Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Webcry


  • Please log in to reply
8 replies to this topic

#1 vistahater

vistahater

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:03 AM

Posted 27 October 2007 - 02:51 AM

Hi everyone. I found my here because I needed help, and everything I've tried has failed. Problem...something called webcry. It has taken over my browser, I think, but only when I use the google search engine. If I do a search using any other search engine, I have no problems at all, but go to google, and wham. Everything I click onto, I am redirected by the name webcry popping up in the address bar and ending up at an ad site of some sort. Like I said, this only happens when I use google.
I downloaded a bunch of software, spybot, error killer, and a privacy software, done scans, including deep scans, and the problem remains. I also have Mcafee security, which has proven totally useless in trying to get rid of this webcry.
I have even gone all through my computer and removed google from it, then scanned, then went back to google, and there was webcry just waiting for me. PLEASE...is there any way to get rid of this, as google is my favorite search engine.

BC AdBot (Login to Remove)

 


m

#2 Guest_uhaligani_*

Guest_uhaligani_*

  • Guests
  • OFFLINE
  •  

Posted 27 October 2007 - 03:25 AM

Use this one:
http://www.atribune.org/content/view/24/2/

The file giving the problem is ocfrrbc.dll in the system32 folder - you could just delete it but mayb better to go through the program suggested!

Edited by uhaligani, 27 October 2007 - 03:27 AM.


#3 vistahater

vistahater
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  

Posted 27 October 2007 - 03:37 AM

Sorry about you having to move this.....the only forums I ever use are guitar forums, and in those forums is where you post your questions. I did search through some of these, and on page 2, I'll try to link to that, I found where you already covered this subjuct. I already did the first step, and it found nothing, so I'll attempt to try the other steps. If anything works out, I'll post it here.

Another-webcry-question

#4 vistahater

vistahater
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:03 AM

Posted 27 October 2007 - 04:09 AM

Okay, all I can fin with a 32 on it is system 32 files...checked it out and nothing that comes close to that name is in there. Also looked through whatever other files I could find and found nothing that comes close to that name. Is system 32 files my windows 32 files? I have vista windows, and this windows is so strange compared to the windows I am use to using.

#5 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:03 AM

Posted 27 October 2007 - 04:35 PM

Looking around the web, this may be a Vundo problem. SAS has had success removing a lot of Vundo malware.
You can also use the Vundofix tool in the link below.
http://vundofix.atribune.org/

Install Super Antispyware free. Run it in safe mode. Allow it to quarantine whatever it finds.
http://www.superantispyware.com/

How to Start Windows in Safe Mode:
http://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/

Post a Hijack This Log in the Hijack This Forum by following the directions in the link below if the program above has not removed ALL malware. DO NOT post a log in this forum. http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#6 Guest_uhaligani_*

Guest_uhaligani_*

  • Guests
  • OFFLINE
  •  

Posted 27 October 2007 - 11:45 PM

It's Windows/System32. But go along with the other suggestions.

#7 vistahater

vistahater
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:03 AM

Posted 28 October 2007 - 03:11 AM

Okay, I did run the vundofixer thing, webcry still there. I also downloaded and ran bitdefender and adwarealert 7000, still have webcry. I see there is only two things left on your list, and I will try those. But I just remembered something, don't know if it will help, but last week, I went to tools, and entered mangage addons, and saw something in there that didn't look right, it read "browser redirect" and I unabled it, went back to google, since this is the only place I have the proble, and tried to go to some sites. This time, instead of being redirected to an add page, I was redirected to a blank page, every time. So the thing in manage addons was clearly part of the webcry thing. If I could just find the other half of it, I would be rid of it.

I know this seems too simple, but since half of this thing was in the manage addons, do you suppose the other half is in there as well? There is a bunch of stuff in there I have no idea what they are.

#8 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee

Posted 28 October 2007 - 07:17 AM

If Vundofix and Super Antispyware has not removed the problem, post a Hijack This Log in the Hijack This Forum.
Never heard of "adwarealert 7000". Sounds like a ripoff of AdAware.

Directions for posting a Hijack This log are in the link below.
DO NOT post the HJT log in this forum.
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#9 Perdrix

Perdrix

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:France
  • Local time:04:03 AM

Posted 12 February 2008 - 01:28 AM

Hi folks,

last night when I found my solution here, e404.dll was packed up inside 1201542025.dll (random?), and showed up as e404mgr in the addon list. Just thought you'ld like to know it is mutating! :thumbsup:

Harvey

Edited by TMacK, 14 February 2008 - 12:05 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users