topic Re: Corrupted Internet Browser in PCs & Accessories

Corrupted Internet Browser

gyron1 — Wed, 11 Jul 2007 21:15:47 GMT

Hi Gents,
I guess I am in some fairly serious trouble with my internet set up (IE6). I was searching for various items connected with my work on internet yesterday and somehow picked up a varirty of undesirables. These take the form of www.virusprotectpro.com which has installed itself on the task bar and elsewhere which I cannot seem to get rid of and continually tells me I have worms etc with pop ups every 30 secs or so (presumably wants me to purchase their software. Also something called www.viruslocker and www.entertainforever.com (which auto boots when I sign on), - none of which I can get rid of. I also get error messages of the type 'iesmn.exe-DLL Initialisation failed'. Finally, should I have something called ActiveX Access which seems to be rearing its head.
I have done a full system virus etc scan using the Symantec (Norton) Anti Virus software which shows my system to be clean.
At this point in time I cannot even log onto my 'Google' home page!! (using my wifes computer to send this message).
Is there any way I can clean up my internet browser and start over afresh, prefrably retaining my favorites?
Apologies for longish post but in real trouble here.
Gyron

Re: Corrupted Internet Browser

@5528097000005097 — Wed, 11 Jul 2007 22:25:28 GMT

Hi Gyron

You probably unknowingly picked up these bugs by allowing a dodgy activeX application to run on your browser.
Will your browser load any pages at all? If so, run an online scan at Housecall, it's pretty good at finding and eliminating problems or advising you on appropriate steps to take to solve problems.
After scanning, reboot and repeat...keep doing this until it declares your system clean.
Good luck, hope this helps

Re: Corrupted Internet Browser

Blencogo — Wed, 11 Jul 2007 22:59:35 GMT

This is installed via the Zlob Trojan which imitates a video or audio codec - the site says that this codec is needed to see video or hear audio on the site..

There is an automatic removal tool here: -

http://www.bleepingcomputer.com/forums/topic98219.html

or if you prefer: -

http://www.remove-virusprotectpro.com/

The automatic removers are much easier than the manual method but do need a working internet connection.

Good luck!!!

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 07:29:33 GMT

Thank you both (Redstring and Blencogo) for your help/advice. Very strange that it is the 'viusprotectpro' software that has somehow auto installed itself. I am not quite sure what you are saying here Blencogo, are you suggesting that the 'remove-virusprotectpro' software actually removes the 'virusprotectpro' software or that 'remove-virusprotectpro' itself gets rid of root cause of problems discussed?.
Thank you for help.
Gyron

Re: Corrupted Internet Browser

Blencogo — Thu, 12 Jul 2007 08:36:42 GMT

Hi gyron,

The two different automatic removal programs in the two links will remove Virusprotectpro and the malware that is causing all the false security alerts.

This whole exercise is to try to get you to buy the full version of Virusprotectpro and is clearly extortion and completely illegal. Under no circumstances should you buy it.

If you have a working internet connection, run the automatic fix - if not you will have to make the manual repairs.

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 09:53:30 GMT

Hi Blencogo,

Thanks for that, I will have a go now.
Yes, I thought the auto 'plant' of viusprotectpro was a 'sprat to catch etc'! I wonder how these things manage to get past the Firewall - I guess nothing is perfect in this world! I was reading somewhere on the MS site last night that some of the 'rogue' software is clever enough to lower the Firewall security settings and that one should periodically reset the Firewall settings to default values (don't know how true this is).
Thanks again, will let you know how I get on.
Gyron

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 11:08:58 GMT

Hi Blencogo,
A quick question for verification please.
I have visited the 'http://www.remove-virusprotectpro.com' site and clicked on the removal tool, whereupon some software called 'SpyNoMore' downloads and checks my system for 'bugs' - it found something like 39 Trojans, Spyware etc etc. You then gt pompted to remove all that it has found BUT cannot remove until you buy & register for software at a cost of £20.89. Is this another hoax or are you sugesting that I purchase the software? Its no great deal if I have to buy, but after all that is going on and everyone (advert prompts) suggesting I purchase their software I am very suspicious!
Finally, if you are suggesting that I purchase software, will it 'corrupt' the Symantec software?
Appreciate your response to this please.
Thanks again,
Gyron

Re: Corrupted Internet Browser

Blencogo — Thu, 12 Jul 2007 11:24:16 GMT

Hi Gyron,

No don't buy anything.

I would try the automated fix or the manual fix in the other link @ bleeping computer.

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 12:20:00 GMT

OK, will give other link a try. Thanks.
Gyron

Re: Corrupted Internet Browser

kee-lo_ — Thu, 12 Jul 2007 12:28:23 GMT

Please do not buy anything from this website, it's extoriton and as Blencogo's said is illegal.

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 14:20:48 GMT

Hi Kee-Lo,
OK,
Gyron

Re: Corrupted Internet Browser

@5528097000005097 — Thu, 12 Jul 2007 14:58:29 GMT

You might want to think about changing your security software too.

There are many options and many different opinions on which is best, all my security programmes are freebies and, touch wood, I haven't had anything nasty up to now, just a few cookies which are easily sorted.

Check out this thread for loads of free security and other software.

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 15:55:52 GMT

Hi Blencogo,
It's me again, sorry to be a pain!
I have tried to take the http://www.bleepingcomputer.com/forums/topic98219.html route as suggested.
All fine, downloaded the SmitfraudFix.exe software onto desktop as directed. Following the instructions, started computer in 'Safe Mode' but when selected I got the follwing message;

multi(0)disk(0)partition1\Windows\System32\ntoskrnl.exe
Windows could not start because the following file is missing or corrupt:
\system 32\ntoskrnl.exe.
Please re-install a copy of the obove file.

Where do I find this file please?

Thanks again,
Gyron

Re: Corrupted Internet Browser

Blencogo — Thu, 12 Jul 2007 17:30:10 GMT

What did you select just before the message came up?

Whatever it was - it is looking for your Windows installation on Partition 1. As you have a Vaio, the Recovery Partition is on Partition 1 and YOUR Windows installation is on Partition 2. So it is looking in the wrong place and can't find the boot files.

Was this after you clicked on SmitfraudFix.exe?

Re: Corrupted Internet Browser

Thalamus. — Thu, 12 Jul 2007 21:38:09 GMT

Hi Gyron,

If the solution Blencogo supplied does not clear virusprotectpro, then try the solution provided by Symantec ..

If that does not work either post back and we try something else..

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 23:12:18 GMT

Hi Blencogo,
Thanks for reply, apologies, had to go out.
OK, I restarted the computer and before windows started pressed F8. This brought up an option screen and I selected 'Safe' mode - the message I sent previously then came up. That's all I did. I didn't click on the 'SmitfraudFix.Exe' icon (on the desktop as instructed) 'cos had not got to that stage in sequence.
I will try again tomorrow morning and see if same thing happens.
Re. your comment about my recovery partition being on Partion 1, my computer is a Vaio PCG-Z1SP and has two 'partitions, Drive C & D. My recovery 'discs are in fact on CD's which came with the computer, they are not pre-installed. However, as far as I know, all my programs etc are on Drive C and Drive D was effectively empty, so thats where I keep all my work information etc. My Documents files etc are all kept on the C drive alongside the Programs.
Thanks for continuing help,
Gyron

Re: Corrupted Internet Browser

gyron1 — Thu, 12 Jul 2007 23:16:53 GMT

Hi Thalamus,
Thanks for joining in on this mess of mine! Will keep your suggestion in mind and let you know how I get on.
What I find strange though is that I have the Symantec (Norton) Firewall & Antivirus protection software already installed - I wonder why it didn't protect me!
Gyron

Re: Corrupted Internet Browser

gyron1 — Fri, 13 Jul 2007 14:48:13 GMT

Hi Blencogo (& Thalamus),
Tried the SmitfraudFix.exe again today, which requires starting in safe mode - no problems this time (don't know what happened ysterday), and used the SmitfraudFix.exe software which seems to have fixed the VirusProtecPro problem. I now seem to be able to use internet without any glitches, pop-ups and adware etc.
I am left with a problem with the Symantec software (Anti Virus/Firewall) which I will leave Symantec to sort out.
Only other thing is a dreadfully slow Boot-Up (around 5/6 minutes) which I will have to fix somehow.
Anyway, thank you so very much for all your help and advice, this is greatly appreciated.
Gyron

Re: Corrupted Internet Browser

Thalamus. — Fri, 13 Jul 2007 16:13:46 GMT

Hi Gyron,

I'm glad Blencogo's solution came good in the end..

Re: Corrupted Internet Browser

Blencogo — Fri, 13 Jul 2007 16:27:35 GMT

Hi gyron,

Glad you've got rid of those nasties!!!!

Only other thing is a dreadfully slow Boot-Up (around 5/6 minutes) which I will have to fix somehow.

It is possible that all sorts of debris have been left in the Registry. Do you have a Registry Cleaner you can use?

If not, download the free (for 30 days) trial version of Tune Up Utilties and run the Registry Cleaner and Optimiser.