I also used Spybot and also Ad-aware. But honestly just when everything looks clean, Once I finally get rebooted there they are again, after a frustrating bout with the annoying MORZE5.lnk and 7UQOJH6W.lnk + others , (20 of these popup shortcut errors when I started my computer up this time), Ugh! Save me!

0

Having same thing going on here. System is looking for morze5.exe file. Looked back though norton antivirus log and noticed that last night before I noticed this problem two events occured. #1 virus name downloaded.trojan which was automatically deleted #2 suspicious script which was automatically blocked This "virus" is holding me back from connection to the net so I am in somewhat of a pickle and have to do my troubleshooting from another computer. Any ideas out there?????

0

Ok here's the deal: Do a windows search for the file that it can't find. For example, I searched for MORZE5 and I found two shortcuts linking to this nonexistant file that some trojan put on my computer. These two shortcuts were in the StartUp folder inside the Start Menu, so I would recommend opening that folder up and deleting all of the suspicious file limks in there.

0

Also, if you haven't run Ad-aware yet you should do so now.

0

I have the same problem. It started on either the 26th or 27th. After deleting the file and rebooting the computer, the files return. It took two reboots for it to return for me. It's really slowing down my computer and making it very difficult to open a website.

0

Ok, I ran Norton, & I did delete all the files in the startup menu folder and in the allusers start up menulike Matt said, (The strange named ones were found in both places) I also ran adaware before shutting down. And all seems ok when i started up the computer this time, I'll post back again if the problem continues for me.

0

ok heres the deal, what Matt did in response # 9 is a good temporary solution, it doesnt complete erase the problem, there r 2 files that continuously come back after reboot, but it will stop u from getting errors when u sign on, i still get the numerous pop-up ads when i use ie, im working on that. for a temp solution try these 2 steps 1. go to c/windows/start menu/programs/start up. delete all the related files 2. go to c/windows/all users/startup menu/programs/start up. u will find those same files there, delete them again, and be sure to empty ur recycle bin, then restart ur comp

0

the pop ups shortcut not found messages are back again.. :o(it was nice while it lasted.. I'll keep checking in hopes someone figures where these are comng from.

0

Everybody seems to be going 'round and 'round with this nasty. Try an online scan to see if it can be found/cleaned. Another thing you might try is to TEMPORARILY disable restore and then scan/clean. Sometimes a nasty will hide in restore and get put back in the registry with each startup. Housecall virus scan (free): http://housecall.antivirus.com/housecall/start_pcc.asp Panda virus scan (free) : http://www.pandasoftware.com/ Norton virus scan (free): http://securityresponse.symantec.com/ HTH. Ed in Texas.

0

I tried to update my Norton but it says that it can't read the uncompressed files and that it may be corrupt and to try and update again. It still doesn't work. I've tried to update using the links that Ed in Texas has suggested. It won't let me read the files also.

0

We picked it up today also at a music site called SoundClick.com. We are now in the process of trying to rid ourselves of it. If successful we'll post back.

0

Ok guys here it is.... 1st: Spybot Full Updates/Full Scan and Fix! 2nd: Remove all shortcuts to the files in c:\windows\start menu\programs\start up 3rd: Remove all shortcuts to the files in c:\windows\all users\startup menu\programs\start up 4th: Enter Msconfig>startup and remove all links to the files there. 5th: Reboot 6th: Run a full updated virus scan (Norton AV 2004) on your drives just to be safe. 7th: Thx ToX666 for saving the day yet again ;) If anyone had to do anything else besides what i posted here please reply.

0

I tried ToX666's soulution and it seemed to have worked. But I still have one problem. I cannot sign on to my hotmail account, Bestbuy.com, my University's email account, or play poker online. My first three lead me to www.perfectnav.com after I hit sign in. Does anyone have any solutions?

0

Thanks to Tox666 :o) So far it works for me.

0

Thanks, so far deleting those Startup files seems to have helped. Somewhere (this board?) I read that you have to get rid of a prog called Loader.exe that apparently calls or enables the numerous popups that are appearing again. However, I am unable to get rid of Loader because a message says the Administrator has forbidden this. What gives? Also, I still cannot change my homepage in IE. Any thoughts here? Thanks to everyone for good advice so far.

0

Update to my last message: I just managed to delete Loader.exe from the Start\Search window and then Emptied the Recycle Bin as usual and it looks like it's really gone - can't find it with a Search any more. So far the popups have stopped. Hope this is the end of that!

0

to tox666 how do i execute step 4? i already did steps 2 and 3, i emptied the trash can and rebooted. the problem is there are two files that come back after i reboot please help me thank you

0

nevermind i got a copy of regcleaner =) thanks for the fix tox666

0

I too have been hit with this pop up nightmare. I located bargain buddy, interstillar 180, lycos sidesearch, and more and got rid of them from the screen and removed as best I could before I started to figure out this was a bigger problem. So then I downloaded spybot and ran it. But when I went in and checked msconfig...bxxs5 was still in the startup registry. So I unchecked it. But when I rebooted..more popups and the bxxs5 is back and checked again and when I go into the registry now..there are all sorts of random number/letter.exe files in the per-user run registry and machine run registry....can I delete all these? They look just like the error message codes I got with the original morze5 error. I see a lot of people do a log before they get help but I don't know how to do that. If anyone can help a sad second grade teacher get back in business here...I'd be most thankful..one minute I was on teachernet getting weekly lesson plans...next this mess. Any help will be most appreciated.

0

Hi kari2004 nice to meet you ! Try to use any available registry cleaner, usually it resolve most of problems. ------------------ www.KeyGlobe.com - Ready sale trade board

0

Step 4: Enter MSCONFIG by clicking the start button, click run then type MSCONFIG. In MSConfig click the startup tab then uncheck all links to the files there. Good luck...Glad i could help!

0

I have had this same nasty since the 26 of March. I have done everything I could find to try to stop it. After 5 days of fighting this thing, it seemed to be gone. I turn my puter on this A.M. and it's back. I feel like tearing my hair out! I hope someone finds a cure soon!

0

Woo Hoo! almost done. I went to Trend Micro and did an online virus scan (aka HouseCall) and the scan found three TROJAN virus' TROJ REVOP.A TROJ TOMADI.A C:\WINDOWS\quo7q76e.exe and TROJ TOMADI.A C:\WINDOWS\gmny5ku1.exe HouseCall cleaned the first one for me but couldn't take off the other two. I went in my program files and deleted the quo7q76e.exe one but the other one is saying it 's being used by Windows and it won't go away! If anyone knows how to get this last little piece off please help! Thanks

0

I can't tell you how excited I was to read about this problem. I too have had the same thing now for a week. I didn't realize that this is such a major ordeal going around. I had even taken my computer to be fixed and a few days later it was all back. I followed instuctions here and so far so good. Thanks to everyone.

0

Grrr! The weird named *.lnk message windows are back again. they have names like Morze1, 3E614BVN, &c. They're all shortcuts and I found them in the C:/Windows/All Users/Start Menu/Programs folder that I cleared out yesterday. I managed to delete them again. A search for Loader.exe came up blank, but I think that was responsible for the slew of POPUPs which have now gone away, not this other problem.

0

Found this on another web forum posted by asharris: I searched for morze5.exe on google and it showed me this article first. After a while I finally figured out what it was, so I thought I would share. morze5.exe is one of the "random" names for winpup. Spybot and Adaware cannot detect winpup, because it changes its name (and adds a new registry key, etc.) each time it starts up. I don't think there exists a full list of every name it uses, but morze5, 704mgafw, oohlphnu, 1d8k66f6, xr6c7029, 030ey752, nb6glz7c, and 4e76oz4m are among them. If you open your running programs under regedit, anything that looks like a random assortment of unfamiliar numbers and letters that has the same thing listed for its name and its program shortcut (.exe) is likely to be one of the winpup copies. Winpup is a trojan adware nuisance. If you have Internet Explorer, it randomnly pops up ad windows (even if IE isn't currently in use). As far as I know, you can't take it off through any program. I had to manually uninstall it, and it took a long time. For detailed instructions on how to manually get rid of it, I recommend using Bazooka. There are sites out there that probably have good instructions also. Just look up 'winpup'. Keep in mind that it will likely take several tries before you get rid of it for good, because it has a habit of sneaking a new copy in even after you've deleted all of its source files. Or something. I'm tired. Anyway, if I can kill it, anyone can."

0

ToX666 Thanks, it seemed to have worked for me after rebooting. This step helped but I sure how to get there so I did a start seach for start up and found all the files all over again. Thanks again 4th: Enter Msconfig>startup and remove all links to the files there.

0

It does seem to come back but with only a few at a time after the initial back up. I have clean sweep and it asking if I want to tract something, just as when it first started with all of this. What's trying to install is the file regsvr32 and that can be attact by the trojan. So don't what to delete that important file? Right?I also found a few other starnge but may not be associated with this one as I may have a few...atiupdated5 and 0021-bdl94126. All the file with the regsvr32 has to do with C;\restore\achive\change.log'added ect. Can the computer be restored back a few days safely? I'm ready to just start over again.

0

Hi all, I just got rid of all those annoying pop ups, and ads. You shold try this antivirus, it's better than Norton, and detected more malwares than I did know about. http://www.emsisoft.com/en/software/download/ There's a free version. I just got finished w/ the SYSAI and BROWSER HELPER spyware, that no antivirus, nor ad aware, and spy bot couldn't got rid of, because it is alaways running, it was in a hidden folder in C:/PROGRAM FILES, and it doesn't appear if you search, cause it's hidden you have to go to tools, folder options and then click in SHOW HIDDEN FILES AND FOLDERS, so you'll see all those names MORZE1.INK in the c:/Windows/ I've deleted them all. I had a lot of trojans here,too. Today I got rid of those spywares, it's all looking clean now.

0

Hi all, again :o) I'll send to you the "report" of the only anti-virus that really helped me, I ran Norton anit-virus2003pro, and it didn't detect these torjans and viruses, it was reported after my AVG deleted over.exe, do.exe, and a _restore file infected w/ trojan. ---------------------- Warning: your machine is Infected! Click here to find out how you can cure your infections. Already an eAnthology Member? Click here to activate your account. ---------------------- Stop-Sign Threat Scanner Statistics: Files Scanned: 22566 Archives Scanned: 1488 Threats Found: 23 Threats Stopped: 0 Threats Remaining: 23 14 Virus Infection(s) Virus: Status: BackDoor.Generic.665 Infected BackDoor.Generic.665 Infected BackDoor.Generic.665 Infected BackDoor.Generic.665 Infected BackDoor.Generic.665 Infected more... 9 Possible Spyware Infection(s) Possible Spyware: Status: LivePerson Infected TribalFusion Infected QuestionMarket Infected DoubleClick Infected CustomToolbar Software Infected more... ---------------------- Click here to find out how you can cure your infections. ---------------------- Virus Scan Details: C:\WINDOWS\SYSTEM\nfraredI.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\ETPPTPN.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\MRTL.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\PSERIALD.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\OMMDLGC.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\BDCRK.exe is infected with BackDoor.Generic.665 C:\WINDOWS\bdl94126.exe is infected with Trojan.Revop C:\WINDOWS\pup.exe is infected with BackDoor.Generic.665 C:\WINDOWS\TWAINTEC.DLL is infected with Trojan.Bispy C:\WINDOWS\SYSTEM\OOLHELPT.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\sxml4am.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\UHOOKA.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\HCTRLH.exe is infected with BackDoor.Generic.665 C:\WINDOWS\SYSTEM\fpcx80nl.exe is infected with BackDoor.Generic.665 ---------------------- Possible Spyware Scan Details: Stop-Sign has found cookies belonging to LivePerson, which has been independently identified as possible Spyware cookies Stop-Sign has found cookies belonging to TribalFusion, which has been independently identified as possible Spyware cookies Stop-Sign has found cookies belonging to QuestionMarket, which has been independently identified as possible Spyware cookies Stop-Sign has found cookies belonging to DoubleClick, which has been independently identified as possible Spyware cookies Stop-Sign has found files belonging to CustomToolbar Software, which has been independently identified as Spyware, or possible Spyware Stop-Sign has found files belonging to DownloadWare, which has been independently identified as Spyware, or possible Spyware Stop-Sign has found cookies belonging to Bluestreak, which has been independently identified as possible Spyware cookies Stop-Sign has found cookies belonging to AvenueA, which has been independently identified as possible Spyware cookies Stop-Sign has found files belonging to SaveNow, which has been independently identified as Spyware, or possible Spyware Licensed under the terms of Service Agreement

0

Update...My ad aware deleted the stop sign scan cause of e-anthology thing...but i got rid of all tohose files manually.Hipe this helps. :o)

0

TO KERI2004, I found the tools in the options. and i clicked in the: SHOW HIDDEN FILES AND FOLDERS. NOW WHAT? no window pops up shows where they are? what am i doing wrong?

0

I have had a problem with this little guy for almost 2 days. It seems like it is a hijack. All the files that would be created are under c:\windows. To make a long story short do to the fact that I really dont feel like recalling everything (major headache). Here are a few links to download a program that worked so far for me. http://www.majorgeeks.com/download3155.html You may also want to run a prog called CCShredder http://www.majorgeeks.com/download4086.html I hope this works for everyone, it worked for me. Goodluck Hmmmmmm

0

this is destroying everyone. I tried and am tired of trying. I just delete all a can and do just what i want...........since friday....i downloaded at least 50 programs. NOTHING WORKS. who cares......... if i have to buy another computer-i won't. i'll just cancel my internet service and just go back to watching TV. EVEN NORTON don't know what this is. I'M TIRED.

0

To Brian, they're all in the C:/Windows/ You may delete all of them, and then empty recycle bin, did you try the anti virus I just sent the link of? www.emsisoft.com/en/software/download/ It scans for all malwares not only viruses and trojans. Should try this online scan, too, yesterday it found another virus in my computer that norton didn't http://housecall.trendmicro.com/housecall/start_corp.asp They only show up if you select Show Files and Hidden folders/ You can try searching them by start menu and then search files and folders. I'll be back later to see if you got rid of it, or if there's any question. I am tired of them, too. But I am not willing to give my computer up... :o) You can think about reformating, too. Hope this helps.

0

Brain don't go back to watching tv, at least read a book. Trend Micro Housecall(free scan) is what the computer guy at work wants me to try before I throw it into the trunk of my car. I knew where to start looking and deleting because it's like a good game of free cell. Only now I have more on here than I thought, that darling daughter of mine.

0

Hopefully this will help.. I had been battling this annoyance for a few days myself. I would remove it and it kept coming back. So I took one of the suspect files and infected a virtual PC and figured out that its a adtomi adware application that is a "Stock Monitor" but the so called "Remove" option does not remove it before its infected you once again. Here are the steps I used to remove the annoying program. 1. Go into HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and found the random character .exe program that is running on start up. Did a CTRL-ALT-DEL and end task on the offending application. Then removed it from the registry. 2. Remove the same key from HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. 3. Delete the random character links in C:\Windows\All Users\Start Menu\Programs\Startup 4. Delete the random character links in C:\Windows\Start Menu\Programs\Startup 5. Delete all temporary internet files. 6. ** This step make sure you have a copy of internet explorer ** Remove Internet explorer from windows using IERADICATOR 2001. Which can be downloaded from http://www.litepc.com/ieradicator.html . 7. Reboot and re-install Internet Explorer. 8. Remove all Active-X programs running in Internet Explorer.. (Delete all files in C:\Windows\Downloaded Program Files) I did all that and it has stayed away.. I have monitored the registry and hasn't came back yet. I suggest after re-installing IE to go and get all the updates from Microsoft once again. Hope this helps!

0

Oh I forgot to mention to delete the files that correspond to the links deleted from the startup folder from both directories. They should all be in c:\windows Jim

0

Oh forgot one more thing (if I haven't forgotten another) you can remove the registry entry of HKEY_CURRENT_USER\Software\Adtomi Thats where the adware program has its entries.

0

It is a file that is embedded somehow in explorer. You can delete it and delete it. Anytime you run explorer it will come right back. You are going to have to use hijack to get rid of it. Make sure you know how to use the prog before getting rid of anything. Or do the following that Jim recommended. I was able to get this off a customers machine without having to un-install IE. Hmmmmmm

0

Bazooka told me exactly how to get rid of this (it's called winpup) Have been clean for 2 days now :)

0

I can't even click on Start or open anything. Once the MORZE messages start everything freezes or I get a fatal error message. A dozen re-boots and still can't open anything. Is there a workaround through DOS? Thanks Rick Friedmann

0

I think I solved a similar/identical problem that occurred on 3/28. So far, so good. Three things that seems to have worked: 1. I had noticed that there were several suspicious looking icons on my desktop. I checked the dates that they were created and found that they appeared on 3/28, at the time that my Norton program alerted me to the virus. Most I deleted using the right-click and delete function. On two I used file search and deleted them that way (the icons disappeared). I found that some were extension files of another. Also, one of them had a picture of a horse in the little monitor. 2. I deleted all suspicious files in C:\WINDOWS\ALL USERS\START MENU\PROGRAMS\START UP I found that they all were of the type MORZE5, YC58ANIG, etc. Also, all of them were created on 3/28. 3. Then I deleted all suspicious files from C:\WINDOWS\START MENU\PROGRAMS\START UP Again, files appearing like the problem files with creation dates of 3/28. CAREFUL, here there were other unrelated files. After doing this, I was able to reboot w/o the messages regarding shortcuts appearing. I am now reloading my Windows ME and Norton AVirus, just in case. I have also had an occassional message to wit: RUND1132 caused error in USER.exe. I dont know if that will reappear or not. Hence, my decision to reload ME. Will let you know if it returns.

0

The names of the desktop files I deleted were: antipudate5 CS4P028 calsdr O.BAT O bs5-nt15v (with horse on icon)

0

Sorry folks. The problems is back with my reload.

0

I have tried all of the solutions listed here and I am still having the same missing shortcuts dialog box pop up when starting my computer. The only solution I haven't tried is Jim's last entry. I'm not sure what files to look for in step 1. The ones listed when are start up are different that the ones in the registry. I also went to Bazooka and tried to uninstall myself but I am not sure of which file to look for in the registry. DRINDAHL

0

Have you tried the master reboot and use the system restore before the date of the virus/trojan attack?

0

I haven't and I'm not sure how to do either. Could you explain please. DRINDAHL

0

Um, before you delete a whole mess of programs on the date of the attack, it might be wise to have your emergency boot disk next to you just in case your computer crashes and whines about not being able to find system.ini or anything else. You'll know about the goof up when your Windows doesn't start up. http://www.bootdisk.com

0

Would it be easier to re-install windows. Would this take care of the problem? DRINDAHL

0

Here's a link to the page where I got help. Please read carefully to it's instructions. Sytem Restore "http://www.windowsreinstall.com/install/tips/winme/tswinme/system_restore.htm"

0

re-installing should work but you'll lose a lot of things in our computer. try system restore first before you re-install windows.

0

thanks DRINDAHL

0

did it work?

0

my last system restore date was September 23, 2003. I don't think it would be wise for me to go back to there. Everytime I open Internet Explorer when I restart my computer, it returns. I tried most of the procedures above, but they have failed.

0

I'm having a company come out monday to completely restore my computer. everything will will wiped away and all trojans gone. Then wednesday i'm meeting with my lawyers and filing suit against uproar.com NO ONE KNOWS WHAT THIS IS BUT SOMEONE WILL PAY. It seems to be going to everything on our computers---AND when we "delete" we are actually deleting everything! Sooner or later-none of our computers will work. VERY clever. The ARABS finnally did what they said they would do with our computers...........We're just the first,in the TOTAL CRASH!

0

i got this info from running Bazooka and it works great,Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.) Browse to the key: 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run' In the right pane, delete the values that look like the letters has been shifted around a little, for example 'ogonl', and where the file has same name, but with the .exe extension, 'ogonl.exe'. Remember the filenames (*). Exit the registry editor. Restart your computer. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.) Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ comms', if it exists. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ pup', if it exists. Exit the registry editor. Delete '%WinDir%\telnat.exe', if it exists. Delete the files mention at (*) Note: %WinDir% is a variable

0

Ad-aware version 181 will fix this . I had the same problems all week and tried all the above suggestions and only ad-aware version 181 worked.

0

Where do I find HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER? "Go into" is not enough info for a rube such as myself. ;-) Thanks!

0

I've been having similar trouble. Ad-aware let me get back into the normal Desktop without crashing. Deleted Startup instances but still have a few weird tasks in Ctrl-Alt-Del. I have the same weird icons on my Desktop and junk files in C:\WINDOWS. o and o.bat on Desktop are batch files that download & run weirdo programs. FTP site is downloads.default-homepage-network.com Ladies & gentlemen, frustrated or not, call your lawyers. I'll be doing some research and I'm gunna find out who created that site. A WHOIS on default-homepage-network.com told me.... nothing useful. The IP of this server is 205.236.189.51 if anybody wants to know. Let's all try figuring out which of these pyscho programs are legit so we can quarentine/delete the junk ones. Also, a friend told me something about the trojan.qhosts which could be part of winpup? I have pup.exe in C:\WINDOWS. It's properties say it's created by "totempole" and it's nickname is "werule". Sounds like a script kiddie/viral coder with an ego. Anyone know if Tppaldr is a legit program to be running under task manager? I'll post back soon with any info I have. P.S.: Ad-aware, deleting all instances of those weird filenames that start up (Not the files, just the shortcuts to them) in those folders mentioned here before, and Ctrl-Alt-Del'ing any weird tasks seems to help. I'm using Opera browser since Internet Explorer has gone haywire. I'll get back to ya'll with more info!

0

More research concludes this thing is recent. Here's an idea I haven't tried yet but sounds smart: Since some part of the trojan/virus may check to see if those weird files exist, boot into safe mode, delete the junk files, and create dummy text files renamed to the same filename. Maybe even put same amount of data? I haven't tried it yet, but it sounds smart. Anybody know how I can make Norton Antivirus/Ad-aware quarentine a file EVEN if nothing bad is found? PaulClerk, try this: Click the Start button. Click run. Type in "regedit" without the quotes. Press Enter. Then in the left panel you'll see your stuff. Just click the word or the + sign to expand it. BE VERY CAREFUL WHEN MESSING AROUND WITH THE REGISTRY!!! I warned ya!!! People, whenever we all manage to get rid of this thing, maybe we could get a lawyer and track down the creator. I mean, I missed my own website's 2nd birthday cause of this junk. At least I can run the normal Desktop with virtually no problems. BTW, answersthatwork.com claims to tppaldr and rnaapp are legit Windows programs. As for this program sending stuff without your knowledge, I recommend Zone Alarm. Don't use Internet Explorer until everything is fixed; get a friend to get ya Opera or Netscape. I also found out that those random gibberish filenames in C:\WINDOWS are created by morze5.exe, one of the "master" programs to this trojan/virus. There doesn't seem to be any program that can automatically fix this entire problem. Maybe if we bug Symantec they'll make one. As for now, be wary online. When Norton first caught & quarantined the Download.Trojan in my Temporary Internet Files (This trojan, according to Symantec, downloads & installs other junk onto your system.) a while later online, some icon appeared in my system tray called "eZula installation - 177%". I'm doing a search on eZula right now. I'll be back later with more info. Good luck.

0

Sorry to keep posting after myself, but has anybody ever had a popup that fills the screen say something like "You have spyware, you're seeing this message. Click HERE to remove it."? That's happened to me numerous times before, and I took it to be a popup trying to get you to INSTALL spyware. Research on eZula told me that this has something to do with it. Just thought ya'll would want to know. NEVER CLICK THE "remove spyware" LINK!!!

0

More info: Found out o.bat is connected with something called aolfix.exe. A search for it on my system didn't find anything though. Before I ran Ad-aware, in C:\Program Files\n-Case there were some hidden log files. I opened them in Notepad and saw THE log. It was talking about "updating a dictionary" and "not enough time yet to launch ad". This thing is definetly a trojan/annoy-ware/adware system. Problem is I can't figure out which "malware" it is! Trojan.Qhosts? Winpup? Aolfix? Download.Trojan supposedly gets SEVERAL malware programs from a designated source. Could we be dealing with several programs?

0

Yes, it could be several programs. http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html Trojan.Qhosts modifies your DNS settings, so people who can't connect online, get the removal tool. Aolfix.exe is also related to this. http://securityresponse.symantec.com/avcenter/venc/data/adware.winpup.html Adware.winpup spams you with ads. Relies on Internet Explorer to break in, so that's another reason for using Opera! This thing apparently copies itself into the random filenames. As for those other weird programs on the desktop, I'm not sure. I seem to be the only one on this board this morning. Please, somebody, reply. I've offered my advice & info, and now I need to know how I can quarentine a file without the antivirus detecting it as infected. I have Ad-aware (Dunno which version, a friend gave it to me.) and Norton Systemworks (which has Antivirus). Good luck on removing this thing.

0

check out forums.thatcomputerguy.us for help with this. they have several useful threads.

0

I want the easiest way to get rid of this, so I'm still waiting for it to catch on to the experts. It's so great to have these forums but it very confusing to have all of these attempts to get rid of it. But I'm wondering if there are people sitting on the butts looking at all our responses and laughing or maybe it wasn't to do what it did with that 'problem with shortcut' and they screwed up. Now we are all really cleaning up the garbage. Here's a link that was suggested by cardfan2004 http://216.239.41.104/search?q=cache:TP4GbxxUHFsJ:forums.thatcomputerguy.us/index.php%3Fshowtopic%3D1426%26view%3Dgetnewpost+problem+with+shortcut+window&hl=en&ie=UTF-8

0

ok guys, i finally killed this thing, only thing is i was running so many programs thru trial and error im not sure which one did it, but i believe, to the degree of 90%, that it was a program called winpatrol that did it, i downloaded it for free from download.com, try it out, and give feedback if it worked for u, i killed the files from the registry and startup and its been a week now and ive seen no sign of it, thats good news cause i havent gone more than 2 days with anything else ive tried, anyways, hope this works for all of u

0

I went to msconfig in run and i unchecked everything and i am still having morze1.ink still come up and another thing is the icons for norton and everyting on the taskbar arent coming up anymore, plus i cannot change my wallpaper it is just the plain blue. please tell me how to fix these things. i think it is something in msconfig because after i unchecked all of it all these problems started coming up. please help me!!! :( jake

0

I went to download.com and downloaded winpatrol. It completely fixed the problem. I am very pleased. Have a MOFO day!

0

Ad-aware removed the problem, but the files are still there. Does winpatrol junk all the weird desktop files AND the morze5/random gibberish files too?

0

I have been battling this problem for three days here's some key items I found along the way in windows, windows/system, program files, and the registry: AvantGo BargainBuddy LycosSideSearch Ezula BSX 180Solutions BookedSpace Key files found along the way: o.bat o silent.exe bs5-nt15v.exe cs4p028.exe 0021-bd194126.exe (and many others) Spybot nor TrendMicro nor deleting these (in the registry and the folders) did no good until I ran across: Windows/System/BXXS5.DLL Killed from a command prompt boot, at least the thing doesn't replicate anymore. Unfortunately a simple rename and this guy can rise again. What is up with this thing and where did it come from?

0

Sounds like everyone is really having a blast with this one. I have killed this mennace off of several machines in the past few days. One thing that seems constant is you MUST attack on all fronts at one time. The reoccurances are typically coming from seemingly innocent looking registry entries. Check out Symantec http://securityresponse.symantec.com/avcenter/venc/data/trojan.norio.html This was one I had to deal with and registry loads like "update.exe" "start.exe" and others were the biggest culprit. Boot to safe mode, delete all you already know is bad and run regedit to kill the keys for reinfection. Pay attention to these keys: 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run' 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run-''HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Runonce' 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Runonce-' 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Runservices' 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Runservices-' 'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run' 'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Runonce' 'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Runservices' There is some degree of randomness to these infections so be careful. Best advice is to call a professional if you are not computer savy with this one. Messing with your registry files can be VERY RISKY if you don't know what you are doing. Just warning you before you go off the deep end. Shread the registry to much and you may HAVE to format and reload unless you are skilled at rebuilding it properly.

0

Digital_Doctor's on the money there. The "Run" entries in the registry are the places to look for malware that is started when Windows is kicked off. The only problem is even after carefully deleting those keys -- if you use your browser without cleaning up the rest of the junk it will simply recreate the entries. The Browser Helpers (BHO) found by "WinPatrol" finally allowed me to de-link those things from Internet Explorer. After searching the web about this I am amazed how many folders and registry entries are created by these low-life applications.

0

Hi guys, I am a newby here, and somewhat a newby to the working of the computer. I had a friend get the virus and she did nothing untill her computer crashed one day. Se was running ME on a HP pavilion. She asked me to reformat her computer and reinstall from her cd. She did not have a boot disk and after several atempts on bootdis.com with no luck I decided to use my 98 boot disk reformat and reinstall 98 and do an upgrade later. The bottom line is I have finaly gotten all the way to installing windows and I get this message. Packed file is corrupt. I have read that this means the computer still has the virus. On trying to do a partition on the hard drive all I get is that the disk is fixed and I can not partition. Any help would be greatly apreciated. I have formated and repartitioned on my computer several times, it took some trial and errors but I finaly got it down. But on this new computer I am at my wits end. Guess my brain is just fried. Thanks Orion

0

Orion, more info on your situation would help i.e. exactly what you did and utilities you have used to get this far. If you are ready to throw in the towel this will attempt unlock the drive Generic talk ... First boot to dos from floppy. In the event of a corrupted master boot record or boot block virus, use FDISK /MBR command to restore the master boot record. If this still won't work, and only as a last resort, a Low Level Format should restore the disk to new condition. If you need to low level format your hard drive then check the drive manufacturer and download such an utility from its website. Every drive manufacturer provides just such a utility. Here is a list of hard drive manufacturers with a links to low level format utilities: IBM(Hitachi) http://www.hgst.com/hdd/support/download.htm Seagate http://www.seagate.com/support/disc/utils.html Maxtor http://www.maxtor.com/en/support/downloads/index.htm Fujitsu http://www.fel.fujitsu.com/home/drivers.asp?L=en&CID=1 Samsung http://www.samsung.com/Products/HardDiskDrive/utilities/index.htm FAQ: Low level format Western Digital http://support.wdc.com/download/index.asp Note: If normal (high level) hard disk formatting is required, you can use DOS FDISK command to first erase and create partitions and then use FORMAT. It is also a good idea when you hard disk becomes inaccessible to see if it is just the system files that are corrupted. Most of the time, it is the case. SYS will do the job of replacing system files. Therefore, low level format is always of LAST RESORT when you encounter HDD problems Good luck.........

0

My friend got this on her computer, NOTHING worked. Reformatted the hard drive and reinstalled windows. For those of you with newer computers, backup your data to cd and then use your restore cd's that came with your computer and reformat your computers.

0

wheatfield, Sort of like the hunting mosquitos with a nuke approach don't you think? Every problem has a solution. Careful work and research can make short work of most pests. Ignorance is bliss, but never in the digital world.

0

Hi again, Thanks Digital_Doctor, I have tried everyting you have suggested. I am going to try the low level format and download from the harddrive manufacture. To wheatfield, I did the system restore disk and that is when the computer stoped working. It is like it just erased everything. I have formated but when I trie to reinstall windows ME from the cd that came with the computer it says files not found. When I go into the bios and reset the computer to boot up to the CD to read it at boot up it resets the bios at boot up and will not run the CD. When I do the fdisk to partion the drives everything comes up as normal but when I try to partion it says the drive is locked and that I can not partion it. I will keep trying and comming back to see what you guys think. Thanks so far for the help. Orion

0

Hey Doc, Thanks for the help so far. I have not tried the low level format yet, I will try that in the am. I will check in here first to see if you have wrote back. A friend came over that had a disk scrubber he said it would clean the hard drive. After he did that we tried the fdisk and it worked but it still would not let us put ME back on after a few attempts he went home. I have stayed messing with it hopeing something would click. I again did the fdisk and then tried installing my 98se which I thought was going to work, but about a third of the way thorough I started getting Failed attempts reading drive a: abort/retry/xxxx cant remember the last words. A little brain dead at the moment excuse me. So I told it to retry and it would down load a little more and the same thing, I kept telling it to retry but after a while it just stoped. So I again I cleaned the cd rom thinking it might help. But after trying to load windows AGAIN all I get is packed files are corrupt. That is back to where I started. I am begining to think the virus would not let it load properly and is now strong as ever. Do you think a low level format would help at this stage. My friend thinks I should just get a new hard drive and be done with it. Any way any suggestions would help. Just not ready to give up yet. Thanks Orion

0

Orion, Just curious of the procedure you are using to load WinME. Easy way for beginners is to boot from the windows startup floppy you hopefully created from a successful install. If you don't have one, make one on any working machine (WinME works fine). The utility to do this is in the Add/Remove programs area of Control Panel. Click the Startup disk tab and follow the instructions. Start the machine with CD ROM support. At the A:\ prompt do the Fdisk and Format stuff as needed. I am making the assumption that you are fully deleting ALL partitions on the hard disk before you attempting to rebuild the system. If not DO IT. Delete all partitions using FDISK then create a new primary DOS partition and set it active. Shut down and reboot from floppy. Run format C: to format the new partition. When you are ready to load ME from the A:\ prompt, run E:\setup, (wher E: is the letter of your CD rom). Note that this will only work if you are using the OEM WindowME disk and not the manufacturer "restore" disk. If you only have the "restore" disk, follow the instructions on the disk once you have done all the FDISK and FORMAT work. Also the best way to clean a dirty CD is to wash it in warm water and small amount liquid dish soap. Be gentle and do not scrub it! Dry it with a very clean and soft towel. Scratches are a different story and will require more drastic measures. The A: abort/rentry/fail message usually comes from removing a floppy from the drive before you should or by using a bad floppy (or even a write protected disk in the drive) but not from a dirty CD. The system is trying to read or write to the floppy. I know some this stuff sounds basic but like I said before, a complete description of what you are trying and what you are using, like boot procedures and type of disk and utilities you are using, is very helpful in giving you GOOD guidance. We can't reach through the computer and only know what you tell us. As for the low level format, it should bring the drive back to virgin condition and eliminate any virus that proper FDISK and FORMAT procedures will not. That being said, I would only do it myself after I have tried everything else. It is already broke so do what you think is best. If you post again, PLS be as specific as possible on your procedured and errors. Your packed files corrupt messages can be induced by virus activity. see microsoft at: http://support.microsoft.com/default.aspx?scid=kb;en-us;218885

0

Ok Doc, Here goes I will try and be as thorogh as possible. First thing first when the computer started messing up it was probably 2 months ago. My frined kept trying to do the cleand disk, scandisk and defrag. but none of the programs would ever complete. Her virus detector had expired and she was trying to get on the net to download one. The more she tried to get on the net she kept getting pop ups out the wazoo and her system would finaly fail. Then about a week ago she started getting the box shortcut not found. With MORZE5.INK, MORZE1.INK, OJTOLNOL.INK ect. That is when she asked me to come over and help. I started trying to trace the source of the error. I did searches and everything I could think of. It has been a long time since I had worked on any system and at this time was just trying anything. I knoticed that one of her programs installed with the HP Pavilion bundle on her computer, A music program had a link to the virus in it. She said the music program did not come on her machine and that she did not install it. I thought maybe that was a good place to start so I deleated it. I went into the msconfig and unchecked all the .ink links, there must have been 500 or more. I went and dumped the users files, the cache, the *.tmp cleaned everything I could think of. It seemes the closer I felt I was getting at deleating everyting I could find the more the computer started to mess up it got slower and slower and would stall finally freezing and I would have to reboot. I would go through the process all over again, always making sure not to try and close the shortcut box as I knew this would just send it on a rampage again. Adding more stuf to clean up. Finaly as I was cleaning and deleating everything I could find releating to .ink the box went away on its on. She had been trying to do a system restore and could not get the cd rom to read the disk. Everything from boot to restore to reinstall is supposed to be on the 3 cd's that came with her system. I finaly got the cd operation but it would not do a system restore. I then went into start/find/files or foldrs/ and I typed in setup. The screen came up to restore or reinstall windows. I inserted the system restore cd and did a complete restore. WE did everyting the cd prompted us to do. At the end it said that the restore had completed and that windows would restart the computer which I let it do. Hoping that when it came back up it would buy us enough time to try and get on the net, do a virus scan and hopefull install a virus dictector that would start working on the virus. I Have AVG on my system for at least 4 years not an never a problem keeping my system clean. WEll when the computer rebooted it came up to a blank screen blue that was it as if it had wiped everyting out. Tried to get the computer into dos. but was having no luck. That is when I came home and started searching the net. Found you guys and a few other sites. Learned about making a boot disk for Windows ME did that, but not correctly at first. That is why I had no success. So I tried booting from my Windows 98se boot disk to do a fdisk. it would not let me. Thought that maybe ME was the ntfs, as I have heard you can not partition ntfs the way you do 98and others. Did a format and tried to load 98se anyway and got the packed files are corrupt. Came back home to do more reasearch. Found out why my ME boot disk was not working Made a new one and whent back to the drawing board. I have printed so far everything I can think that might be of help. Different codes for installing. Although the one I have in my books seem to get me the furtherst. I have found sever different formulas all slightly different to do a install. Have tried them all. Any how back to the subject. SORRY I put the ME boot disk in tried the fdisk and it said the disk was locked and It would abort. So I just tried to get the cd operationl to do a install ---- Nothing---- And again I am back on with you guys. Where I hear about the low level format. I have downloaded the program and the disk works just have not done the format yet. A friend came by yesterday that tried his hand at installing the windows. To no luck. he said I probably need to flash the bios and get a new hard drive. The new hard drive I could handle if I knew that would work, but I know nothing about flashing the bios. Have done my home work and printed out the papers on how t do it. Now just to down load the proper tools. Any how my fried while he was here did a disk scrub on the hard drive. Not sure what program he used, he just said it was called a disk scrubber. He tried a few more things. Then that is when he told me to fash and get new HD. Later that day I thought I would try the low level format. Made the flopy but instead Thought I would try the install just one more time. Got my trusty book out that I have used repeatedly. Booted with 98se did a fdisk, wich it allowed me to do this time. When I was done I did the format which all looked normal. I then put the Windows 98se CD in the cd rom and did the setup.. Everyting looked good it started copying files just like it should untill on somewhere arround the 70th file to be copyed I got the reading drive a abort/retry/fail ... So hit retry.... its started loading again, but not long after I got the reading drive a message again. I figured somthing was up with the Rom drive or that the virus was tryig to block the download. That when my friend scrubed the HD that it helped but not enough. After abuot the third or fourth reading drive A RETRy I did it just stoped loading. NOW I can do the fdisk. I do the deleate the primary DOS partition, then I go to setup a primary Dos partition when it is done I make the entire C drive the primary partition. I never get an error there. NOr have I since the first time when it said the disk was locked and I could not partition. The problem is now when I try to install the OS. it tells me that "PACKED FILES ARE CORRUPT" I feel like I am going around in circles here and I problay am. As I said I am fairly A newby. But I have done this several times before in the past with other machines and never a glitch. I have the machine at my house now. Right next to my machine so every time I get a glitch I can research. So here I am again. :-) or :-( I hope that might help more if not I am not sure how else to say it, I am not good with teck terms. Thanks Again Orion

0

Orion, Reload procedure sounds fine. PACKED FILES ARE CORRUPT message still can be caused by a stubborn infection on the HDD. Low level format and/or a Zero-Fill utility for your hard drive should be your next step if you are concerned that a virus still exists. These utilities are available from the drive manufacturers websites. If you have concerns about the BIOS, consider either putting the drive in question in a different machine just as a testing tool or install an old drive in the machine you are working on just for a diagnostic tool. This may help you decide which way to run and keep you on track. Don't hear galloping and think zebras. What started your symptoms was most likely some malware called "coolwebsearch". This malware then spawns other junk all over your system. For future reference they are best cleaned up from safe mode. Tools to deal with them include: Spybot, Bazooka, Winpatrol, and AdAware. For more advanced users there is also HijackThis. Different ones of these help in different ways and each requires different amounts of user knowledge. In the case of HJT you should know something about the registry function in windows. Some of them would not remove the problem by themselves. My best results are obtained by using more than 1 in order to assure a fully cleaned system.

0

Thanks Doc, Did the low level format and everything passed. Except when I did the check instalization it gets so far and then says error log file not found. Did the format anyway and as I said everyting passed. Did everyting leading up to the install as usually and when I put the cd in to install windows it started the install. but again about a 1/4 of the way through I start getting the error reading drive D: retry. Then after a few of these it just stops trying. Went into the bios and checked the setting on the Master or C:drive, they are wrong and it will not let me change them. will only let me change what is on the master or enable disable the master. pushed the F6 to get to the last option on the master and set the configurations my self. Read on the net that you can do that when it will not let you set the drive configurations. Did the same on the cd rom it is incorrect. Should be Samsung CD-Rom SC-148 on the bios it reads Samsung CD-Ron SC-148 will not let me change anyting except to change what is on the drive to a removable item (cant remember exact wording) or the enable or disable. Tried to set the bios to the original setings but they will not take. Back in Dos went to the Autoexec.bat and the Config.sys they look nothing alike. The Autoexec looks really messed up. But I am not 100% sure how it should look. Found a feference to this on the net going to print and compair. Also read about removing the battery in the bios for about 2 hours and this should reset the bios, but it did not give a specific amount of time. Did read somewhere that on a lap top to only leave the battery out for 30 seconds any longer would damage the mother board. I am not on a lap top I am on a desktop but do not want to do damage to the mother board if it hasnt already. I believe the HD is ok. so buying a new one will not do any good if the bios is correct. So I am at a loss where to go from here. Going to take a break now and spend time with the kids. Will do more reaseach later. Thanks so much for all the help so far. Will check back in later Orion

0

Orion, Last time I checked, HP does not support BIOS flash but that might have changed. You might try identifying the MB manufacturer with a utility like ctbios (downloads.com). Use the info you get and google the web to see if you can come up with the files and utilities you need. Might also slave the drive into your working computer and copy the entire Win 98se disk into a temp directory. You can try to install the system by running the install files directly from the HDD. Of course this will not do anything for the BIOS.

0

not much time today to work. Between job and kids. Tried the ctbios but couldnt get it to work. Will try again tomorrow and let you know. Thanks Orion

0

Here's some hope Morze 1 and Morze 5 are spyware. MSN sends them to you when they send you the yellow popup that tells you to look for a virus or spyware! It is rumored that Adaware free)will get rid of it. Seems there is another virus attached to the adaware. Netsky if I remember. This is my remedy til i find something better. Win 98.2 Start pc in "safemode". go to "start" menu then "find files" enter "morze" delete it wherever it appears next type "startup" in find files. There are 3 files, startup, disabled startup and a copy of one or the other. Open first "startup" folder. If morze 1 or 5 is in there delte it. Also delete the unfamilair alphnumeric files in there with morze. These are the same files that ypour pc searches for after it searches for Morze when you first start it up and discover you have a problem. Do the same in the rest of the "startup" files. Don't skip any. Then Delete the deleted files from your trash can. Go to "run" at your start menu (bottom left)run msconfig. open starup on the far right. Morze and/or some strange alphnumeric files will appear checked. Uncheck them . Don't uncheck "sys tray". Note the alphanumeric files will have the same names as the files that appear when your pc searches for morze.exe file when you tried to start up and can't. Restart pc. To make sure you're successful go to run "msconfig" Morze is either gone or unchecked. The offending alphanumeric files are now unchecked. If you notice the pc get sluggish again , check "msconfig" for the rerappearence of the morze etc. At worst this huisance delayed msconfig for almost 2 minutes. Sometimes I remove this crap 3 times a day. A nuisance . Have the idea you can avoid it by using another browser,like Netscape instead of MSN . Not sure. If adaware works without giving you another virus etc please post here. Luck

0

stsnbee Using the procedure you described cannot properly clean the offending spyware off your system once and for all. To my knowledge AdAware is neither the problem or the solution. The infection you are fighting is most probablly "coolwebsearch" and some other malware all at once. Doing what you are doing and then also running "Spybot - Search & Destroy" (downloads.com) and then follow up with AdAware. Do this all from safe mode in order to avoid the malware from being active. This will likely help you out of this loop you find yourself in. There are other scanners out there but this is a great start. You seem to be correct in that this paticular infection likes to mess with MSIE and not so much netscape. Don't know how long that will last though.

0