Activex control

[teztina]

i keep getting a pop up window sayin an acticex control on this page might be unsaft to interact with other parts of the page.do you want to allow this interaction?
yes no
when i click yes of course it disappears....
but when i click no it sayd error 2011 this paginates it requires controls activex to be shown in there entirety press to accept.
ok
and when i click ok its asking me the same yes no as be4.....i wont go away until i press yes...
also i have been experiencing some problem i dunno if they have to do with is....when i go into programs like winrar to look at something i downloaded or CWShredder or even a fold that i have on my pc just close out with in secs of opening it.....here is a highjack log is there something there that shoundnt be?
also im seeing a file in my taskm underprocesses sayin rundll32....i never saw that there be4 these problems...and its causing pop ups every once in awhile...
it also has changed my home page.

 

[Nodsu]

Do not install AciveX controls. Seriously, just don't. If that page requires ActiveX then just go somewhere else.

It is best to disable ActiveX in IE internet zone completely and only put absolutely trusted pages in the trusted zone in case there actually exists an ActiveX control your life depends on (like Windows Updates).

And there is no HJT log.. Try again

 

[teztina]

its asking my that q when i dont even have a browser open and everytime i look for anything to do with antivirus it closes my browser on some1 plz help me
it even closes window when i go into internet options security tab....when i click custom level it closes that window on me..

 

[Nodsu]

Boot into safe mode with networking.

 

[teztina]

i now know what it is now i have to get rid of it....i was wondering why my jasc paint kept opening every now and the with a pic of avril laviegn....its appearrently the VBS.GEDZA.A worm i can close it out of my taskm by ending the process titled rundll32 long enough to run virus program cuz be4 when it was running it would close anything that had to do with antivirus...im in the works of figuring out how to get rid of it...i used the trendmicro free scan and that is how i found it and what its is....on first scan it piked up 3983 virus with the name vbs.gedza.a and only cleaned 500 since it is a free scan...i did a sencond scan right after and it picked up 4207 virus with that name...

 

[RealBlackStuff]

Boot in Safe Mode.
Switch System restore OFF.
Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:
WScript.exe
Weather.exe

Next, UNinstall anything to do with:
C:\Program Files\AWS\WeatherBug\Weather.exe

Next, run a HJT scan and place a tick-mark in the little square before (if still there):
...................................................................................................
C:\WINDOWS\System32\WScript.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\SYSTEM32\winmgd.win
F1 - win.ini: run=C:\WINDOWS\SYSTEM32\mouse_configurator.win
O4 - HKLM\..\Run: [Kernel32] C:\WINDOWS\SYSTEM32\Kernel32.win
O4 - HKLM\..\Run: [Israfel] C:\WINDOWS\SYSTEM32\Israfel.vbs
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
...................................................................................................
Now click on the Fix Checked button in HJT.
When done, from between the dotted lines, delete the highlighted bold files.
When a directory-name is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Boot normal. When all OK, switch System Restore back on.

 

[tdeg]

Do everything realblack said to do and then do the following:

1) Download Firefox ( www.getfirefox.com ) and use it instead of IE
2) Get a spyware killer program like Ad-Aware http://www.lavasoftusa.com/software/adaware/
3) Make sure you have a firewall like ZoneAlarm
http://www.zonelabs.com/