I somehow managed to get a freaking trojan on my computer, likely due to the nes rom searching I was doing. Of course, I leave the computer on overnight, with minimal protection. (puny norton and microsoft antispyware)
This thing downloaded everything possible to ruin my bloody computer. Adware,spyware,around 70 more trojans, keyloggers, etc.
I'm still dealing with this shit. My mom won't let me format the computer because she doesn't want her stuff deleted, so I have to get rid of this crap manually.
Blah Blah, I'm running some normal stuff (avast, adaware, crap like that). Avast found over 150 viruses, and adaware finds around 700 pieces of spyware/adware.
Deleted.
Kay. I leave the computer on for a bit with an active internet connection, to test it. Suprise. Half of this crap comes back. So Now I'm running more things, and sifting through the autorun areas (alot of them, half the crap is deep in the system directories.. Fun.) in the registry.
It isn't fucking worth my time. Whoever came up with this shit needs to die.
lol
Don't use Internet Explorer. Ever.
I know. The one time I use it and it screws me. Fun.
i've found an adaware and spybot combination to be the best first-line defense in combination with active and auto-updated memory-resident virus shield. anything that isn't handled by these tools can be removed with hijackthis.
alternate method: i've also gotten rid of this stuff by sifting through the active running applications and tracing the stuff to its roots in the various start-up folders (there are at least two in 98SE), system folders and registry. it's a PITA, but you can eventually recover this way and wind up feeling like a clever detective to boot.
firewall and HOST files are also heavily recommended in the first-line defense group, altho they won't help you now that you're already infected.
Where'd you go look for nes roms? Weird places you must've looked at..
Regedit, cleans the registry so get it if you can. Spysweeper does a nice job of deleteing spywares as well.
Good luck.
I've gotten rid of about everything now. The problem is this "nrpl.exe" running on windows start up. Gone through the registry, files, it keeps coming back. Nothing detects it either. Is there anything I can do to have this process restricted from opening, period?
Quotei've found an adaware and spybot combination to be the best first-line defense in combination with active and auto-updated memory-resident virus shield. anything that isn't handled by these tools can be removed with hijackthis.
alternate method: i've also gotten rid of this stuff by sifting through the active running applications and tracing the stuff to its roots in the various start-up folders (there are at least two in 98SE), system folders and registry. it's a PITA, but you can eventually recover this way and wind up feeling like a clever detective to boot.
firewall and HOST files are also heavily recommended in the first-line defense group, altho they won't help you now that you're already infected.
I have all of that. The problem is that the infection had progressed so far it's becoming impossible to get rid of totally.
You can try and editing your "msconifg."
Click Start --> Run --> Type msconfig.
Then click on "selective startup." --> Unclick loadup startup programs. --> Apply and restart.
Hope it helps.
I just recently got raped up the ass by a fucking Trojan... -_-
Ran and scanned with everything I got, and a bunch of stuff I downloaded just to try, I'm still not sure if it's completely gone. At times everything seems back to normal, and I haven't run into any serious problems since... but fuck if I don't get a feeling that some shit is happening in the background on me.
I agree, "Whoever came up with this shit needs to die."
I know that a process called 'ru.exe' on start up spawns 'nrpl.exe' and then closes 'ru.exe'. This is the last problem I'm having. I've deleted everything that nrpl and ru use to do crap (They are both absolutely harmless now, besides sucking 5 megs off my ram.), I just can't seem to get rid of them.
Try:
1) Updating all of your diagnostic, firewall, anti spyware/virus programs.
2) disconnecting your cat5 ethernet cable or modem cable
3) restart windows in safe mode [minimal processes in use]
4) turn OFF system restore
5) re-run all of your diagnostic programs.
EDIT: you may also try the advanced settings in Spybot - Search and Destroy
Mode: click Advanced
click the Tools button in the bottom left corner
click System Startup
From there you should be able to see what processes are starting up with windows. You can delete any process you deem suspicious in that menu too.
If all that didnt work then...well...you are probably hosed. Convince mother to back up her files then reformat the hard drive :/
Stop dissin' on Internet Explorer.
I don't have spyware. I never get spyware.
I use this computer 24/7. I don't sleep, I don't eat.
How come I have 0 spyware?
I had an argument about this 2 days ago and some guy told me to run an adware scan. I sent him the log, the only thing adaware found was Alexa, which comes standard with internet explorer, and it's not even malware. There were of course tracking cookies.
3 weeks!
I spent those 3 weeks on this chair.. IE gave me no adware. How?
Maybe I surf smartlier than most people?
Anyway, don't blame IE for spyware, blame yourself. THX.
Holy suck. How the hell do you get viruses and crap from searching for SNES(or did you say nes) roms...maybe stupid crap like x-box roms but still you shouldnt need to leave your comp on over night for roms not like they are that friggin huge. Btw while your at it download a FF6 rom for SNES it r0x0|25 j00 b0x0|25.
QuoteStop dissin' on Internet Explorer.
I don't have spyware. I never get spyware.
I use this computer 24/7. I don't sleep, I don't eat.
How come I have 0 spyware?
I had an argument about this 2 days ago and some guy told me to run an adware scan. I sent him the log, the only thing adaware found was Alexa, which comes standard with internet explorer, and it's not even malware. There were of course tracking cookies.
3 weeks!
I spent those 3 weeks on this chair.. IE gave me no adware. How?
Maybe I surf smartlier than most people?
Anyway, don't blame IE for spyware, blame yourself. THX.
Exactly.
Seriously, I don't get spyware or virus shit through I.E. You shouldn't be going to a suspicious site in the first place. & everyone who's been in the emulation scene knows that more than 80% of the sites out there are fake.
By the way, kitty. http://www.gpemu.cjb.net (http://www.gpemu.cjb.net) is probably the best emulation site I've been to, ever. As far as I know it's still running, though that was about 3 months ago, & was the site I used for more than a year.
QuoteI have all of that. The problem is that the infection had progressed so far it's becoming impossible to get rid of totally.
you've actually tried
hijackthis? if so, it meant you submitted the diagnostic summary to a forums of helpers and assorted experts. i'd be astounded if they didn't have something constructive to say. this is what makes hijackthis so different from all the self-contained checkers out there. if you haven't tried that method yet, start here:
http://www.tomcoyote.org/hjt/ (http://www.tomcoyote.org/hjt/)
otherwise, i like blarg's suggestion. safe mode is a great place to make changes without being held back by programs or the system. disconnecting your ethernet cable at the same time is nice because it prevents any bot programs from reporting back to their master.
anyway, i tried searching on "ru.exe" and it looks like it's an adult content dialer masquerading as a quicktime component. the easiest way i've found to deal with this stuff is just to google it and see what other people (and what experts) recommend to get rid of the problem. the only time i didn't have success with this method is when i got a bot program that kept randomly-generating filenames upon bootup, in which case i had to keep quarantining and searching until i finally found the root bot program.
http://www.google.com/search?q=ru.exe&sour...:en-US:official (http://www.google.com/search?q=ru.exe&sourceid=mozilla-search&start=0&start=0&ie=utf-8&oe=utf-8&client=firefox-a&rls=org.mozilla:en-US:official)
QuoteQuoteStop dissin' on Internet Explorer.
I don't have spyware. I never get spyware.
I use this computer 24/7. I don't sleep, I don't eat.
How come I have 0 spyware?
I had an argument about this 2 days ago and some guy told me to run an adware scan. I sent him the log, the only thing adaware found was Alexa, which comes standard with internet explorer, and it's not even malware. There were of course tracking cookies.
3 weeks!
I spent those 3 weeks on this chair.. IE gave me no adware. How?
Maybe I surf smartlier than most people?
Anyway, don't blame IE for spyware, blame yourself. THX.
Exactly.
Seriously, I don't get spyware or virus shit through I.E. You shouldn't be going to a suspicious site in the first place. & everyone who's been in the emulation scene knows that more than 80% of the sites out there are fake.
By the way, kitty. http://www.gpemu.cjb.net (http://www.gpemu.cjb.net) is probably the best emulation site I've been to, ever. As far as I know it's still running, though that was about 3 months ago, & was the site I used for more than a year.
Storm got a new URL, so now its www.emugp.com. And well, the new Java download applet doesnt work for some people.
If you still have problems, HiJackThis works great. You don't have to wait for people to tell you what to delete; all you need to do is look at the file extension that HJT gives you. For example:
O4 = Global Startup: Acrobat Assistant.Ink = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
If you look at the last extention, it shows the executable file acrotray.exe. Since it is obviously from Adobe Acrobat reader, you know it is not malicious and therefore shouldn't be deleted. However, if you encounter an unfamiliar file, you should google the exact name of the file. A lot of websites give detailed information about whether the file is a threat to your computer.
I am to lazy to read what the others suggested, but the Microsoft (Yes I know) Anti Spyware is actually pretty good, both finds and removes Spyware. And its free.
Oh and it has a real time scanner for any pages with spyware :)
The solution to having specific processes like ru.exe and nrpl.exe is to first remove them from the startup in msconfig, second to do a search for those 2 files and delete them, and last but most important to do:
start --> run --> regedit
Search --> [ru.exe or nrpl.exe]
When you find an entry, delete it. Don't worry, although deleting registry entries is generally considered risky, any entries related to these 2 viruses can and should be deleted.
Hit F3 after finding an instance to continue searching through the registry. Make sure you're searching the entire registry (highlight my computer on the left), not just one branch. Keep hitting F3 until it fails to bring up any more results.
Do this for both exe's.
Lastly, you can spot persistent hidden connections to other internet sites... connections created by adware/spyware.
Start --> run --> command (click OK)
Type netstat
You'll see a list of connections. At least one of these will be to yourself, others will be to various web sites you're browing. If you see something like aaa.screensavers.org or adulthosts.com or something else that sounds fishy, then you know that you're still in trouble.
To fix this (and you should do this even if you don't see any weird connections):
Start --> find --> files or folders ... search for "hosts" without the quote. The file you're looking for is just called hosts, no extension, just hosts. It'll be in your windows folder. Rename it "hosts.txt" and open it (wordpad or notepad are fine).
You'll probably see entries to a lot of spyware/adware sites. At the top, just after
#
# [Misc Add-ons][A - Z]
you'll want to put in this line:
127.0.0.1 localhost
Which ensures the computer's localhost is defined as itself, and not some spyware site.
You can probably safely delete the other entries, although I never bothered.
Save the changes, close out of hosts.txt, and rename it back to just "hosts".
If you don't already have a process viewing application, you should get one. Processes can run in a way that hides them from task manager (ctrl+alt+delete), and to see them you need a proper viewer. Windows 95/98 users can use pview95.exe, which is part of a kit but I'm hosting it here:
http://creedo.gbgl-hq.com/pview95.exe (http://creedo.gbgl-hq.com/pview95.exe)
You can see what's running, google everything you don't recognize, and take the appropriate steps above for everything that isn't kosher.
Once you're sure you've cleaned stuff out, reboot, check the process viewer, and check startup stuff through msconfig again.
QuoteI just recently got raped up the ass by a fucking Trojan... -_-
I think you should reword that.
It just doesn't sound right.
PWNED.
I also don't see how anyone can single out IE for being the single source of spyware/adware/malware. It's all in how you computer and browser is configured.
Anyhoo, if you want any cartridge roms, there's only one site you really need (excluding GBA roms): Edge|emu (http://www.edgeemu.com) There's a lot of popups and and such, but that's what keeps the site free and they have literally THOUSANDS of roms for dozens of systems, including public domain roms, and they've been verfied by the site's owners. :):
Check out ROMshare at [url]http://gbxemu.com[url], although it's less safe since anyone can post anything they want romwise, so you need to be careful of your choices for downloading.
Oh, if you're running XP, find your prefetch folder and delete everything in there. They're just cache files that help speed up booting, but stuff can get planted in there.
Its nice that we have so many people who can help out. I came in here thinking I would suggest Hijackthis and its already been said.
Yeah, the last trojan I had destroyed my computer completely and I had to kill it.
The Ru.exe or nrpl.exe are not in the msconfig, nrpl has been terminated from the registry, but the RU.exe is the problem. I can't find it anywhere. And it just spawns nrpl and re-adds all the values and files I got rid of, then kills it's own process. Time to do some system32 directory hunting. It's my last real idea.
Edit:****. I found Ru.exe in the windows folder. I'll get rid of it, destroy nrpl, and see what happens.
Good luck. And my advice is not to download roms, or look at porn, becuase my neighbor did both, and he had to get a new computer.
Nothing wrong with downloading roms from a non retarded site, you know.
As for porn, she's a girl. Do girls look at porn? (much) I don't think so.
Its pretty much this step for me, Adaware -> Spybot Search and Destroy -> Giant AntiSpyware (not calling it MS) -> Avast -> AVS -> HiJackthis -> Reformat :)
If i'm lazy i just go to the last step and im set.