
>another instance of Agent for each NNTP server. I think the freebie
>or crippled free version still does that but their commercialware
>version supports multiple NNTP servers now.


I use the latest PAID version of Forte. As for delimiters, I have
tried commas and semi-colons. I only use one NNTP server (COX's).
However, I've always had trouble cross-posting. I called COX and they
say it must be Forte. I contacted Forte and they say it must be COX.
Perhaps if you tell me EXACTLY how to post to more than one newsgroup,
I'll try it and see if it works. I'll try anything. Who knows? I
might be doing some little thing wrong which screws up my post.
Yesterday, when I tried cross-posting, my post went to NEITHER of the
groups and I got an error message to the effect. But the message said
nothing about my syntax, Thanks.........
  Reply With Quote
Old 07-11-2007, 10:55 PM   #8
VanguardLH
Guest
 
Posts: n/a
Re: Need help removing malware

"Fruit2O" <jz137xww@cox.net> wrote in message
news:mh8ki39moaos76tf4tq9c0igo37vtgiac8@4ax.com...
> On Thu, 1 Nov 2007 12:15:54 -0500, "VanguardLH"
> <VanguardLH@mail.invalid> wrote:
>
>>"Fruit2O" <jz137xww@cox.net> wrote in message
>>news:kelji3tnv1ggjnqkp050gobji9ni8mc5a7@4ax.com. ..
>>> On Thu, 1 Nov 2007 02:30:32 -0500, "VanguardLH"
>>> <VanguardLH@mail.invalid> wrote:
>>>
>>>>"Fruit2O" wrote in message
>>>>newsuaii312brk4v7inct6c3snhnnfk9sif0a@4ax.co m...
>>>><snip - duplicate post multiposted instead of crossposted>
>>>>
>>>>See replies to your same post in the other group to which you
>>>>multiposted.
>>>>
>>>>Learn to cross-post.
>>>>
>>>>http://en.wikipedia.org/wiki/Crossposting
>>>>http://www.cs.tut.fi/~jkorpela/usenet/xpost.html
>>>>
>>>>A point not made is that N multiposted copies will consume N times
>>>>the
>>>>disk space for each of the separate copies of the same post.
>>>>Crossposted messages have just *one* copy on the server with links
>>>>in
>>>>the newsgroups back to the same single copy. Multiposting wastes
>>>>disk
>>>>space on the server. Yes, your post may be small but remember
>>>>that
>>>>you consume N times the space on one server and then do so again
>>>>on
>>>>all the newsgroups servers worldwide. You waste more bandwidth
>>>>getting N copies of your multiposted message distributed to all
>>>>the
>>>>newsgroups servers worldwide. Cross-posting has just one copy of
>>>>the
>>>>message on an NNTP server, and only one copy gets propagated to
>>>>other
>>>>NNTP servers.
>>>>
>>>>To those visiting the newsgroups, crossposting helps them see ALL
>>>>the
>>>>replies from those in the other RELATED newsgroup to which you
>>>>linked
>>>>your post. That way, they don't waste their time duplicating
>>>>similar
>>>>replies.
>>>
>>> Sorry, but I tried crossposting and it didn't work. I've had
>>> trouble
>>> crossposting for years and haven't been able to figure it out
>>> yet -
>>> even with a lot of help on the Forte newsgroup and Forte tech
>>> support.
>>> I tried it again last night but it wouldn't post at all.

>>
>>
>>It's been since February when I last trialed Forte Agent (the real
>>version which was a trial version, not the crippled version). You
>>should be able to simply add more newsgroups to the Newsgroups field
>>to do the cross-posting. Many NNTP clients will not cross-post if
>>the
>>newsgroups are available only across different NNTP servers; that
>>is,
>>they cannot cross-post if one NNTP doesn't have all the newsgroups.
>>I
>>don't know if that is a limitation of Agent but you can check with
>>its
>>users. There looks to be some newsgroups for that newsreader.
>>
>>Typically what happens is you get a warning that not all newsgroups
>>were available on the NNTP server that you used but that doesn't
>>stop
>>you from posting to the remaining newsgroups (i.e., skip past the
>>warning). Cross-posting only works within one NNTP server because
>>they are the one providing the links to the one copy of the article
>>that *they* have. Other NNTP servers have their own separate
>>cross-posting support for articles on their own host. You cannot
>>cross-post across NNTP servers. That is, the links to the same
>>article are for that article on the same NNTP server, not for links
>>across multiple NNTP servers. It looks like you are using Cox's
>>NNTP
>>service to post. I don't know if you were trying to cross-post
>>across
>>multiple NNTP hosts. You didn't describe what is your problem
>>(whether with the program or your understanding). Maybe you're just
>>using the wrong separator character in the Newsgroups field. Maybe
>>your instance of Agent is screwed up.
>>
>>Agent used to suck for supporting multiple NNTP servers in that you
>>had to specify on the command-line which one to connect and open
>>another instance of Agent for each NNTP server. I think the freebie
>>or crippled free version still does that but their commercialware
>>version supports multiple NNTP servers now.

>
> I use the latest PAID version of Forte. As for delimiters, I have
> tried commas and semi-colons. I only use one NNTP server (COX's).
> However, I've always had trouble cross-posting. I called COX and
> they
> say it must be Forte. I contacted Forte and they say it must be
> COX.
> Perhaps if you tell me EXACTLY how to post to more than one
> newsgroup,
> I'll try it and see if it works. I'll try anything. Who knows? I
> might be doing some little thing wrong which screws up my post.
> Yesterday, when I tried cross-posting, my post went to NEITHER of
> the
> groups and I got an error message to the effect. But the message
> said
> nothing about my syntax, Thanks.........



According to RFC 3977 (which obsoletes RFC 977), the NNTP client
issues the POST command and then follows with the standard headers.
The Newsgroups header is one of those standard headers. Be sure to
comma-delimit the newsgroups and with NO spaces in the list. An
example posting for the commands sent by the client ("[C]") and
returned by the server ("[S]") might be:

[C] POST
[S] 340 Input article; end with <CR-LF>.<CR-LF>
[C] From: "Demo User" <nobody@example.net>
[C] Newsgroups: misc.test
[C] Subject: I am just a test article
[C] Organization: An Example Net
[C]
[C] This is just a test article.
[C] .
[S] 240 Article received OK

Could be you have something misconfigured in Agent as to how to
delimit the substrings in the Newsgroups header. The headers are
actually defined under RFC 822, obsoleted by RFC 2822; see
http://www.tcpipguide.com/free/t_Use...lHeaders-2.htm
(where it says to separate the groups with a comma character). You
have to specify the WHOLE newsgroup name, not just some part of it.

"I got an error message to the effect" does not say WHAT message you
got. Impossible to work with unspecified error messages. You might
want to turn logging on in Agent, if it has it, to see what commands
and data it sends to the NNTP server when you attempt to cross-post.
You can use *.test groups to submit test posts for checking
cross-posting results. You might also try using a different NNTP
server, like aioe.org's which is free (but they have anti-spam quotas
that can get in the way of even legit non-spam posts).

  Reply With Quote
Old 07-11-2007, 10:55 PM   #9
foghollow
Guest
 
Posts: n/a
Re: Need help removing malware

I used a news client once that dropped all but the first group in the list if you put spaces after the
delimiter (which was a comma, in that one)
I've used news servers that drop stuff if any of the groups in the list aren't carried by that server

You might try sending to one or more of the test groups to see how your stuff is propagating.
alt.test, comp.test, etc.
You get a message back telling you what happened to your message on its journey through the
internet.
--
Snob? Were I a snob, I wouldn't be talking to you.
  Reply With Quote
Reply
Tags: , ,


Thread Tools
Display Modes


Google
 


All times are GMT +5.5. The time now is 05:33 AM.


vBulletin, Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO
Copyright © 2005-2008, TechTalkz.com. All Rights Reserved - Privacy Policy
Valid XHTML 1.0 Transitional