For those that use Smilie Central...

Dave, I haven't done anything about my computer yet because it's been so dang hot here. I've been outside getting myself wet and anything else I think might be thirsty. Maybe this evening, when things cool down, I'll be able to sit here and find those files, ok?

Oh, wait! Here is the location of the file that is causing all the reloading of that particular spyware.

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.dnywhipfiuzewnwgpmkzqmhe....6urTmEZ/g.html





<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>
<div class="foot">(Edited by SeptemberMorn on 09/05/04 07:26 PM.)</div>

OK, that's your regular IE file right where it should be... it is possible some spyware replaced it with its own version...

Open the folder (Program Files\Internet Explorer) and right click on the file and choose "Properties", and then let me know:

On the General tab:

<ul>[*]Filesize (the full number in parenthesis in bytes) ("Size" not "Size on disk")[*]Modified Date[/list]
And on the "Version" tab:

<ul>[*]"File Version" on top[*]Click "File Version" in the list box below and give me the full version number including everything in parenthesis.[/list]
Where did you get the information you posted, was it reported by one of the anti-spyware tools?

Which version of Windows are you using?

<hr>
Also, if you are using WindowsXP and you applired the SP2 service pack, you should have a copy of the same file in the "C:\Windows\ServicePackFiles\i386" folder... right click that one, keep the properties for both files open at the same time and compare them. If you have applied SP2 the two files should be iidentical in the parts I said to check (they could differ in "Date Accessed" or "Size on disk" or a few other things... mostly make sure the size in bytes is identical, and that the version numbers are identical.

------------------------------------
--http://www.idexter.com
<div class="foot">(Edited by dexter on 09/05/04 08:37 PM.)</div>

Ok, damnit!! My Netscape browser got hijacked now! This is what the error box says:

wwww.mklvfjefjhyohcyumodded.us could not be found. Please check the name again... blah, blah, blah

This is the iexplore info you asked for:

iexplore - Size - 91.0 KB (9993,184 bytes)
Size on disk: 92.0 KB 94,208 (something's changed!)

Created Thursday, August 29, 2002 3:00:00 AM
Modified Wednesday, August 04, 2004, 12:56:50
Accessed: Today

Version: 6.0.2900.2180 (xpsp_sp2_rtm.040803-2158)

The information I posted, I got from the one lonesome icon that is left on my desktop after I run Ad-Aware and Spybot. I right-clicked on it and got the properties.

I'm using Windows XP. Got it last year, for what that's worth.




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

That info matches mine. (You got a few extra nines in the filesize but I assume that is a typo.) And version number matches exactly.

That file is OK. If something had altered or replaced the file, the file size would surely be different.

So don't do anything with that file, that's not the problem. I'll look the other thing tomorrow.

<hr>

>>Size on disk: 92.0 KB 94,208 (something's changed!)

No, that's normal, it's the way files are stored on a hard drive.

Suppose you store milk in gallon containers. Suppose you have 3 and a half gallons of milk. The answer to "How much milk do you have?" is "3 and a half gallons". The answer to "How much space is milk taking up in your fridge?" is "4 gallons" (because that 4th container takes up a gallon of space even though it is only half full of milk)

If anyone upgraded through Windows 95 to 98 and XP they will remember an option to refomrat the drive from "FAT32" to "NTSF". That change is a different way of storing data on the drive, one of the advantages is that the files are now stored in cups instead of gallon containers so there is less wasted space. Suppose you have:
1 quart of grape juice,
1 half gallon of orange juice,
1 quart of soda,
3 1/2 gallons of milk
and 1 pint of cream...
all stored in gallon containers.

That is a total of 7 gallons of fridge space, for 4.625 gallons of liquid... more than 3 gallons of wasted fridge space.

If we switch storing everything in quart containers we now use 9 quart containers for 18.5 quarts of liquid, with only a half gallon of wasted space... 1/4 gallon wasted as opposed to more than 3 gallons wasted.

If you have tons of small files on your hard drive then a lot of your drive space is wasted. The NTFS format reduces the amount of space wasted.

Did I do my math right? If its wrong you still get the idea. You may have to replace some of my "quart to gallon" dll recipe cards in the filebox.

------------------------------------
--http://www.idexter.com

>>www.mklvfjefjhyohcyumodded.us

What exactly does the shortcut say in the properties, as file type, etc...

What I really want to know is which box in the properties has the "http://www.nonsensecrap" and which box or label says "c:\program files\..." Is that the "file location" or the "target location"?

The lines don't tell me much unless I also know the context.

Time for bed now

------------------------------------
--http://www.idexter.com

Dave,

you are awesome........I did all that and now everything is fine. What about those other two files? Do I delete them or just leave well enough alone?

Btw, thank you ever so much. {{{{{{Dave}}}}}}}}

Mary Alice

Courage is fear that has said its prayers.
Dorothy Bernard

Thanks, Tomi. I'm just overly sensitive lately I guess.

xoxoxoxox

Courage is fear that has said its prayers.
Dorothy Bernard

Do you mean the other two copies of iexplore in "servicepackfiles" and "softwaredistribution" folders?

Those copies belong there, so don't delete them. Although they are not "actively used" you can consider them backup copies.

If you find a copy in some other location that doesn't seem kosher let me know.

------------------------------------
--http://www.idexter.com

LOL I didn't check your math. It really doesn't matter 'cause I got the idea perfectly when you said my storage space changed from gallon containers to cups. ... except that I checked and double checked the numbers to make sure they were right, but I'm going to check again: this is the number I get on the Version Tab: 6.0.2900.2180 (xpsp_sp2_rtm.040803-2158) This is what I get when I click on the Product Version Item Name 6.00.2900.2180. There's an extra zero. It got past me last night.

(S-I-I-I-I-H-G-!)

PS. DUH! LOL Ok, now I see what I did wrong! You checked my math! teehee




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>
<div class="foot">(Edited by SeptemberMorn on 09/06/04 12:51 PM.)</div>

Let me look again... I might have missed that too, it might be normal...

------------------------------------
--http://www.idexter.com

Hey, yea, mine is like that too. I missed it too. No worries, your file is OK. Microsoft <sigh>.

It is like that old trick:

<center><font size=6>Paris in the
the spring</font></center>

Look and relook and never see it.

------------------------------------
--http://www.idexter.com
<div class=&amp;amp;amp;amp;amp;amp;amp;amp;quot;foot&amp;amp;amp;amp;amp;amp;amp;amp;quot;>(Edited by dexter on 09/06/04 01:02 PM.)</div>
<div class=&quot;foot&quot;>(Edited by dexter on 09/06/04 01:04 PM.)</div>
<div class="foot">(Edited by dexter on 09/06/04 01:05 PM.)</div>

LOL And we thought we were sticklers for details, eh?

This thing has my mind reeling. I'm gonna go do some housework (YUK) and maybe clear my mind a little. That's a no-brainer.




<font color=blue>"Our doubts are traitors and make us lose the good we oft might win by fearing to attempt" --Shakespeare</font color=blue>

I mean those two mvcr.........whatever files. Should they stay or go?


Courage is fear that has said its prayers.
Dorothy Bernard

Sorry, I lost track of who was moving which files.

To recap (do I have this right?) you were missing the file "MSVCRT40.dll", and you found a copy of it in a"sofwaredistribution" folder and a copy in tthe "servicepackfiles" folder. You copied one to the proper location and now everything is working again.

The other copies of the file, the one in softwaredistribution and in servicepackfile belong there, so do not delete them. Consider them backup copies.

Hey there. I'm back for now.

I don't know what I did a couple of nights ago, but that file that kept reinstalling itself hasn't done it again. It was the one that was/is on my iexplore.exe. Whatever it was I did, it was simple. Here's hoping that it stays that way.

Now the only thing I can't figure out how to do is get rid of the blank page that comes up when I go to Netscape. I've deleted all extraneous favorites and places I've visited; in other words, "managed" my bookmarks. No results. I know that you aren't familiar with Netscape so I'll just mess around a bit more and see what I can figure out. That's where I get that error box saying that some file wasn't found. It's a bunch of letters. At least I don't get re-directed to some page I don't want. All I get is a blank page but I can access the Netscape front page as well as my new Yahoo page or come directly here or to any of my bookmarks. What it boils down to really, is just "clutter."

I'm glad you explained the new stuff on this new server. I came on yesterday and said "Whooooaaaaa! Now what??" LOL It asked me to log in but wouldn't accept the active password. However, it did accept the password prior. WHEW!! Good thing I kept a record of them!

So... you can relax as far as I'm concerned.

First just go into the "options" or "tools" or "preferences" for Netscape and somewhere there should be a box to enter the URL that you want to be your "homepage" which is just the page that automatically opens when you launch the browser.

The preference for this should be pretty obvious, under general preferences or something similar, it is considered one of the basic preferences for any browser.

My guess is that you'll find some garbage page there, anyway something other than the netscape page. If that's the case, delete that URL and replace it with the Netscape URL, or you can choose any page you want, a favorite website, my website PsychCentral even (but if you do that remember that anyone else who opens your browser is going to see the PsychCentral page right off the bat.)

There might even be a "reset default" button which will reset it to the default Netscape homepage that you had before.

Sounds like you are in good shape though. Yea!

I played at what you suggest but I wasn't real serious about it when I did it. I'll go back and try again and see what I can find.

By Jove! I think I've got it! Let me log off and come back to see if it works!

Hot damn! It worked!! Yeeeeeehaaaaaaaaaaaaa!!! It was in my preferences all the time! DUH! I was looking in all the wrong, most difficult places! LOL Leave it to me! hehe

I'M HOME FREE!!!!

{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{Dave}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} smoochies!! smoochies!! hehehe

I got all excited thinking dex was back bummer...

amyway yeah, I ran my spyware after visiting smileycentral.. and that's why it won't stay on my toolbar sigh.

WOW!!! Very good thread but too many pages for me, it's very overwhelming. I can only read a few. I'll have to come back to learn more.

I use AdAware right now and like it but I don't know if it catches everything, as far as I can see it does. If I get a spam e-mail, I bounce it back so they think it is not a legit addy that they sent it to. Of course, sometimes that doesn't help when they spoof the from addy, so for them, I just delete.

What made you think that, Sky? I just really wondered who had dug this out of the archives! LOL

I didn't do it.. It was up to read somewhere and when I came in.. there was NO recent posts.. go figure. maybe someone did but deleted and that pulled it up? anyway.. I got the first page or so and saw Dexter's s/n and got all excited. sigh.

how;re ya duning?

Hmmmm... someone must have deleted their post, I guess. Weeeiiiiiird!

does anyone know how to UNINSTALL THEM?????