*sigh* malicious script problem (1 Viewer)

[iambored]

there was a pop up from the virus checker saying that the computer was trying to access a dangerous site, i clicked block

the next popup said there was a malicious script, what did i want to do? i clicked something like remove or block

then i started getting popups and screens closing and freezing so i restarted the computer

i started the net and the homepage had changed. i ran ad aware and removed the crap. the homepage was fine for about 30 secs when it changed again. i got more popups.

i disconnected the net and i ran the virus checker and it identified and fixed 3 problems. at the same time i ran ad aware and deleted the crap (3 things) again.

the homepage was fine for 30 secs, then it went back to the problem one. i ran and deleted crap on adaware again. it has come back!!

why does it keep coming back and what can i do?
thanks

 

[sunny]

This website you went to hijacked your brower! Use a less hackable browser like Firefox.

Did you update Adaware (the SE version, not the old version 6) before running it? If it still fails after updating, try HijackThis (example [thread=68872]here[/thread])

 

[iambored]

thanks sunny, i will update it now. i clicked for updates but it said there were none available but i have ad aware 6
(i was wondering why there haven't been updates for a long time!)

i also got a pop up ballon thing from near the clock just then saying that there was a security problem and then what did i want to do, i clicked block. then a screen popped up as if i wanted to download something and i clicked cancel.

it's pointless if when i click block the checker doesn't block anything

edit, this sucks, i need someone computer able in my house, my head hurts, without this site i would have absolutely no idea

 

[sunny]

thanks sunny, i will update it now. i clicked for updates but it said there were none available but i have ad aware 6

Adaware 6 is long outdated, and there haven't been updates for it for some time now. Upgrade to the free SE version.

 

[iambored]

i loaded it and scanned the computer. it found about 60 things and i deleted them but 2 wouldn't work because IE browsers were open. i ran it again and it found 20 things and i deleted them. i changed my homepage, disconnected from the net and ran it again and it was taking too long so after it found 1 thing i cancelled to see what it was. i deleted it and ran it again and stopped when it found 1 thing. it had found the same thing!

details:
obj: (a grey square with a red exclamation mark)
vendor: VX2
type: process
category: malware
object: C:\windows\mfcwz32.exe

i just deleted it again and i am in the process of doing a full scan on adaware. my virus checker's scan is probably about half way through and this time has not found anything

edit 10:50 : virus checker has still not found anything, ad aware found 25 things, a lot from CoolWebSearch, a possible browser hijack attempt and a few from VX2. i will delete them and the 44 negligable objects now.

 

[sunny]

I have seen several computers infected with this one. Its very very persistent at what it does. A quick search turned up this detailed solution:
http://www.short-media.com/forum/printthread.php?t=18846

 

[iambored]

thanks sunny!!! the instructions were fantastic!!!

 

[theone123]

this is causing the faults

 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = 
res://C:\WINNT\zxzgr.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = 
res://C:\WINNT\zxzgr.dll/sp.html#12802
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://zxzgr.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
res://zxzgr.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
res://C:\WINNT\zxzgr.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = 
res://C:\WINNT\zxzgr.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
res://C:\WINNT\zxzgr.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://zxzgr.dll/index.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
res://C:\WINNT\zxzgr.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
res://C:\WINNT\zxzgr.dll/sp.html#12802