PCTech Forums

by **brad** » Fri Nov 21, 2003 9:45 pm

I guess you obviously know that this happened because of a worm.
Here's the complete , including the fix for the "Registered To:" problem.
brad

by **Ibsen3** » Wed Nov 26, 2003 5:01 pm

No, I didn't know this was because of a worm virus. It didn't seem to follow the rules of the Blaster worm and I certainly wasn't aware of another. Thanks Brad. This page fits the specs perfectly. There is only one problem. I'll include it below in the form of the letter that I just sent to my ISP (ntl). I really thought this problem had been pretty much cleared up, but I'm not so sure now.

I think this has been plaguing me now for about four or five months and I'm ready to kill the people behind this thing :mad:

The letter -

"Dear Sir / Madam,

RE: Suspected malicious virus

This is just to inform you of a problem I encountered yesterday whilst trying to connect to the internet. I hoped that you might be able to help me.

Yesterday, around 16:00, I connected to the internet and was able to use the connection for various purposes, but by around 18:00 I tried to reconnect after a break but found that I was unable to. This problem occured with both my laptop and my old PC, leading me to think that it was some sort of problem with the ISP, which according to the error messages seemed to be slow in responding.

I later attempted to connect and was able to do so (though this may have been after specifying the regional area that I was able to connect from by making use of the connectivity and security options), thus allowing me to run a few net-related programs, but not the internet nor MSN Messenger, the details of which are quoted below:

'We could not connect you to MSN Messenger. It appears you are behind a firewall that does not allow a direct connection to the internet. We tried to sign you in through an HTTP proxy, but your Internet Explorer proxy settings are either missing or incorrect. To adjust your IE proxy settings, click the IE Tools menu, click Internet options, click the Connections tab, and then click LAN settings.'

Other error messages include the recommendation, upon failing to establish a proper internet connection, to use an H.323 gateway or proxy.

This situation is problematised by a malicious virus that invaded my system a few months ago, resulting in messages on my laptop screen, a slowdown in the programs I was runnning and a lot of downloaded files I had not personally downloaded, including much that was detected as having a virus. However, a great deal of this has been taken care of through the program 'Ad-aware'.

I need to establish if this new problem is something that is definitely focused upon my machine or if it is my ISP before I can resolve this situation. Could you please advise me and offer any technical assistance you could suggest? I would be very grateful as the virus had been kept at bay by a series of steps taken to neutralise its effects but I believe that this is may be another, albeit greatly reduced, threat from the same source.

Yours faithfully....etc. etc."

by **Restek** » Thu Nov 27, 2003 4:14 pm

Just a note - there were problems with ntl's DNS servers. Certainly on wednesday I couldn't connect to many web sites, and those I could connect to were slow. Apparently there was also some problems with a transatlantic link earlier this week, so your problems could be related to these.

Are the connectivity issues still ocurring?

by **Ibsen3** » Sat Nov 29, 2003 1:41 pm

Aha! It looks like it's sorted itself out now, but I'm now suffering from a new problem (it never ends!!!

). Recently, I signed in to Messenger as usual, and managed to talk to people okay but when I clicked on the link to the emails it just kept asking me to resubmit my password.
I've contacted Microsoft about it and they just seem to give me an automated response about how to reset my password. Clearly, it's something more complicated than that if I can get in but can't access my emails. I thought this was something to do with the .NET passport. Maybe my remote hacking scumfiend somehow used this to gain control over my inbox :mad:

, as I believe the passport may only respond to the remote computer of the scumfiend that is taking me for a ride. Sure enough, after browsing for a while trying to sort out my problem, I received the message that there WAS a problem with my .NET password for exactly this reason. Even after stressing that I'm waiting for a very urgent and crucial job-related email (which is absolutely true, unfortunately) I was still unable to prompt them to do something that might help me.
Now of course, after resetting my password so many times, it looks like I'm blocked out for the time being :roll:

. Do you have any ideas?

by **Ibsen3** » Tue Dec 02, 2003 6:54 pm

OK, that's sorted, but this thing's going crazy now. I have a laptop and I think the key configuration has been screwed with, so that now instead of qwertyuiop etc., it reads:-
qwerty456-
asdfgh123
zxcvbn0
I'm pretty sure that means the driver has got me connected up to something that expects a big keyboard as opposed to the usual laptop layout.
Thanks for your time again, people. You're the best! :bow:

I promise I'll get this sorted soon by trying Brad's suggestion, but I wanted to get a few more files together so that I could get everything essential on my hard drive and burn a few CDs. At the moment, it's a case of putting it off whilst I have some urgent work to be getting on with.

by **Ibsen3** » Wed Dec 03, 2003 9:47 am

by **brad** » Wed Dec 03, 2003 12:08 pm

by **Restek** » Wed Dec 03, 2003 3:05 pm

by **Ibsen3** » Sat Dec 06, 2003 4:52 pm

by **Gecko** » Sat Dec 06, 2003 5:12 pm

by **Ibsen3** » Sun Dec 07, 2003 3:56 pm

It's quite a rare model, I believe, and almost two years old now. It's an AR15 NOTEBOOK SELECT 1000, part of a batch that the now defunct company 'Tiny' Computers had going before the company was taken over.
If it's any further help, it's got a 1GB Intel Celeron Processor, 112MB RAM and 17GB Hard Drive space.

by **Gecko** » Sun Dec 07, 2003 6:20 pm

The below is from the Tiny Computers support site
http://support.tiny.com/support/default.asp

If you are experiencing a problem where some keys do not appear to have the correct function as printed on the actual keys on your keyboard then follow the instructions below to solve the problem.

Click Start > Settings > Control Panel
Double click Keyboard
Now click on the Language tab
If the language is set to English (United States) then click on the Add button
Select English (British) from the list supplied and then click Ok
Now from the previous screen select English (United States)
Click on the Remove Button to delete this layout as it is not required. If you are asked to verify your actions click Yes
Now click Ok button to close the Keyboard Properties screen. Note: You may well get a warning message informing you that you will need to re-start the PC for the changes to take effect. If you get this message click Yes button to continue.
Now re-boot your system and the changes will have taken effect

I do believe that this is the driver that you need if the above does not work
http://support.tiny.com/support/drv/drv0058.zip

by **Ibsen3** » Mon Dec 08, 2003 10:12 pm

There must still be something seriously wrong, because that's still not working properly and I tried both of them. This is the worst problem yet, as I'm not much of an internet surfer anymore and my main use of my laptop is for writing purposes :evil:

.
What I can tell you is that during the time I was uninstalling and reinstalling my keyboard driver, I tried installing hotkey options by mistake and I briefly got a window whilst it was trying to restart, saying that the program 'Should not see me' was not working properly with the options 'End Now' or 'Cancel'. By the time I rebooted, there was the familiar old telltale Worm virus message with the title 'Damn...' and the message 'I'm starting to get sick of staying here aside, maybe you should report me if they don't know about me yet'.
I'm now gleefully fantasising that the evil $£&* has got itself lost in my machine and that through some technical magic it will tell me where this ^*$£ing piece of $%*^ is living. It's the only way I know of staying sane! I tried downloading the 'w32blast' removal pack and running it, but it said it could not detect, or find, the Worm virus on my machine.

P.S. I think I have only just found some documents that shouldn't actually be on my machine (they just seemed to appear) and I've kept them because I was wondering if they might help me to trace the problem. One is classed as 'Registration Entries' and titled 'FixNT2KXPAdaptecASPI' and another is a lengthy notepad file classed as 'Setup Information' with the title 'keyboard'. It's far too long to cut and paste but it looks more than a little suspect.

by **brad** » Tue Dec 09, 2003 7:42 pm

The Registration Entry file looks like the driver fix for WinXp, although mine was labeled "fixaspi.zip"
As for the: "I'm starting to get sick of staying here aside, maybe you should report me if they don't know about me yet".... that's one of the signs of this worm: (Scroll to the very end of this page to see it.)

Maybe it's time to update/upgrade your anti-virus program??
brad

PCTech Forums

Cleaning Up Operation

Cleaning Up Operation

Who is online