Unauthorised Downloading.

Try turning your firewall off for just little while and try scanning your computer with these two online scans: GRC's Shields UP! at www.grc.com/x/ne.dll?bh0bkyd2 and Symantec's Security check at www.symantec.com/securitycheck run the "Security Scan". When you visit GRC do the "All Service ports". Report back any open ports that you find. You might also try the trial of TDS3 as mentioned before and try these options... In the Plugins menu click "common ports check" and "trojan ports check".

 

Thank you all for your generous help. I've taken all recommended actions, save the update advise (Microsoft said I needed 256MB worth, it'd take forever with dialup) and the Firefox alternative.
The original problem still persists, but only when I change the IE default from "msn.com" to "blank". Then the big download + the 2 files. If I leave the IE default as msn.com - no big downloads.
To this novice it certainly seems that Bill Gates and his merry men have hijacked my IE default page. I'm beginning to understand those guys at microsuck !
The upgraded Spybot was a great help (thanks) - it found a VBouncer, I delete but it keeps coming back.
Now, I only despair at the learning curve I'm facing. It sure looks very steep and long from down here.
/ H

 

Can you take the following steps:

Step 1. Install Zone Alarm (free) – Firewall with visual outgoing alerts to see what is trying to access the internet.
http://www.zonelabs.com

Step 2. Install and run CWShredder available here:
https://www.wilderssecurity.com/showthread.php?t=14086

Step 3. Install and run Stinger available here:
http://vil.nai.com/vil/stinger/

Step 4. Reset you Internet Home Page to www.google.com by doing the following:
Internet Explorer> Tools> Internet Options> Home Page or
Firefox> Tools> Options> General. Home Page

See if the above stops your problem...

Let us know how you go…

Cheers

 

Hi Hans

Regarding VBouncer, i read somewhere that it copies itself to C:\Windows\TEMP\ , so perhaps this is why it keeps coming back, here's a Link ( at the bottom), to manual removal ( remember to delete tempfolder). Another thing you might do, is to update al your security-software ( Trend, Ad-Aware, Spybot and TDS-3 trial i believe it is?) and boot into Safemode , run full scan's with all four, this will take some time ofcourse, and see what come's up. Good luck.

 

Appologize in advance if I have missed this but do you have Automatically check for Internet Explorer updates checked in the Advanced options of IE ? That option checked and the part about it going to MSN.com rings a bell !

 

In the time that has passed, service pack 2 has come out and it is pretty big. Since you don't have service pack one, it is a monster download. However, you can get a cd with all of the updates mailed to you for free from Microsoft. I got mine in about a week even though it said 4 to 6 weeks. Click here for the CD: http://www.microsoft.com/windowsxp/downloads/updates/sp2/cdorder/en_us/default.mspx

 

Thanks everybody,
Your patience and helpfulness are absolutely fantastic for novices like myself.

To answer some questions -
- No auto updates are active.
- I have PC-Cillin, Spybot, Ad-Aware, CWShredder, rbkiller and now Stinger. I use 'em 3 to 5 times a week and check for updates each time.
- I have also run TDS-3, Belarc and Port Explorer (didn't understand the result from the last one).

I must say the mere thought of turning off the firewall makes me shudder. It rejects several attempts per minute acc to the log.

I also don't understand the reason for trying to reset the default page to Google. Isn't that like stepping from one cow pat into another?
/ H