event manager security URGENT PLEASE HELP HELP HELP

From: hel8itch (hel8itch_at_msn.com)
Date: 06/26/03 

Date: Thu, 26 Jun 2003 12:10:55 -0700

hi thankyou for your help i really am grateful.i posted
somewhere here yesterday but received a rather abusive
email from someone saying it had been removed for seom
reason but anyway atleast your helping.i run the klez
tool i got from symantec before reading what you said
about searching for double ending files,and it said there
was no klez virus detected on my system.iv run norton
again and still nothing,iv also run spybot
(search&destroy) and it found alot more stuff than
adaware but theres still no improvement on my system.the
mystery icon is still there iv tryed dragging it on
desktop to see if i can get any properties but no good.iv
right clicked it but it just says "chris's homepage" this
is the ad of the page it takes me to when i click it
http://kickme.to/chrissnook its just a plain page really
with a couple of links but nothing that gives anything
away.my pc seems to crash every half hour.and now i keep
getting microsoft runtime errors popping up and closing
my programs.its driving me mad.someone said i might be
able to do a repair by using an xp setup disk but it was
preinstalled on my pc so all i have is the 4master disks
and cant seem to find the cab file for winxp setup.i do
hope you can help.thanks again
>-----Original Message-----
>before you use the cleaner, do a search on your system
for
>any files that have more then one ending on them.
>For example if you have a file that ends like this
>..exe.scr or .jpg.scr then you have the klez for
>certain.
>
>run msconfig and send back whats running at startup!
>see if you can detail the properties of that icon that
says
>Chris's home page, just right click on it and view
>properties, post back with that info!
> visit here for a free online virus scan, highly
>recommended. http://housecall.trendmicro.com/
>
>visit here for a free trojan scan (in case the virus
scan
>doesn't see it)
>
>http://webzila.com/virusscan.html
>
>
>I suggest that you also check to see if someone has
>installed a key logger onto your system, visit here and
>page down a bit for the trial version
>http://www.networkdecisions.com/freestuff.html
>
>Not sure just what is going on, but gathering data never
>hurts! if someone else has a clue feel free to pitch in!
>
>
>
>>-----Original Message-----
>>HI I HAVE ADAWARE.PLUS WINXP FIREWALL.ANOTHER STRANGE
>>THING IS I WAS USING MSN MESSENGER JUST NOW TALKING TO
2
>>SEPERATE PEOPLE AND ONE OF THEM SAID THERE WAS A
MESSAGE
>>ON TOP OF HIS WINDOW SAYING THE PERSON YOU ARE TALKING
TO
>>HAS A VIRUS SEND THEM THE KLEZ.EXE REMOVAL TOOL.THE
OTHER
>>PERSON HAD NO SUCH MESSAGE.I DONT KNOW WHERE HE GOT IT
>>FROM I THINK THE MESSAGE DISPLAYED A LINK TO IT,HE SENT
>>IT TO ME,I WENT TO OPEN IT IN MY MAIL AND IT SAID IT
WAS
>>A VIRUS AND MSN CANNOT REPAIR IT.SO NOW IM DOWNLOADING
>>THE REAL REMOVER.I WISH SOMEONE COULD TELL ME WHAT IS
>>HAPPENING TO MYPC!!!
>>
>>
>>>Not sure if this is the case, but do this!
>>>Get adaware and spybot. also do a search on google for
>>>Trojans, enable your firewall.
>>>
>>>looks like this is coming from norton Antivirus
updating
>>>it's files, not sure though!
>>>
>>>
>>>
>>>
>>>>-----Original Message-----
>>>>hi i was checking the event manager today looking at
>>>>errors etc.and under the security section there are
>>alot
>>>>of warnings that say the following:Event Type:
>> Warning
>>>>Event Source: WinMgmt
>>>>Event Category: None
>>>>Event ID: 63
>>>>Date: 23/06/2003
>>>>Time: 10:37:12
>>>>A provider, OffProv10, has been registered in the WMI
>>>>namespace, Root\MSAPPS10, to use the LocalSystem
>>>>account. This account is privileged and the provider
>>may
>>>>cause a security violation if it does not correctly
>>>>impersonate user requests.
>>>>
>>>>what does this mean???there are several of the same
>>>>warning.and another odd thing is that there is an
icon
>>>>that has appeared on the right side of my start menu
>>that
>>>>i never put their and i cannot delete.its
>>named "chris's
>>>>home page".has someone accessed my pc??please can
>>someone
>>>>advise me what i should do.im running windows xp.
>>>>.
>>>>
>>>.
>>>
>>.
>>
>.
>

Relevant Pages

  • Re: event manager security URGENT PLEASE HELP HELP HELP
    ... > reason but anyway atleast your helping.i run the klez ... > tool i got from symantec before reading what you said ... > was no klez virus detected on my system.iv run norton ... > mystery icon is still there iv tryed dragging it on ...
    (microsoft.public.security)
  • event manager security URGENT PLEASE HELP HELP HELP
    ... >reason but anyway atleast your helping.i run the klez ... >was no klez virus detected on my system.iv run norton ... >mystery icon is still there iv tryed dragging it on ... >able to do a repair by using an xp setup disk but it was ...
    (microsoft.public.security)
  • event manager security URGENT PLEASE HELP HELP HELP
    ... that install programs on your pc. ... >reason but anyway atleast your helping.i run the klez ... >was no klez virus detected on my system.iv run norton ... >able to do a repair by using an xp setup disk but it was ...
    (microsoft.public.security)
  • Re: event manager security URGENT PLEASE HELP HELP HELP
    ... There are many viruses nowadays that DISABLE antivirus programmes so you may ... Go to the Symantec website and see if you can find out ... >>>reason but anyway atleast your helping.i run the klez ... >>>was no klez virus detected on my system.iv run norton ...
    (microsoft.public.security)
  • Re: Virus tranmission via Windows Automatic Updates?
    ... What virus scanner detected the virus? ... >>update icon in my task bar and then clicked on details to ... >>program would not install it. ... >>If Windows Automatic updates really has been hijacked, ...
    (microsoft.public.win2000.security)