Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

16-bit Ms Dos Troubles


  • Please log in to reply
6 replies to this topic

#1 Diablobovis

Diablobovis

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:38 PM

Posted 25 June 2007 - 03:57 PM

I keep getting this pop up when I turn on my computer, and sometimes just randomly. usually it's about 15-20 of the things. It actually just popped while I'm writing this (16 of the darn things to be precise) I'm thinking it's a virus.

Posted Image


What is it and how can I get rid of it?

BC AdBot (Login to Remove)

 


#2 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:06:38 PM

Posted 25 June 2007 - 04:00 PM

See if this helps:
kellys-korner
Error Message: MS-DOS or 16-bit Windows-based program - #346, on the Right
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#3 oldf@rt

oldf@rt

  • Members
  • 2,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Avondale, Arizona USA
  • Local time:05:38 PM

Posted 25 June 2007 - 04:05 PM

It looks to me like you have the Backdoor CLT worm. This infections connects to an IRC server where it awaits commands. If this infection is on a Windows XP, NT, 2000, 2003, or Vista box then it may have overwritten your legitimate file. Try this:

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
  • Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
  • Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the "Scan tab" and UNcheck "Heuristic analysis"
  • Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
  • Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
  • When done, a message will be displayed at the bottom advising if any viruses were found.
  • Click "Yes to all" if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
    (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  • Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
If this does not correct the issue, you will need to post a hijack this log: http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
The name says it all -- 59 and holding permanently

**WARNING** Links I provide might cause brain damage

#4 Diablobovis

Diablobovis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:38 PM

Posted 25 June 2007 - 06:27 PM

backup-20070625-161750-997.dll;C:\Documents and Settings\HP_Owner\Desktop\backups;Adware.Coupons;Incurable.Deleted.;
backup-20070625-161751-866.dll;C:\Documents and Settings\HP_Owner\Desktop\backups;Program.PopcapLoader;Incurable.Moved.;
KillWind.exe;C:\hp\bin;Tool.ProcessKill;Incurable.Moved.;
Process.exe;C:\Program Files\Roguescanfix;Tool.Prockill;Incurable.Moved.;
A0276521.ocx;C:\System Volume Information\_restore{A2578CBA-012A-4EE9-9E3D-27D3F494A2B6}\RP597;Adware.Coupons;Incurable.Moved.;

that's what DrWeb report said. It didn't fix though, they popped up again.

#5 oldf@rt

oldf@rt

  • Members
  • 2,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Avondale, Arizona USA
  • Local time:05:38 PM

Posted 25 June 2007 - 08:26 PM

Did you try TG1911's post? If you have not, try it, also if you have an original XP CD, try running system file checker.

(Start, Run, sfc /scannow, follow the instructions.)

If neither of these work you will need to post the hijack this log.
The name says it all -- 59 and holding permanently

**WARNING** Links I provide might cause brain damage

#6 Diablobovis

Diablobovis
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:38 PM

Posted 25 June 2007 - 08:41 PM

yes, I tried his, I don't think it worked.

I just posted the hijack this log.

#7 oldf@rt

oldf@rt

  • Members
  • 2,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Avondale, Arizona USA
  • Local time:05:38 PM

Posted 25 June 2007 - 10:30 PM

Great, now the usual instructions apply: do nothing to your computer unless instructed by the hijack this team member. Please wait and be patient, as they are quite busy.
The name says it all -- 59 and holding permanently

**WARNING** Links I provide might cause brain damage




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users