Can't change script in HTML

[Bill Lane]

Hi All:

Can't figure out what's going on, all of a sudden I can't rewrite any script in any stationery.

Notpad and Writepad both work just fine.

If I delete a line of script and click save, then reopen the source again, the script still has the line that I deleted.

Any thoughts on this problem will be very much appreciated.

And thanks ahead of time,

Bill Lane

OS: Win98 with all updater, IE 5.5

[EzyStvy]

I recently fought a Trojan that would do that in the registry. Could type something – save it – hit the F5 refresh key and it would revert back.

Do Ctrl-Alt-Del and see if you have Sservice and or Fservice listed.


Have you recently made any changes to you IE security settings? New anti virus checker? New firewall?

[GaryRouth]

[ . . . just in case it's the trojan the EvyStvy mentioned, here's the info & removal link over at Symantec http://securityresponse.symantec.com...or.prorat.html . . .]

[EzyStvy]

(prorate - that's the little sucker that I've been trying to forget)

[Bill Lane]

Hi All:

Well I didn't have those Fservice or Sservice.

I went to PC Pitstop and ran a test on my pc, it came up with "Briss A , Downloader.GK, and Startpage.EO viruses.

I ran McAfee with the latested Dat file installed, but it didn't find even one virus. (Version 5.21)

The test at PC Pitstop told me that I needed to defrag C:,
but I can't do that either now, I get an error telling me to run Scandisk, I did a throrough with the fix problems checked, but it didn't find any errors.

PC Pitstop had a program to force Defrag to work, but it still wouldn't defrag.

Anyway, it looks like I might have to bite the bullet and format C:, and reinstall everything, unless you have a thought or two on this matter :-)

It says that the Briss.A virus is in the jao.dll, Downloader.GK is in polmx.exe, and Startpage.EO is in olehelp.exe, but when I ran SFC none of those dll or exe exist.

I also ran Find Files, no luck.

Bill Lane

[GaryRouth]

All three of those are truly nasty bugs. On the webpage for the downloader.gk over at Panda, they also have a link to their online scanner - which should have a chance of removing it, and possibly the other two as well.
http://www.pandasoftware.com/virus_i...&idvirus=48242

McAffee mentions that both the latest scan engine as well as the latest definitions were necessary to remove the Bliss keylogger. If you haven't tried updating the scan engine, you could try that, and let McAffee have another go at it. For some viruses, it's best to try the scan from Safe Mode, too, which can prevent the little buggers from loading in at startup.

This last month has just been a Security nightmare. On June 29 another keylogger was found that installs itself via pop-ups & sneaks it's install through yet another IE Helper Object hole. [If you want to read more about that one, they still have the article posted over a Cnet: http://news.com.com/Pop-up+program+r...tml?tag=st.pop

Set your Security settings to "High" at the very least, until MS can get a patch out for this one. Several folks around the lab here are switching to Mozilla or Opera -- and some say they aren't considering going back to IE until a hot place freezes over.

Best of luck
. . . Gary

[kram 2.0]

I would go to Panda ActiveScan and run the online antivirus - I have done that on ocassion, and it has caught many things. I'm most concerned about the downloader.gk viri/trojan. It's rated with pretty high damage and wildness. The PandaActiveScan won't remove that, as testimonied by other people, but it will redetect it, but in hopes of removing Bliss A.

I would also do the following - boot up in safe mode, and install AVG, UPDATE it, and run it. Then install Adaware and Spybot Search and Destroy - they should get rid of the things connected to the downloader.gk and the other viri, but not actually remove it. You may get something with AVG, though.



Hope that helps,
kram

[Bill Lane]

Thanks Guys:

I removed my old McAfee 5.21 and installed 6.01, but it didn't find any viruses either.

So I'm off to the web sites that you posted, and I'll see if I can follow your instructions.

I will try it in Safe Mode.

Thanks again,

Bill Lane

[Bill Lane]

Hi Again:

Well the Panda site was a big help! I had to go back three times to make sure the viruses were disinfected, but on the third trip, no viruses were found.

I ran a repair of IE 5.5, went to Windows Update site and downloaded the latest critical updates.

Ran Regclean, Sptbot, and Adware, corrected a few problems there.

But Defrag still won't work, I still get the error message that drive C: needs to be repaired, I ran Scandisk, but no problems were found.

Also my start page won't stay, I have to enter it manually ...
http://www.earthlink.net/start, it's always is set to Use Blank and takes me to another page.

In the CTRL + ALT + DEL I now have a new listing ...
Rulaunch , anybody know what this is?

Also in my traveles today one of the sites told me to block vbs, bat, exe, pif and scr in my Outlook Express e-mail, I can't find out how to do it, let me know if I should do this and how if you know.

Thanks again,

Bill Lane

P.S. I ran McAfee in the Safe Mode, but it didn't find any viruses.

And I still can't change any script in any of my stationery.

[GaryRouth]

Here's the answersthatwork.com's blurb for Rulaunch:
____________________________
Background task installed by McAfee VirusScan 6.x and which automatically downloads antivirus updates whenever you connect to the Internet.

Recommendation :
There are so many problems with McAfee VirusScan v6.x that the last thing you want is a VirusScan background task doing badly in the background what you can do manually yourself. RULAUNCH often crashes or fails, or is it fails and crashes ?!!! Even if you have not experienced a problem with RULAUNCH, we suggest you disable it and simply manually update VirusScan 6.x To disable RULAUNCH : start VirusScan. Then "Pick a Task \ Change my VirusScan settings \ Configure Instant Updater \ Configure Automatic Updates \ Manual Update".
=========================

Boy, I guess they don't like that version of McAfee! But with the virus climate lately, I think any automatic virus updating might be a good thing [of course, if it doesn't crash the computer, that is]
_____________

I don't use Outlook Express, but I imagine the extension blocking would be in the menus somewhere. I don't know how recent McAfee 6 is, but most recent antivirus progs will scan your e-mail [though this often requires some configuring on your part, to let it know what accounts to scan from what mail client]...
______________

You know, if you have a good set of backups, since the cleaning is dragging on, and since there still seems to be a possibility of some spyware still sneaking back in - it just might be safer and just as fast to zero-write the baddies out of existence, scan your write-protected backups like crazy with antivirus/antispyware, reformat, reinstall, and then restore your data.

Are you on dialup or broadband? If you are on broadband, it's nice to be behind a NAT/SPI hardware firewall (to help keep the badguys on the Internet from breaking in) and a software firewall like ZoneAlarm (to let you know if spyware has slipped through and is trying to dial out with your data), and an antivirus that can scan your email and instant messages as well.
________________
It's a bit late here, & my mind's getting rather groggy, so I'll check back later on & see what questions I didn't answer yet, and how you're doing . . .
. . . Gary

[p.s. the DeFrag doesn't work even in Safe Mode after ScanDisk has repaired things?]

[Bill Lane]

Hi All:

Well I have another problem now, McAfee detects the klohl.dll as being infected, the notification pops up with every move I make, and McAfee can't delete it, and I can't delete it.

How am I going to get rid of it?

Also I was able to run Defrag in Safe Mode.

I use Microsoft's back up, I did a back up and overwrote all files, that seemed to help.

My last virus check today at Panda's web site found no viruses.

This is the first time McAfee ever found anything (klohl.dll).

Sure hope you have a thought on this klohl.dll problem, and is this dll part of the original Microsoft Win98 program?

Thank again,

Bill Lane

P.S. I'm running ZoneAlarm, the free version.

[Bill Lane]

Hi Again:

Well I have no idea what's going on, the klohl.dll has disappeared from C:/Windows/System, and it's not being dected by McAfee anymore, I guess that maybe because I kept clicking the McAfee Delete button,it finally worked?

But now I can't set my home page, which was my original problem, before I was able to type it in in the Internet Properties, but now it's set to "About Blank" and grayed out.

And if I go on line I get a blank page, and when I click Tools, Internet Options I get the following message ...

Restrictions: This operation has been canceled due to restrictions in effect on this computer, Contact your system administrator.

I'm the administrator, but I don't know how to lift the restriction.

Any help will be very much appreciated !!!

Bill Lane

[GaryRouth]

Hi again Bill

For the problem with your grayed-out Internet Options, and administrator messages, here's a blurb from the Spybot FAQs pages:
__________________________
"I can't access my IE settings any more!

Internet Explorer tells you to contact your administrator when you try to access the IE settings?
This can happen if you use Spybot-S&D in advanced mode and you have used the Immunize feature without reading all the text

Please start Spybot-S&D again in advanced mode (usually from the Start menu group Spybot - Search & Destroy, until you've already changed the desktop icon to advanced mode), select Tools in the left bar -> IE tweaks.
There you'll see a group Recommended miscellaneous locks. Untick the checkboxes in front of both Lock IE... options. You may need to close all Explorer windows, and maybe even restart Windows before these changes take place.

Hint: this lock function has been added mostly for multi-user environments where you wouldn't want other users of your computer to change your IE settings. If you are the only user of your computer, there's no real need to enable them."

_____________________________________

It's possible that after making the changes recommended by our spybot friends and rebooting, you'll also regain the ability to set your home page to your liking.

You could well have had a witches brew of browser hijackers, trojan horse programs, and viruses all making a mess of your online experience - and in the process of cleaning them up, you hit a little bump in the road.

Hopefully all the devils are exorcised - but I imagine you'll want to track down the identity of every entry in your "Software Environment/Startup" list in System Information [the right-hand pane will list where each executable is called from - a nice feature ---> and Google is handy for tracking down the identitiy of the programs (usually you get quick links to the AnswersThatWork and Pacs-Portal processes lists) ]

[. . . if you haven't used System Information before, on most Win9x systems it's in the Start Menus: Start/Programs/Accessories/System Tools/System Information]

Can you check your McAfee logs & double-check the spelling of that klohl.dll? Either it's a phony file with a randomly created name, or it's misspelled. I couldn't find a search engine with anything that matched (even with a few guessed misspellings). Hopefully, if it was a random virus-generated file, it was deleted. Might empty your ReCycle Bin and Internet Temporary Files just to make sure a copy isn't lurking in there.

I highly recommend the Internet Options setting - under the "Security" section - "Empty Temporary Internet Files when browser is closed".
________________________

Did the problem with the stationary get fixed along the way?

. . . Gary

[Bill Lane]

Hi Gary:

That klohl.dll disappeared.

Yesterday I went to Trend Micro and ran their virus test, it found 4 trojans... blazefind.a, istbar.dw, alchemic.a, and dyfuca.bx, it was able to delete the first three, but left the dyfuca.bx which was in C:/Windows/nem216.dll.

I couldn't delete that dll because it said that Windows was using it. I tried to delete it in safe mode also, no luck.

But I learned something, I opened Notepad and wrote nem216.dll, and saved it to My Documents as nem216.dll, went to Start/Run and ran SFC and replaced the one in Windows with my phony dll, it worked, I was able to delete it, no more nem216.dll in C:Windows.

Thanks for the info on Spybot, I'll try that now.

"Empty Temporary Internet Files when browser is closed", I have it set this way.

Thanks again,

Bill Lane

[fudtone]

I think you need to look at how you are getting all of these...


Do you have a good firewall? Run the AV at startup and leave it on?

AVG is a good free antivirus you may want to use it.

[Bill Lane]

Thanks fudtone:

I'll check it out.

Gary your instructions said "select Tools in the left bar -> IE tweaks"

I select tools but I don't have the IE tweaks.

I checked Spybot for updates, but there are no new updates.

Thanks,

Bill Lane

[GaryRouth]

Hi again

It looks like the help file in my earlier post was for an earlier version of SpyBot. Here's what the 2nd paragraph "should have" read for the latest version of SpyBot (which is the one you most likely have, since you've been keeping it up-to-date)
============================
"Please start Spybot-S&D again in advanced mode (usually from the Start menu group Spybot - Search &D Destroy, until you've already changed the desktop icon to advanced mode), and go to the Immunize page.
There you'll see a group Recommended miscellaneous options. Untick the checkboxes in front of both Lock IE... options. You may need to close all Explorer windows, and maybe even restart Windows before these changes take place."
===========================

So, if you start SpyBot at the usual "Spybot - S&D" tabbed screen, on the left-hand side you'll see the icons for "Search & Destroy", "Recovery", and "Immunize". The lock options are at the bottom of the Immunize screen.

See if that does it.
. . . Gary

[p.s. ...you can unlock things long enough to make the changes you want, and then lock it up tight again - and let SpyBot keep the known hijackers out of your IE settings]

[Bill Lane]

Hi Gary:

That did the trick :-) , after I set my home page, I locked it back up.

I went to Panda's virus checker page, no viruses found.

I went to Trend Micro's virus checker page, and it found the Troj. DYFUCA.BX , I deleted it there.

I'll check back there tomorrow to see if it comes back again.

Also I can now rewrite script in my stationery :-)

Sure want to thank everybody for all the help, it's really appreciared !

I may have another problem, I sent a friend of mine three e-mails today, they never received them, and I received a notification that they were undeliverable with an attachment that ended with .dat. I deleted them immediately.

I should have save one so I could be more specific.

I sent them an e-mail a few minutes ago, and it didn't come back, but at this time of night (their time 3AM FL ) their computer is off line.

That .dat attachment scared me, and I'm wondering if their computer is sending out viruses.

Anyway, I'll make a new post tomorrow if I receive any returned mail with that attachment.

Thanks again,

Bill Lane

[GaryRouth]

Here's some info on the .dat extension, RichTextFormat (RTF) email sent for OutLook, and how to change the setting if it gets to be a problem: http://www.incredimail.com/english/f...il_attach.html

It's possible that the problem with the emails to your friend had nothing to do with your computer or his - but with his email provider either having some trouble or doing maintenance. Or of course if he changed his email address!

It's also possible, if he uses a "freemail" account (like Microsoft's Hotmail), that he has exceeded his alotted space [he's got waaay toooo much spam clogging his account] and you'll be able to send your mail as soon as he clears up some of the old mail [need more room in that old closet, so to speak]

Glad that HouseCall was able to kill that last trojan. Doesn't seem like your McAfee is very active - is it set to scan all your email? If you use Instant Messaging, see if you can set up your AV to scan that, too. The virus/trojan writers are getting sneakier every day.
. . . Gary

[Bill Lane]

Hi Gary:

Thanks again for the information !

Everything looks good today, but I'm going to keep a closer watch on things from now on.

My McAfee is set to check e-mail too.

Thanks again,

Bill Lane