Warning - Potentially Expensive virus!!

I've recently done a disk reformat and fresh WinXp install. All was going
well untill this morning.

My pc is connect to the net via a dailup connection. This morning I booted
my pc, checked a few emails and left the machine to itself for an hour while
I had breakfast.

When I came back the machine had rebooted itself - that's weird I thought.
But when I looked closer I noticed a pop-up blocker had been installed into
IE. The name on the blocker toolbar is Mirar

Furthermore, when I went to reconnect to the internet I noticed the username
had been changed from kerryww1 to kerry29.14.80233.2. Worse still the dialup
number had also changed to 0011675277024. I found out this number is an
international number costing $US1.60 a minute!!

Just as well I looked before I pressed the dial button again. Also, luckily
I didn't have the automatic re-dia box checked.

That's just part of the problem, the connection status dialogue box shows
that I'm in a constant state of upload and download which has slowed the
connection to a snails pace.What am I uploading and downloading?

When I open a new window of IE I often get re-routed to various porn sites.

I've come across some viruses in my time but this beats them all!.

Anyone have any ideas apart from the usual disk reformat and load windows
again for the upteenth time?

TIA

Kerry

There may be ways to fix it. However, another reformat will probably be the
best solution. Before you connect to the internet again I'd install a good
virus protection software and firewall.


"Kerry" <kerryww1@bigpond.com> wrote in message
news:Tnt6e.7617$5F3.7353@news-server.bigpond.net.au...
> I've recently done a disk reformat and fresh WinXp install. All was going
> well untill this morning.
>
> My pc is connect to the net via a dailup connection. This morning I booted
> my pc, checked a few emails and left the machine to itself for an hour
while
> I had breakfast.
>
> When I came back the machine had rebooted itself - that's weird I
thought.
> But when I looked closer I noticed a pop-up blocker had been installed
into
> IE. The name on the blocker toolbar is Mirar
>
> Furthermore, when I went to reconnect to the internet I noticed the
username
> had been changed from kerryww1 to kerry29.14.80233.2. Worse still the
dialup
> number had also changed to 0011675277024. I found out this number is an
> international number costing $US1.60 a minute!!
>
> Just as well I looked before I pressed the dial button again. Also,
luckily
> I didn't have the automatic re-dia box checked.
>
> That's just part of the problem, the connection status dialogue box shows
> that I'm in a constant state of upload and download which has slowed the
> connection to a snails pace.What am I uploading and downloading?
>
> When I open a new window of IE I often get re-routed to various porn
sites.
>
> I've come across some viruses in my time but this beats them all!.
>
> Anyone have any ideas apart from the usual disk reformat and load windows
> again for the upteenth time?
>
> TIA
>
> Kerry
>
>
>
>

On Mon, 11 Apr 2005, Kerry wrote:

> I've recently done a disk reformat and fresh WinXp install. All was going
> well untill this morning.
>
> My pc is connect to the net via a dailup connection. This morning I booted
> my pc, checked a few emails and left the machine to itself for an hour while
> I had breakfast.
>
> When I came back the machine had rebooted itself - that's weird I thought.
> But when I looked closer I noticed a pop-up blocker had been installed into
> IE. The name on the blocker toolbar is Mirar
>
> Furthermore, when I went to reconnect to the internet I noticed the username
> had been changed from kerryww1 to kerry29.14.80233.2. Worse still the dialup
> number had also changed to 0011675277024. I found out this number is an
> international number costing $US1.60 a minute!!
>
> Just as well I looked before I pressed the dial button again. Also, luckily
> I didn't have the automatic re-dia box checked.
>
> That's just part of the problem, the connection status dialogue box shows
> that I'm in a constant state of upload and download which has slowed the
> connection to a snails pace.What am I uploading and downloading?
>
> When I open a new window of IE I often get re-routed to various porn sites.
>
> I've come across some viruses in my time but this beats them all!.
>
> Anyone have any ideas apart from the usual disk reformat and load windows
> again for the upteenth time?

The next time you connect, follow these instructions first:
http://www.cablemodemhelp.com/xpsurvivalguide.pdf
or (redirects to the above):
http://isc.sans.org/presentations/xpsurvivalguide.pdf

If you need a French version, "Windows XP : Survivre le premier jour":
http://www.lsdp.net/~lotfree/doc/win...alguide-fr.pdf

You might also find it safer to use IE *only* for Windows Updates
and install an alternate browser for everything else. Also avoid
Outlook/Outlook Express and switch to some other email software.

The software recommended by my ISP:

http://beacon.chebucto.info/news.shtml

[snip]
: Updated - Recommended software list
:
: With the recent interest in Internet security and the rise in various
: exploits meant to take over user machines, the Chebucto Office has
: compiled this list of recommended software for user computers running
: Microsoft Windows.
:
: Web browser: Mozilla Firefox free from [18] Mozilla.org
18. http://mozilla.org/
:
: Email client: Mozilla Thunderbird free from [19] Mozilla.org
19. http://mozilla.org/
:
: Anti-Spyware Software:
: * Ad-Aware SE free and paid versions from [20] Lavasoft.de
20. http://www.lavasoft.de/
: * Spybot: Search & Destroy free from [21] Safer-networking.org
21. http://www.safer-networking.org/
:
: Firewall: Zone Alarm free and paid versions from [22] Zonelabs.com
22. http://www.zonelabs.com/
:
: FTP Software: FileZilla free from [23] FileZilla.SourceForge.net
23. http://filezilla.sourceforge.net/
:
: RSS Newsfeed Reader: RSSOwl free from [24] RSSOwl.SourceForge.net
24. http://rssowl.sourceforge.net/
[snip]

--
Norman De Forest http://www.chebucto.ns.ca/~af380/Profile.html
af380@chebucto.ns.ca [=||=] (A Speech Friendly Site)
"It's MyParty and I'll delete it if I want to."
-- Trafton Ziegler in alt.comp.virus, on Sunday, February 10, 2002.

Kerry wrote:
> Anyone have any ideas apart from the usual disk reformat and load
> windows again for the upteenth time?

Here are the free tools I use to keep my machines clean:

http://www.lavasoftusa.com/software/adaware/
Detects and removes

http://www.safer-networking.org/en/index.html
Detects and removes

http://www.javacoolsoftware.com/spywareblaster.html
Prevents installation

http://www.kephyr.com/spywarescanner/index.html
Bazooka doesn't automatically remove anything but it detects a lot of
things that other programs don't and it gives you directions for manual
removal
--
Red

On 2005-04-11 07:41:39 -0400, "Kerry" <kerryww1@bigpond.com> said:

> Anyone have any ideas apart from the usual disk reformat and load windows
> again for the upteenth time?


Ditch Windows completely?

Worked for me - I've not had a virus in 8 years.

"Ben Jamieson" wrote.

>Ditch Windows completely?
>
> Worked for me - I've not had a virus in 8 years.
>

You're right Ben, but I'm not in my office where I download all my email and
do most of my work with RH Linux. Only when necessary, I use Windose. Since
I've been away and relying on a Windows pc this will be the third time I've
had to reload it in 5 months.

The main reason I use (need) Windows is because some years back I started a
web site with FrontPage and never got around to changing.

It amuses me that we buy Windows and everyone tells me not to use IE and
Outlook Express. Same with Frontpage, I constantly read people advising
others not to use many parts of Frontpage, use FTP instead, avoid Frontpage
extensions etc etc. Even when I go to Microsoft's site and check their code,
it's not even done using FrontPage. It seems that not even Microsoft use
their own software! I once read they said that they also use *nix at times
"because it's so robust" Is that true?

What sort of a crazy world do we live in when we buy something then go and
replace it with something else that not only works better but is FREE?

Also thanks for all the help. You're right, I'm about to reformat the disk
and so on. I'm also thinking of buy a Mac to sit alongside my Linux box when
I get back to my office.

Kerry

> You're right Ben, but I'm not in my office where I download all my email and
> do most of my work with RH Linux. Only when necessary, I use Windose. Since
> I've been away and relying on a Windows pc this will be the third time I've
> had to reload it in 5 months.
>

I agree I am linux person. It runs and runs and never have
to reinstall it like some other OS every other month.
I don't worry about virus and don't have adware and
spyware to deal with. Also, my linux "seems" faster than
other compatible machines running windows possibly
due to them being full of adware and spyware slowing them
down.

I have got everything that I use to do in windows now
installed and working under linux so I have no use
or need to go back to windows.

my two cents