Re: 80072EFD after Download Box shows up and executes. AOL 9 & wi

From: Kurt (Kurt_at_discussions.microsoft.com)
Date: 12/10/04 

Date: Thu, 9 Dec 2004 17:27:02 -0800

Thanks go to dak & Noel & Yolanda RC for taking the time to respond to my
dilemma. I can only work on this in the evening so my progress is slow and
therefore the delay in my progress update. See my responses below, but first
a review of my situation.

- IE will not work through AOL.
- AOL browser will not download updates from Microsoft Windows update.
- To use IE through Earthlink; I have to first turn-off Proxy server setting.
- IE through Earthlink; Can not download from Windows update site.

dak wrote:
If the tracking cookies, or other malware, are triggering frequent
"error pop-ups" you can disable them:
-Open Spybot S&D, if you're not on the SPYBOT S&D tab click on it
-Click IMMUNIZE
-From the DROPDOWN MENU in the lower section, select "Block all bad
pages silently."
In order to see this dropdown menu you must have the "Permanently
running bad download blocker for IE" enabled.

Kurt says: I do not have problems with frequent "error pop-ups" but I went
ahead and performed the procedure described.

The DSO EXPLOITS are incorrectly "fixed" by Spybot S&D so they show up
again on the next scan. If you are up to date on your Microsoft updates
and patches then you don't have to worry about the DSO EXPLOITS, as that
particular security "weakness" has been corrected.

To get rid of the DSO EXPLOITS false flags you can set Spybot S&D to
ignore them:
-Open Spybot S&D, click on SETTINGS.
-Click on IGNORE PRODUCTS
-Click on SECURITY
-Check the DSP EXPLOIT box

Or you can download and install "Spybot S&D 1.3.1 TX" which corrects
the DSO EXPLOIT bug in Spybot S&D. This will replace the executable
ONLY, so you must already have either "Spybot S&D 1.3 FINAL" or "Spybot
S&D 1.3.1 BETA" installed. You can download "Spybot S&D 1.3.1 TX" from:

<http://www.majorgeeks.com/download4392.htm>

Kurt Says: My version of Spybot did not say “final” so I downloaded the
version from www.majorgeeks.com and reinstalled it. I downloaded the latest
updates. I downloaded and installed the patch. I ran spybot and it worked.
The DSO exploits no longer showed up. I tested for my four problems listed
at the beginning and no change.

Your HOSTS file should reside in "C:\WINDOWS\system32\drivers\etc".
Look at its contents with Notepad and delete anything beyond the
"127.0.0.1 localhost" entry (which should be the first entry) that you
did not put there yourself.
You can disable (rather than delete) the other HOSTS files by renaming
them to something like "HOSTS.TXT".

Kurt Says: There was not anything beyond the "127.0.0.1 localhost" entry.

Noel Wrote:
1) Aluria Spyware Eliminator - Aluria have recently formed a partnership
with WhenU (purveyors of spyware to the masses) - make of that what you
will. (http://www.spywareinfo.com/articles/aluria/delisted.php)

Kurt Says: Hmmm. Thanks for the heads up.

2) Ad-Aware is free for personal use, so you have nothing to lose by trying
it. No one spyware killer removes @everything@ - and the beauty of Ad-aware
is that you can pretty much remove absolutely everything it finds, with very
rare exceptions (unlike SpyBot S&D, which can cripple your PC if you don't
know what you're doing).

Kurt Says: I found the free download of AdAwareSE on the www.BigGeeks.com
site that dak talked about. I got it set up and ran it in safe mode and in
full mode. No difference in what it found. It found the following:
    - (35) MRUs
    - (6) softomate toolbar items [TAC=9 and mentions this is a brower
hijacker]
    - (208) tracking cookies.
Ad-Aware seems to have outperformed Spyware Elminator. It makes one wonder
if these internet review sites are taking money under the table to modify
their ratings of products?

Nil Carborundum Illegitemi

Kurt Says: I have spent too much time trying to find out what this means.
I give up, what nugget of wisdom does this give point to.

Yolanda wrote:
I had all the same symtoms-called Dell, MSN Virus People, the MSN $$ Expert
no go. last 2 told me to back up system & scrub my hard drive, I was NOT
going to do that again - All diagnostics showed my pc was CLEAN! I was
hijacked, I knew that so I looked thru programs and found it under my Norton
Internet program- these "geniouses" that develop these viruses can go around
anything! this one is named Adware Bouncer & ba.exe so its easy to download
thinking it's Adaware. The virus/spyware reproduces itself and changes the
registry - it would not let me download Stinger, nor Panda nor update Norton.
I cound not do research nor use Google. I ran Spy Bot (free) and downloaded
Adaware again. In desperation I deleted my Norton Internet. I used
abcnews.com as a search engine for free anti-virus, I like it - and was able
to get Panda AntiVirus. Used it. Reloaded Norton Internet and everything is
working fine now. Norton has a small program to unhook these things from
registry but you have to call a tech to walk thru the process -the name of
the program is "tbar.exe" It comes with directions but I did not have to
use-its free. It took a long time to fix my pc - now I'm deleting lots of
e-mail, not opening attachments espcially from people who love to "forward"
stuff and no more downloading of anything unless its absolutely safe.
Firewall, AntiVirus, 3 Spyware Protectors is what I'm using now. Good luck!

Kurt Says: Yolanda, I read this and despair enters into my soul. I tried
the Panda Anti-virus with no luck. I tried to search out Adware Bouncer &
ba.exe with no luck.

Kurt Says: I am now at the point of researching the system restore function
to see if I can take myself back to the time period before all of this
happened. I also have several images of my hard drive taken by Acronis True
Image 6.0 . If the system restore function looks like it is lacking, I will
investigate restoring my hard drive to a time period before this started to
happen and then rebuild my PC with the updates & patches I have already done
& then load in my personal files.

Relevant Pages

  • Re: 80072EFD after Download Box shows up and executes. AOL 9 & wi
    ... > - AOL browser will not download updates from Microsoft Windows update. ... > If the tracking cookies, or other malware, are triggering frequent> "error pop-ups" you can disable them:> -Open Spybot S&D, if you're not on the SPYBOT S&D tab click on it ... > Kurt says: I do not have problems with frequent "error pop-ups" but I went> ahead and performed the procedure described. ... I am now at the point of researching the system restore> function ...
    (microsoft.public.windowsupdate)
  • Re: 80072EFD after Download Box shows up and executes. AOL 9 & wi
    ... registry - it would not let me download Stinger, nor Panda nor update Norton. ... In desperation I deleted my Norton Internet. ... >> I also have Spybot. ...
    (microsoft.public.windowsupdate)
  • Re: Search help
    ... Sounds like this might be a variant of some malware called CoolWebSearch (if ... not, then see AdAware, SpyBot, and HijackThis, below). ... Download, UPDATE before running, and run: ... Another excellent program for this purpose is SpyBot Search and Destroy ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Hyperactive Hyperlinks
    ... Sounds like this might be a variant of some malware called CoolWebSearch (if ... not, then see AdAware, SpyBot, and HijackThis, below). ... Be sure that you also download and install hotfix Q816093, ... Another excellent program for this purpose is SpyBot Search and Destroy ...
    (microsoft.public.windows.inetexplorer.ie6.ieak)
  • Re: A2 found "traces"
    ... Trace.Directory.Spyware.MateWatcher ... download it. ... more pieces of spyware, a little bit at a time and usually quick enough so ... I don't know about Spybot, but I -thought- Adaware had done a fix to ...
    (microsoft.public.windowsxp.security_admin)
Loading