WARNING - FSfreeware - Site infected my pc with trojan

[John_Cillis 2,406]

I just want to add to this thread...One of the methods being exploited since the beginning of April by websites containing malware/trojans/spyware exploits an issue Microsoft reported in the beginning of April. It allows sites with "damaged goods" to exploit a bug on systems where Outlook Express is installed. Outlook Express doesn't have to be running in order for the infection to "take", btw....One of the symptoms of this style of infection is that wmplayer.exe gets swapped with a bogus version. The bogus version's path is then entered into various startup vectors in the registry so it runs in the background. People go about cleaning their systems thinking all is great, then launch wmplayer.exe at some point. Then guess what--reinfection.If you ever suspect you've been hit with a trojan/malware/spyware, other than running the standard utils like Spybot, Adaware, Hijack This, etc....do a file scan of all files on your system, and use the suspected infection date as a search filter. Look for exe's, dll's, etc that have that date in common. More often than not, the hijacked exe's won't have an icon associated with them, although they will have legit names like wmplayer.exeHope this helps.... -John

[Guest Larry S]

I had a recent bout with CoolWebSearch CWS trojan. cwshredder would indicate it was removed. I could reboot a hundred times and be fine. However, the next day it would return. I proved the next day effect by removing it, repeatedly rebooting, then setting the clock ahead one day and getting it back. Aside from changing my home page to coolwebsearch, it had an effect on my firewall. cpd.exe, the mcafee firewall, was running as high as 85 percent, my cpu was pegged at 100 percent sitting idle at desktop.Never found where it originally came from. Never found where it was being triggered the next day in my system. I fought with it for about a week. I had to use the XP restore option and restore my system to a few days before it got me (I used cwshredder to remove it one last time before the restore). Haven't seen it since. The restore ended up breaking Mcafee, I had to download a removal tool from Mcafee.com to remove Mcafee before I could reinstall it, but all seems fine now. Small price to pay to get rid of the freakin thing.

[atc_scott 22]

I had a problem with the wtoolsa hijack. It istalled itself on my c drive as wintools. I had the same problems stated above. The reason I knew I had it was it was maxing out my my CPU every two seconds. I scanned the files over and over with Norton, and it never said anything about it being a virus. I got rid of it with a combination of hijack-this, adaware, spybot, and manually deleting files. What a nightmare this thing was! I have never been paranoid about the net before, but I am constantly scanning my computer now!

[calypso 32]

The people responsible should be shot!!

[Guest Bigshot]

Same exact thing happened to me a few days ago when I went to fsfreeware. My firewall went crazy and blocked about a dozen invasion attempts. I had to control/alt/delete to get my browser back. Then Norton caught a trojan that'd infected my notepad.exe file and deleted the file. I switched to wordpad cause the threat came through the adware program to the notepad file. BTW; I'm completely updated with windows security stuff. Just short one notepad.exe file. Needless to say, I've deleted my fsfreeware page from the favorites list. It'll be a cold day before I go back there. I think they need to check their advertisers more carefully. Also, adware software appears to be an unlocked door. I'm thinking about uninstalling that program. My Norton is uptodate and did identify adware as a security risk as when I scanned my harddrive, I got three security risk hits on the adware software.

[Guest Fsfreeware]

Ok - let's put this right - once and for all.The only advertiser used at fsfreeware - was a popup window scheme - - Terms and consition of usage - was absolutely guarantee security for sites visitors.I said used - because - this is now being removed - sure nobody want trojans - or other kind of stuff going around - or risk that this stuff going around - as safety of users comes first - therefore for peace of mind we clear this off the site.At present There is no external advertisers - display at fsfreeware - other than internal adverts - produce by us exclusively - based on pure html or images.If you come across the site - and you have problems - be sure they are not originated by Fsfreeware - and i'm also sure by the CH site - as reported on the other message board.Raimondo

[Guest Ken_Salter]

And with that I'm locking this thread.