|
|
|
|
Home » Spyware Protection »
|
|
|
4-counter.com 3721
 View Page
 Show all comments |  Post your comment
It is now 2005.... so I hope people do still look at this forum. I am in China and I guess that is why i have helper.dll trojan. which uses helper.dll and rundll.exe to choke my system resources. I have deleted entries in the registry, used msconfig, CWSshredder, AD-Aware. I seems to disappear for a while, but the ten suddenly I have a heap of files (dll and .dat) from 3721 sitting in my temporary internet folder. This is the way it does it and then msconfig is populated again with helper.dll and I have run Rundll.exe running. helper.dll is is one of them. Also /system32 folder is populated with a file that seems to have a different name everytime helper.dll starts. I need to find the original file ... does anybody the name of the original 3721 file. Then the trojan can be gone. I ALSO FEEL LIKE WRITING A VIRUS THAT BRINGS DOWN WWW.3721.COM ...
Waza
1/12/2005 6:08:54 PM - CN
|  reply
I have got the same internet address everytime I re-start the computer and run the Explorer, I am also directed to this search engine "http://69.31.79.101" It will not go away, and places pages under the favourites tab
I see I am notr the onlyone with the problem, if anyone has found how to fix it, please let me know??
Anonymous
11/15/2004 6:38:27 AM - UK
| reply
我可以查找一个网友吗
3721
10/13/2004 8:30:16 PM - CN
| reply
How to remove "helper" key from the registry? Can you show us the steps?
jchan
7/31/2004 4:47:23 AM - US
| reply
I have tried just about anything, running spybot, ad-aware.. etc, bit nothing seems to work, even re-installing explorer, I still get the same paage whenever I reboot. I have searched every possible website that i could find, with no luck, I wonder if anyone has had any success removing this page so far.
I am not sure how many people might have the same proble, but I would sincerely appreciate any help. Anyone with any ideas?
thanks,
Ed
Ed
7/1/2004 12:30:20 AM - US
| reply
bonfim
bonfim filho
6/29/2004 4:05:29 AM - BR
| reply
There maybe a spyware on your pc. Try using spybot search and destroy
Leyan
6/28/2004 10:53:23 AM - PH
| reply
I have got the same internet address everytime I re-start the computer and run the Explorer, I am also directed to this search engine "http://69.31.79.101" It will not go away, and places pages under the favourites tab
I see I am notr the onlyone with the problem, if anyone has found how to fix it, please let me know??
Ed
6/25/2004 10:48:14 PM - US
| reply
I´ve downloaded "ResetRun" and that had no effect, I opend the hosts file with notepad and didn´t see eather of the auto.search.msn.com lines. Any other sugjestions?
josh
Anonymous
6/4/2004 1:51:54 AM - US
| reply
Try to check your hosts file.
Open it with Notepad and at the end of the file you will have few lines:
69.31.79.101 auto.search.msn.com
69.31.79.101 auto.search.msn.com
Delete them.
Run Hijackthis and check all entries containing 69.31.79.101, then click on Fix checked
Sameproblem
6/4/2004 12:04:16 AM - US
| reply
Hi Josh,
See if this 431483.page can help.
Peter Tong
6/3/2004 9:03:02 AM - SG
| reply
I have the 4 counter and I´m running win. 2000
i can not compleat step one on your prossess because i do not see any of the names given on my task maneger Processes page. Also when i got to the command propt step the get the loadliberty(/u) failed.
I also don´t see the helps to remove from the regetstery.
all help is welcome
josh
6/3/2004 2:26:23 AM - US
| reply
To Tom who is running Win98SE and using its crappy task manager, there are aftermarket task managers (usually arounbd US$20 or so that work more like the W2K task manager and allow you to see processes, etc. I am using TaskInfo2003 (www.iarsn.com) written by a Russian guy. It will tell you more about what´s going on in your computer than you will care to know as well as giving you the ability to explore and cancel the processes on your system. I think I found out about it by doing a Google for "Win98 Task Manager" and getting shuttled over to some web site about "windows Annoyances" or something like that. Good luck.
Bill
5/30/2004 1:04:22 AM - US
| reply
I recently had the 4-counter.com spyware on my computer and got cwshredder to remove it. I also ran hijackthis and that worked as well.. Unfortunatley, along with it, another spyware program is running that I cant get rid of. The home page of IE will always pointt to http://69.31.79.101/index.html. Ive used hijack this to remove it but once i restart the computer, it returns. Can anyone offer any suggestions?
glen
5/24/2004 7:31:40 PM - US
| reply
Hey, I have this 4 counter crap on my computer and quite frankly its really pissing me off!. Your procedure is the only one I can find, however im on Win 98 SE and I cant end the processes, could you tell me how? Also the DOS commands I followed give me an error, "LoadLibary" something or other.. Could you guide me EXACTLY how to do it on Win 98 SE like you would a child?. I really need your help!. Thanks in advance, Hope to hear!.
Tom
Tom
5/22/2004 4:37:11 AM - UK
| reply
Hi JS,
Sorry about that! This page was posted base on my field notes recorded as I was removing the SPYWare that was on one of my customer´s computer. I have updated the page, hope this will give you some ideas how to remove it. I must say here that this is one of the more difficult program to remove. Good luck.
Peter Tong
5/5/2004 9:41:34 PM - SG
| reply
Your Procedure is a bit confusing I got this virus on my computer and what are you supossed to do to C;\winxp\system32\rundll32.exe? and the other commands in step 1 above??? JS
Anonymous
5/5/2004 9:06:54 PM - US
| reply
|
|
|
|
|
 Mail this page
|
|
|
|
|
|
