Someone on icq named Paul sent me a link to a site called

DO NOT GO TO THIS SITE
www.jokeworld.biz
DO NOT GO TO THIS SITE

There\'s someone on my contact list named Paul already so I assumed it was from him but it wasn\'t. Anyways, as soon as I clicked the link, something got downloaded onto my computer and these pop-ups prevented me from stopping the download. Now, nearly nothing with the extension of .exe works on my computer. I can run basic things like Internet Explorer and Word but ICQ, Adobe Acrobat and many other files say they have performed illegal operations and shut down immediately when opened. I can\'t even go to www.icq.com to redownload the file because visiting that site causes another error.

I\'ve had to restart my computer several times already. Is there any way for me to fix this? I read the details of the illegal operation and there\'s some technical jargon that I don\'t understand. Is there a way to decipher it?

Thanks...

Well, if it\'s a virus of some type...you can go use Panda Activescan. http://www.pandasoftware.com/activescan/

Unless of course the site won\'t load.. And if you can\'t download AdAware or any anti-virus programs.. If you looked at your registry--

Oh wait, what OS are you running?

(I\'ve had my share of comp problems today, couldn\'t install fonts and almost had to reinstall Windows. Ahem)

Whats the technical nonesense? What are the words you can\'t understand? If you tell me, I\'ll try to figure it out!

Once not a year after we got a computer, the entire hard drive broke with no warning. I couldn\'t get on the internet or anything! It took about a month before we got around to fixing it. No more Gateway computers.

That was off topic and absolutly NO help at all!
Pocket, I did some searching. Read this forum descussion and there should be helpful data there. Try it.

Helpful Data

Oh, I just downloaded it. I have a mac, so it will have no effect. I will check out this odd prog and attempt to figure this out!

[Edited on 22-2-2004 by Zero EXE]

The details of the illegal operation word for word:

I\'m using Win98. I\'m looking through the annoyances page you posted Zero. Thanks.

EDIT -


[Edited on 23-2-2004 by Pocket]

I just aimed Unknown. Go to this site for a scan.

Scan

it\'s an online scan that needs no exe files. Check it out.

I\'m currently using HollowTorment\'s Panda thing. I have 12 infected things so far that have all been disinfected.

I\'m going to use Zero\'s scan afterwards...

Thank you all for your help. I\'m going to give my computer a digital enema.

As Zero has notified me, I have come. Pocket, if you can get into ICQ or the Web ICQ, here\'s my number: 203901348 and I can help you out quicker.

For now, if the virus scan comes up clean, see if you can run this:
HiJack This!
is a utility that can tell a lot of things pertinent to running processes and things integrated into browsers by sites. If you can run it, hit the Scan Now button, which will turn into a Save Log button. Copy/Paste the contents of this log into a post.
If it doesn\'t work, try to get what you have running so I can check it out. Also, try posting your problem on Winguides forums, which I also frequent, and there are a LOT of people good at solving problems like this.

-Unknown

I posted on the Winguide forums, I ran both online scans recommended by HollowTorment and Zero.EXE, I ran HijackThis (somehow) and deleted a bunch of questionable files, and I ran sfc (c:/WINDOWS/system/user.exe and c:/WINDOWS/system/setupx.dll are corrupted)...

I don\'t what else I can do...
My next goal is to find my Windows98 CD and fix those two files and hope that solves the problem but I\'m almost positive that it won\'t.

I have no real computer experiance but i\'ll try to help:

First of all, do not open anything in the controll panel as it will infect any started exe programs an thereby your entire driving system. Make sure it has not infected explorer, if it has you have a very big problem.

If your computer won\'t start after trying to fix the problem (for example you set something wrong), there is a way to manually reset your settings by opening your Comp. I don\'t know much about this virus, but it reminds me of a error that happined when I overinstalled a driver, thereby deactivating my old one leaving my comp corrupt. I don\'t know if any of this helps but if all else fails, delete all (try) infected files, and then format the entire drive. If the virus is still there it was attached to one of the main files. In that case, your best shot is with a virus program.

Hope it helps...

Ahhh... In that case...

I double checked and it seemes the virus was downloaded. This might mean 2 things: one: that is is an installer virus wich uses a spesific file as a host and installes itself as a program, if this is the case one can delete the file or unistall it, but it might get transfered to another place in the prosess so if you locate the host file DESTROY IT with an anti virus program.

second: It might be a link virus. I suppose you have heard of the \"I love you\" virus or \"bug bear\"? both are activated when you open their infected e-mail. They find a host file and spread if activated. But what is spechal is the way they penetrate the system. By infecting an important file they can link to all other files related to it. Hence the name \"link virus\". If this is the case, you can bet its in an all important exe file like explorer or something controlling most of your computer like windows.

I\'ll post more on it if anyone finds it usefull.

I\'ve been have a internet problem. It says \"Action Canceled\". Always. Can anyone help? It\'s not AOL, I figure I undid some settings that were important. BTW, i\'m at school posting this now.

User.exe is also very important, as it controls a LOT of things, namely anything Control Panel, and some older programs depend on it.

And, yes, if there\'s one file you DON\'T want corrupt, it\'s kernel32, as that\'s the OS core.
But any corrupt system files can be corrected by getting the files in question extracted from the CD and replacing them in C:\\Windows\\System directory manually through a boot disk (clicky here if you need one), getting you into DOS so you can start replacing them. I can send you any files you need to replace to avoid a long search through the Win_XX cabs and the über annoying extract command.

Since I\'m at it, if anyone wants to have me check a Hijack log for spy or malware (and possible viruses) go to This part of my boards, and I give all the info for this there.

Well, that\'s all for now,
Unknown

[EDIT]
Firstly, you\'re using IE, correct? It\'s a possibility that there could be a browser hijack (in which case you probably will want to get a HiJack Log, see above link) which or something\'s been added to your hosts file kicking you off some sites. Getting \"Action Canceled\" shouldn\'t happen unless you hit the Stop button (or the ESC key)
Hope that helps you some.

[Edited on 2/24/2004 by Unknown_Entity]

I\'ve run a lot of virus scans and none of them seem to be finding the problem or the virus in question. The system file checker says that nothing appears corrupt.

The other problem I have besides the exe failures is the fact that some websites will cause \"DDHELP\" to perform the same illegal operation that my exe files do before it forces me to close the browser window. As soon as I do so, Explorer performs an illegal operation and then I need to restart.

Pocket: do you know the name of the virus? If you do, you can search for it with serch or others (dos i think). I found my virus that way. Some Icon changing thing called Worm/Stator. It installed a picture of a girl and changed all exe program icons to Jnes. Who in the world even consider taking the time to make something like that

I don\'t even know if it is a virus that\'s causing the problems because 1 out of 20 times I try to open an exe file (including icq) I can access it properly until I close it and try again.

You may have to reformat because this is sounding like a really impossible virus to find.

(My father\'s computer was infected with a virus that was so difficult to find, but somehow, my brother was able to find it and the virus was removed. Unfortunately, the virus destroyed the hard drive.)

maybe the blasterworm virus? i dunno, have you tried the AVG virus scanner?

I\'ve only tried the antivirus programs that were suggested in this thread so far. More suggestions and links to other online scans would be very helpful. I don\'t know if it\'s the blasterworm and reformatting is not an option at this time.

Yeah, that\'s a good free installable virus scanner, but the Blaster does not affect 98. It\'s designed against the NT Core (Win NT, 2000 and XP people, that means YOU) So it\'s not that. The Blaster makes the comp restart by crashing the RPC service (only in NT, and very vital to it)

As I\'M even beginning to run outta ideas, Kia\'s got a plan. If you\'ve got your 98 CD handy, back up what you need, boot to DOS from a floppy, reformat the C: Drive and install 98 again.

[Edited on 2/24/2004 by Unknown_Entity]

Better safe than sorry.

You better hope the virus isn\'t destroying your hard drive.

Pretend I\'m mostly computer illiterate (because I am) and explain to me what this booting and reformating will do exactly...

I fear losing many programs / saved files that I have worked very hard to achieve.

Firstly how much you need to back up, cause reformatting\'s gonna wipe your HD clean, which is sure to get ridda the virus, but also the \'last resort\' method to fixing it.

You\'ll need to make a boot disk (which you can make from Add/remove programs considering you can get there, if not go to www.bootdisk.com)

And after this is done, you\'re gonna get a buncha stuff to prevent such things from occuring:D

Ok, reformatting is DEFINTELY not an option. I\'d rather run though every available antivirus scan I can get a hold of rather than reformat.

My friend found a description of what I got hit with and why it was so hard to find.

READ THIS FOR YOUR OWN SAFETY