strange login screen when going to tcm.

[Ken_ver_1_5]

I am not real sure what to make of this. I think I may have a virus.
this morning I booted up opened ie it went to my start page my isp
I went to tcm and this log in screen came up.

I thought right away this is not from tcm it must be a virus.

so I updated my norton, spybot, and adawere. rebooted
and scanned. only found a few cookies.

each time I reboot and go to tcm I get this log in screen
but have found nothing so far.

here is my hjt log I don't see nothing new.

Logfile of HijackThis v1.99.0
Scan saved at 9:12:00 AM, on 9/16/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\MIXER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - //a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

[debbie]

I got this one at around 9 am.

[justabitcrazee]

i got it too about 10 mins ago when i came to the page. just push cancel.

[Ken_ver_1_5]

I think I should report this to Deb

[Swordfish]

I didnt get anything like that but let me test

[Dr.Dan]

Hmmm... looks like somone is trying to harvest our passwords... :mad:

I haven't seen this pop up as of yet... but will be sure to ignor it... as everyone else should too!

[andyman]

vbsyles. com is VBuliten skins
try a different style ?

[Swordfish]

I dont think it has anything to do with TCM I just logged in and logged out and no such screen. Best thing I can suggest is run adaware or sybot and check for viruses

[Ken_ver_1_5]

just to be clear here this is not coming from tcm that I know of I just checked
the other board I go to and it doesn't come up even after a reboot.

Yes good advice Dan ignor it.

[Ken_ver_1_5]

I dont think it has anything to do with TCM I just logged in and logged out and no such screen. Best thing I can suggest is run adaware or sybot and check for viruses

I only get it after a reboot.

[frostyone]

Well I run windows 98 too Ken.
I'll reboot and see,
You're using Internet explorer?

[Dr.Dan]

I still haven't seen anything in either N7 or IE6 (updated)...

And what I meant by ignor it was don't log in...

It should be reported to Deb though... just incase it does have anything to do with TCM.

[andyman]

I don't log out .. no need to on this comp

[debbie]

I don't log out .. no need to on this compThat screen popped up after I had and was logged in.

[Ken_ver_1_5]

Well I run windows 98 too Ken.
I'll reboot and see,
You're using Internet explorer?

yes an old ie.

also online scan is good

BitDefender Online Scanner - Real Time Virus Report



Generated at: Fri, Sep 16, 2005 - 09:49:01

Scan Info

Scanned Files
24918

Infected Files
0

No virus found.

[Frogy]

I don't log out .. no need to on this comp


Same here but I'll give it a go.

[andyman]

just tested and no extra log in box
Could it be just Win98 ?

[Frogy]

Nothing here either andyman, could be a 98 issue. See what frostyone has to say. (I'm using FFox as debbie is)

[Deb]

Definitely not coming from us...We haven't changed anything whatsoever over the last while for the board.

[andyman]

right click and go to properties
it does say VBstyles . com in the pics

[Ken_ver_1_5]

it has stopped don't know why or how.
but with all the scans I have done I have nothing on my system.
I haven't installed anything for some time.

thanks for the confirmation Deb.
I knew it wasn't from tcm.

[Swordfish]

I only get it after a reboot.

weird, nothing here but I am running XP with all of the updates and behind a router/firewall

[frostyone]

Just rebooted.
Used IE
Went to TCM.
Logged in as usual.
No strange pop-up.
Windows98SE
IE6

Wonder if it's a popunder from another site?

[YABA]

it happened to me runing xp pro this morning.......said VBstyles

[frostyone]

Anyone get's it again, right click and check properties.
Get an idea where it's coming from.

[Ken_ver_1_5]

I have a suggestion maybe Deb could make a little notice on the front
page telling members to ignore it. or something like that should it return.

as I said I am not getting it now.
I am gonna do a system shut down and see if it is really gone
after a complete power down.

[Frogy]

I wonder if it has something to do with IE5?

[YABA]

I have a suggestion maybe Deb could make a little notice on the front
page telling members to ignore it. or something like that should it return.

as I said I am not getting it now.
I am gonna do a system shut down and see if it is really gone
after a complete power down.

mine is gone as well...its not just u.....find it funny, how we are both having the same prob on different puters, visiting the same site

[Swordfish]

werid, I logged out rebooted changed themes nothing no popup or anything and I have my pop up blocker configured to accept popups from Tcm.

[frostyone]

Yeah, but if the popup is not coming from tcm?

If it's a popunder you can get it only when leaving another site.
It will popup apparently coming from tcm's.
But the true source is the other site.

[leverg]

FYI


I got the same error at around 8:30 and just hit cancel. I'm using W2k, IE6 and have all the latest updates.

[Ken_ver_1_5]

its gone for sure I wish I had right clicked to get the info on it:(

but that was before my morning coffee:)

[Deb]

We do have a banner ad in the rotation from them, maybe they were playing with the code or something. It's the only thing I can think of...