Tech: Error notices

Subject: Tech: Error notices
From: kendall
Date: 04 Aug 04 - 06:40 AM

I have a couple of things that are driving me nuts.
Everytime I log on, I get a notice from Microsoft saying they have to shut down, send error report. I have done every thing they suggest, dumping cookies, disc cleanup, defrag. and delete unused files, nothing helps.
Now I'm getting e mails with a yellow band at the top and a notice from Outlook Express that says: OE has removed access to this unsafe attachment etc. I have two anti virus programs and neither of them pick it up.
What the hell is the matter? No wise cracks please, I'm not in the mood.

Subject: RE: Tech: Error notices
From: DMcG
Date: 04 Aug 04 - 06:53 AM

I can't answer the first question, but the Outlook Express one is almost certainly just OE being cautious. Notice that it says the attachment is 'unsafe', not that there is a virus. My settings on Outlook (as opposed to OE) regard all pictures as unsafe, supposedly because such things can be used by websites to spot whether the email delivered to you was picked up and can therefore be used to send more spam to. That's a completely different kind of 'unsafe' to viruses. (I say supposedly, because there are also lots of other reasons why you might not want to download pictures automatically)

Outlook tends to block lots of things that are potentially a problem, whether or not they are a problem in reality 'just in case'. On balance, this is probably a good thing, but it can certainly make legitimate use of some of these facilities annoyingly difficult.

Subject: RE: Tech: Error notices
From: kendall
Date: 04 Aug 04 - 08:55 AM

thanks. Maybe I'm putting too much trust in my anti virus program.

Subject: RE: Tech: Error notices
From: GUEST,MMario
Date: 04 Aug 04 - 09:42 AM

kendall - if OE has removed the attachment - there is nothing for your virus checker to pick up

Subject: RE: Tech: Error notices
From: kendall
Date: 04 Aug 04 - 11:48 AM

This just started happening suddenly for no apparent reason.

Subject: RE: Tech: Error notices
From: JennyO
Date: 04 Aug 04 - 12:01 PM

Everytime I log on, I get a notice from Microsoft saying they have to shut down

Kendall, the last time I started getting notices like that, it turned out I had a virus that had turned off my antivirus auto-protect, disabled my firewall and blocked access to symantec and similar sites. So I had no warning from those things that it was there.

Have you looked at your Task Manager to see if anything strange is running? (press ctrl/alt/delete) Mine was - there were processes running that were taking up a lot of my memory.

Of course it might not be anything so sinister, but just a thought.

Subject: RE: Tech: Error notices
From: wysiwyg
Date: 22 Aug 04 - 03:21 PM

Jenny-- how did you clear off the infection?

~S~

Subject: RE: Tech: Error notices
From: McGrath of Harlow
Date: 22 Aug 04 - 03:36 PM

I'm always stumped to find out what these mysterious programs are - "Dk service" "X760stat" "NWERboot" for example.

Someday I'll get a new computer, and I'll religiously record all the things it's got installed and all the things I install, and I'll recognise when new things turn up that look wrong. Except I doubt if I ever will.

I've got it booked in for a health check in a few weeks time, which should sort out everything. Except it never does - some things get better when I take it in, but some things stay the same when they shouldn't, and some even get worse sometimes (like the time when my hard drive went wrong, and they took it in, and removed the wrong hard drive that hadn't gone wrong and sent it off to be scrapped). I wish I could find a computer bloke I could trust the same way I trust the bloke who fixes my car.

Subject: RE: Tech: Error notices
From: wysiwyg
Date: 22 Aug 04 - 04:52 PM

JOKE 150ALERTS

Whazzat?

~S~

Subject: RE: Tech: Error notices
From: The Fooles Troupe
Date: 22 Aug 04 - 06:04 PM

Mcgrath.

This is why running HijackThis! &/or AdAware, and a few others will form an 'ignore list' right after you install it, then note each new thing added.

Subject: RE: Tech: Error notices
From: GUEST,WYS cookies deleted
Date: 22 Aug 04 - 06:06 PM

I think I'm in big trouble. Puder whizzes, where are you????

~Susan

Subject: RE: Tech: Error notices
From: The Fooles Troupe
Date: 22 Aug 04 - 06:28 PM

With no details of what the trouble may be, and precise symptoms, we can't really help in a technical sense, sorry...

Subject: RE: Tech: Error notices
From: kendall
Date: 22 Aug 04 - 06:29 PM

My virus shield is working fine.

Subject: RE: Tech: Error notices
From: wysiwyg
Date: 22 Aug 04 - 06:32 PM

It's just as I posted above-- I asked Jenny how she got rid of whatever it was SHE had (since I have the same symptoms she described) and I asked "JOKE 150ALERTS, whazzat?" because it shows up on an online scan.

If you can help, great. If not, hey, don't give me any shit right now, OK??????

~S~

Subject: RE: Tech: Error notices
From: The Fooles Troupe
Date: 22 Aug 04 - 07:14 PM

Sorry, don't know that one personally - one can't know everything...

Google search on that phrase shows lots of references...

briefly - a DLL hijacker...

http://www.annoyances.org/exec/forum/win98/1059842921
part of thread in response to
"PLEASE HELP ME-Joke_150alerts "

is one of the first pages with some removal instructions, other pages may be more helpful and less cryptic.

Don't think it's a new one by the look of it.

Robin

Subject: RE: Tech: Error notices
From: The Fooles Troupe
Date: 22 Aug 04 - 07:22 PM

The page at
http://doxdesk.com/parasite/CustomToolbar.html
contains this text and lots of links which a simple cut and paste doesn't show here... This text explains how you probably got it...



Description
CustomToolbar is an Internet Explorer toolbar made using toolbar creation software from customtoolbar.com.

Variants
CustomToolbar/Mojo is an adware toolbar written and distributed by mojo.com (its controlling server).

There are other CustomToolbar variants but none are known to be installed by underhand methods; they are not known to be harmful and are not detected by the script at this site.

Distribution
The Mojo variant is installed by ActiveX drive-by download on pop-up ads served through Standard Internet. It is known to have used an Internet Explorer security exploit to install automatically without prompting; some anti-virus software may detect this exploit as JS.Exception.

Note: one of the sites involved in spreading CustomToolbar/Mojo is stopannoyingpopups.com, which may also install Wink/nsdlua.

What it does
Advertising
Yes, can open untargeted pop-up ads as directed by its controlling server (which is contacted when a new IE window is opened).

Privacy violation
No.

Security issues
In the software itself, no.

However the security exploit often used to install the Mojo variant is an extreme security risk: it enables all ActiveX security settings, allowing any web page to run any code at all (even unsigned code) without prompting.

Stability problems
None known.

Removal
Open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%\System"
regsvr32 /u ..\ctb\CustomToolbar.dll
regsvr32 /u Actbar2.ocx
Restart the computer and you should be to delete the 'ctb' folder inside the Windows folder, and the 'Actbar2.ocx' file inside the System folder (which is also inside the Windows folder, and called 'System32' on Windows NT/2000/XP or just 'System' on Windows 95/98/Me). Then open the 'Downloaded Program Files' folder in the Windows folder, and delete the 'CustomToolbar Setup' entry.

Now check your security settings — if Mojo installed through the IE exploit then not only do you need to fix that hole, but you also need to undo the damage done to your ActiveX security settings, which will be wide open. Go to the Security tab of Internet Options, choose the Internet Zone, click 'Custom Settings' and make sure the following options are set:

'Download signed ActiveX controls' to Prompt (or Disable);
'Download unsigned ActiveX controls' to Disable;
'Initialize and script ActiveX controls not marked as safe for scripting' to Disable;
To fix the exploit that allowed Mojo to load, you will need to get a newer version of the Microsoft Java VM. Windows 2000 users can find a patch for it; for everyone else there is only the somewhat temperamental Windows Update. (Or alternatively, using Sun's Java VM, or disabling Java altogether.)

Links
The software used to create CustomToolbar is from customtoolbar.com.

Mojo.com is a generic portal operated by the advertising network Standard Internet.

Parasite detection & information

Subject: RE: Tech: Error notices
From: John Routledge
Date: 22 Aug 04 - 07:31 PM

Kendall I too have had your yellow band OE notices

As you say only acess is removed not the attachment itself

By clicking on the notice from OE - sorry can't remember where - access can be reinstated just for that particular attachment or indeed all attachments.

This works in addition to your virus scanner.

Perhaps someone has a more comprehensive answer.

Subject: RE: Tech: Error notices
From: wysiwyg
Date: 22 Aug 04 - 07:54 PM

Thanks, Robin. I think I will see if my mind reboots tomorrow and if so I will give all that a look.

In the event this may be of help:

Not seeing any new toolbars, I don't think....

My techie installed "Pop-up Stopper" the other day and swore he had not had any bad effects from it at home.... let's see, what else have I done in the last few days, well I installed an update from an Intel CD for the digital camera....

And there was that REALLY funny site I went to the other day that had page after page of a thread describing all the different kinds of sh*t there are (hey, I was following a link, OK?)....

Oh yeah, wait, I am also running the newest Norton AV and both SpyBot and Webroot Spy Sweeper.

This afternoon I did delete all temp internet files and deleted something calling itself jokes.dbx that the file mgr said was created months ago but modified today-- no such action on MY part I can assure you!

The only other online download I've said YES to was for the online scan I started earlier today-- it only got a little of the scan done before locking up.

I did finally get Norton to open a little while agoi and ran a full scan. It opened itself in duplicate and neither scan it ran found anything.

~Susan

Subject: RE: Tech: Error notices
From: Bill D
Date: 22 Aug 04 - 08:05 PM

here is my take on such things.

I almost NEVER use IE, so I do not get 'stuff' that happens with ActiveX scripts...I have several programs that specifically monitor attempts to open sites, install cookies or stick stuff on my computer without my permission. Kerio firewall, Proxomitron and SpyBot S&D with 'resident shield' enabled, along with my AVG anti-virus make it so that I never have these strange happenings. (yes, there are other combinations of things that can help, also, but I have spent 5 years sorting out the best 'free' set of tools)

I do NOT trust the efficacy of 'online scans'...if they can scan me, they can do other things. I want total control of what scans my PC.

Subject: RE: Tech: Error notices
From: The Fooles Troupe
Date: 22 Aug 04 - 08:09 PM

Ah - some of these nasty toolbars are invisible ....

That joke site sounds likely the culprit...

Robin

Subject: RE: Tech: Error notices
From: Pat Cooksey
Date: 22 Aug 04 - 08:15 PM

I had all sorts of problems with my pc, yesterday I phoned the
microsoft helpline here in Germany, a very patient young lady
who must have thought I was a complete idiot, she was right, went through all the steps with me to rid my machine of all problems, it
took 40 minutes but it worked, all is sound now.

Subject: RE: Tech: Error notices
From: Cluin
Date: 22 Aug 04 - 09:16 PM

Pat, sounds like you were one of the lucky ones. Their usual answer is "You will have to reinstall Windows."

I have NEVER had to do that, by the way.

If an email attachment is infected by a virus that your anti-virus program can recognize, it will catch it on the way in, before Outlook Express does anything with it. What the anti-virus program does with it depends on the settings you gave it, whether it quaranteens it or alerts you about it or just does away with it silently.

Have you recently installed some software, Kendall? Perhaps there is a conflict with another program you have running in the background, maybe a corrupted .dll file.

Subject: RE: Tech: Error notices
From: wysiwyg
Date: 22 Aug 04 - 10:42 PM

(patiently) Yes Bill dear, yes..... but every time I have tried installing and running a program that SAYS it will manage all 8 of my email accounts, it doesn't work. So if you would be so kind as to come the hell over (ooops lost that patient tone) and show me how the F! to use what you use, I wouldn't have these little irritations! :~)

~Susan