Mozilla warns over Firefox Trojan

[Steve]

http://www.bleepingcomputer.com/combofix/how-to-use-combofix


It removes what it can and produces a log file.

[pctech]

Pass, FF patched itself earlier so am immune from the pox so luckily not had to run it.

[Baz]

well I dont know what happened or what i've done but its running now.....to a certain degree.But heres a strange one, was on google and clicked a link and CPU usage shot right up to 100% again and it took me to some totally random site not the one I wanted.So I tried again with a google search of 'Dogs' clicked a link, any one and again I got some wild site full of ads.It only does this 100% thing on google it seems at the moment.

Any ideas.Theres something still not right with my system some where.I have the latest version of FF in case it was that just got it tonight.

[Simon]

You seem to have some malware on board, Baz.  Suggest Super AntiSpyware and / or Malwarebytes. 

[DorsetBoy]

Try these online scanners Baz :

http://www.eset.com/online-scanner


http://housecall.trendmicro.com/uk/


http://www.pandasecurity.com/activescan/index/?track=100737

the problem with a lot of the worm type infections is that they need manual removal from the registry.

[Baz]

thanks guys will try those links if i get running again.have both those progs Simon and Malware did find something but today as soon as I booted up I got the same 100% cpu usage problem.Ran Combofix again but now im stuck on the windows welcome screen 

Its getting annoying now.cant even get it to run so I can save files and stuff and do a clean install.

[Simon]

Safe mode?

[DorsetBoy]

I really am beginning to think of  having a net machine which I image up in Acronis and then just re-install if there's  problem. Isolate it from other machines on the network, but give it access to printers.

A simple answer that certainly works is the new Avast Internet Suite which offers a superb Sandbox virtualisation system for any application you choose.

I had shied away from any of the suites/av-firewall combos due to the often dire effects on performance and the fact that mnay of them actually are proven to give less protection than many of the free offerings.

Wanting something else to do I have over the last couple of weeks tried applications from the top of the VB100 list. G-Data,Ikarus and TrustPort  . G-Data and Trustport had several applications , each of which I found to be hopeless as they bogged down my system to the point of being unusable.

Having gone back to Avast5 Free the GUI has been carrying an upgrade offer,50% discount time limited, for their new suite. So for the last few days the trial version has been running on 2 machines here and I have to say it is excellent. There is zero lag even running a browser in Sandbox mode.

This system means you can visit suspect (or even known bad sites) and your system is secure from attack and any application you are unsure of can be run in the Sandbox to check its function without it being able to execute on your machine. 

( To get the 50% upgrade discount it looks like you need to install the free version first)

[Baz]

well...here I go again,trying to get the thing running that is  .had to do a clean install so i'm in the proceeds of getting it back to how I like it so beware of lots of daft questions in the next few days 


starting with        how do I change the keyboard to english one,at the moment I cant type some symbols   the 'at' one for example types as this  "    I just cant remember how to do it 

[Rik]

Control Panel > Regional & Language options, Baz.

[Baz]

tried that but didnt see any thing connected with the keyboard.have the country correct, does it need a restart?

[Rik]

That should knock through to the keyboard as I recall it, Baz. Reboot anyway.

[DorsetBoy]

Which version of Windows Baz?

[pctech]

Booting into Safe Mode should stop it from loading as chances are its added a registry key to start itself as a system service.

[Baz]

XP Dorset if you have any tips for me but......@@@@@@@ I found it thanks.that daft  EN symbol on the taskbar has a settings option in the menu.

[Baz]

heres a question I just remembered,after a clean install do I need to activate windies again? still using the same disc which has already been done whenever I got it,will it stop working if I dont,and how do I stop the 'activate this now...'bubble showing up

[pctech]

You will need to Baz.

[pctech]

You can activate as many times as you need, the complication can occur if you change something such as your CPU as the hardware hash changes.

[Baz]

thanks   

[pctech]

NP

[Glenn]

Ramnit.a!htm -  the advice is to rebuild.

http://www.bleepingcomputer.com/forums/topic354757.html/page__p__1983863__hl__ramnit__fromsearch__1#entry1983863

[Gary]

If you activate to many times and its a retail version you may have to call in for a code to type in from what I recall.

[Rik]

Deep joy, Glenn.

[zappaDPJ]

If you activate to many times and its a retail version you may have to call in for a code to type in from what I recall.

I've actually had cause to test that out recently with a retail copy of Vista. Long story short the PC would install and then fail to see the installation as valid due to what turned out to be a hardware fault. This happened at least five times, possibly as many as ten and every time Vista would authenticate with Microsoft.

I was rather surprised at that so I'm wondering just how many times you can reinstall or if there's a different criteria i.e. hardware mapping to a signature tied to the key.

[Glenn]

If you activate to many times and its a retail version you may have to call in for a code to type in from what I recall.

If it is stored by MS, the same way as XP. Then after 6 months the records are deleted, so the codes will work again, without need to contact MS.