User Restrictions in Win98 SE?

Hi,

I was referred here from the Malware Forums.

I *had* been infected with the CoolWWWSearch and Winsoftware.WinAntiVirus2005pro fuglies.

But all infections, according to the malware experts, are now clear.

However, I am still having problems which I can neither explain nor fix.

*Something* is trying to access several adware sites, but is being blocked by PeerGuardian 2.

It is trying to reach ad sites such as Tribal Fusion Inc., EDS Automated Operations, AOL Transit Data Network, ClearBlue Technologies, PSI Fakes Photobkt Split_B, etc.

It tries to access these sites several times a second, all day and night.

Other anomalous events:

The user resources keep going low, even when I am not using the computer.

When I try to access the properties for IE, nothing happens. But when I open the browser and go to Tools and then Properties, the following error appears:

"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system Administrator."

The above message can appear after using Immunize on Spybot, but neither of the boxes related to locking IE or the Control Panel are checked, and the registry entries to which Spybot refers if/ when having this problem, do not exist.

I can no longer get SAS to run, even if I uninstall it, completely remove it from the registry, reboot and re-install.

But one of the biggest and most annoying problems is that my bookmarks (Netscape 4.7) keep multiplying.

I cannot save new bookmarks to the original bookmark file, but the new bookmarks are in one of the spawned copies.

At one point I had over 5000 bookmark files, taking up more than 556 MB of space.

It seems everytime I open the browser, more bookmark files appear (several in one day), even though I do not save new bookmarks.

While my system was being evaluated in the Malware forum, I was not using it, but the bookmarks spawned to 13. Looking at it a moment ago, the number is up to 18.

If anyone can give me a clue as to what is happening and what I need to do to fix it, I would be greatly appreciative.


Many thanx,


Ringo389

 

I can't help with the ongoing infection, but if you want to see what the situation is with Firefox, the last version compatible with Win 98 was 2.0.0.20, and although I can't find it at MG it is available here -

http://www.filehippo.com/download_firefox/tech/5015/

 

Hi Earthling,

Cool handle.

Reminds me of a message I sent to a classmate that ended up being broadcast across the *entire* school network....

Anywho,

I think I may have found some answers....

After searching for multiplying bookmarks, I found that Firefox does indeed address this issue.

Somehow, my bookmark file attributes got changed to "read only." I don't know if that happened when one of the many malware programs I ran, or maybe the infections I had, changed the attributes.

So if anyone is having problems with their bookmarks multiplying, check to see if your bookmark file is "read only." If it is, uncheck that attribute.

So far, I only have one bookmark file. (Keeping fingers crossed.)

It may be that Weatherbug (paid version) is the culprit trying to broadcast to the advertising sites.

I have been running a few tests and the events seem to coincide with Weatherbug running, but I cannot be 100% sure since there are times my internet access on this system is blocked. (Never happened before....)

I am still testing the Weatherbug theory.

As for not being able to access the properties in IE, this one still has me stymied.

I have searched for information regarding restricted access in 98SE, but the only reference I find is regarding Spybot.

And I have checked everything it says to check regarding this problem after using "Immunize" on Spybot, but *if* those conditions exist, it is not in the current configuration, and I can't find out how to un-do what Spybot did since the registry keys to which it makes reference do not exist.

I finally got SuperAntiSpyware to install and run and it, too, seems to have a protective measure for IE. I had it "repair" that entry, to no avail. I'm not even sure it did anything.

SAS came up clean regarding malware, and I hope I can trust the results.

This infection has left me somewhat less than confident regarding the results since it escaped detection on more than one scan.

If anyone has information regarding how to "unlock" IE, I would be most appreciative.

I have yet to try most of the programs on my system, as I was not using it during the cleaning process.

I would like to get this (hopefully) last glitch resolved before I back up the system.


Many thanx,


Ringo389