PDA

View Full Version : strange login screen when going to tcm.

Ken_ver_1_5
09-16-2005, 10:20 AM
I am not real sure what to make of this. I think I may have a virus.
this morning I booted up opened ie it went to my start page my isp
I went to tcm and this log in screen came up.

I thought right away this is not from tcm it must be a virus.

so I updated my norton, spybot, and adawere. rebooted
and scanned. only found a few cookies.

each time I reboot and go to tcm I get this log in screen
but have found nothing so far.

here is my hjt log I don't see nothing new.

Logfile of HijackThis v1.99.0
Scan saved at 9:12:00 AM, on 9/16/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\MIXER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\PROGRAM FILES\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - //a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
debbie
09-16-2005, 10:24 AM
I got this one at around 9 am.
justabitcrazee
09-16-2005, 10:25 AM
i got it too about 10 mins ago when i came to the page. just push cancel.
Ken_ver_1_5
09-16-2005, 10:31 AM
I think I should report this to Deb
Swordfish
09-16-2005, 10:35 AM
I didnt get anything like that but let me test
Dr.Dan
09-16-2005, 10:35 AM
Hmmm... looks like somone is trying to harvest our passwords... :mad:

I haven't seen this pop up as of yet... but will be sure to ignor it... as everyone else should too!
andyman
09-16-2005, 10:37 AM
vbsyles. com is VBuliten skins
try a different style ?
Swordfish
09-16-2005, 10:38 AM
I dont think it has anything to do with TCM I just logged in and logged out and no such screen. Best thing I can suggest is run adaware or sybot and check for viruses
Ken_ver_1_5
09-16-2005, 10:39 AM
just to be clear here this is not coming from tcm that I know of I just checked
the other board I go to and it doesn't come up even after a reboot.

Yes good advice Dan ignor it.
Ken_ver_1_5
09-16-2005, 10:41 AM
I dont think it has anything to do with TCM I just logged in and logged out and no such screen. Best thing I can suggest is run adaware or sybot and check for viruses

I only get it after a reboot.
frostyone
09-16-2005, 10:46 AM
Well I run windows 98 too Ken.
I'll reboot and see,
You're using Internet explorer?
Dr.Dan
09-16-2005, 10:48 AM
I still haven't seen anything in either N7 or IE6 (updated)...

And what I meant by ignor it was don't log in...

It should be reported to Deb though... just incase it does have anything to do with TCM.
andyman
09-16-2005, 10:49 AM
I don't log out .. no need to on this comp
debbie
09-16-2005, 10:52 AM
I don't log out .. no need to on this compThat screen popped up after I had and was logged in.
Ken_ver_1_5
09-16-2005, 10:54 AM
Well I run windows 98 too Ken.
I'll reboot and see,
You're using Internet explorer?

yes an old ie.

also online scan is good

BitDefender Online Scanner - Real Time Virus Report



Generated at: Fri, Sep 16, 2005 - 09:49:01

Scan Info

Scanned Files
24918

Infected Files
0

No virus found.
Frogy
09-16-2005, 10:55 AM
I don't log out .. no need to on this comp


Same here but I'll give it a go.
andyman
09-16-2005, 10:56 AM
just tested and no extra log in box
Could it be just Win98 ?
Frogy
09-16-2005, 10:58 AM
Nothing here either andyman, could be a 98 issue. See what frostyone has to say. (I'm using FFox as debbie is)
Deb
09-16-2005, 10:59 AM
Definitely not coming from us...We haven't changed anything whatsoever over the last while for the board.
andyman
09-16-2005, 11:02 AM
right click and go to properties
it does say VBstyles . com in the pics
Ken_ver_1_5
09-16-2005, 11:09 AM
it has stopped don't know why or how.
but with all the scans I have done I have nothing on my system.
I haven't installed anything for some time.

thanks for the confirmation Deb.
I knew it wasn't from tcm.
Swordfish
09-16-2005, 11:13 AM
I only get it after a reboot.

weird, nothing here but I am running XP with all of the updates and behind a router/firewall
frostyone
09-16-2005, 11:14 AM
Just rebooted.
Used IE
Went to TCM.
Logged in as usual.
No strange pop-up.
Windows98SE
IE6

Wonder if it's a popunder from another site?
YABA
09-16-2005, 11:16 AM
it happened to me runing xp pro this morning.......said VBstyles
frostyone
09-16-2005, 11:18 AM
Anyone get's it again, right click and check properties.
Get an idea where it's coming from.
Ken_ver_1_5
09-16-2005, 11:19 AM
I have a suggestion maybe Deb could make a little notice on the front
page telling members to ignore it. or something like that should it return.

as I said I am not getting it now.
I am gonna do a system shut down and see if it is really gone
after a complete power down.
Frogy
09-16-2005, 11:20 AM
I wonder if it has something to do with IE5?
YABA
09-16-2005, 11:23 AM
I have a suggestion maybe Deb could make a little notice on the front
page telling members to ignore it. or something like that should it return.

as I said I am not getting it now.
I am gonna do a system shut down and see if it is really gone
after a complete power down.

mine is gone as well...its not just u.....find it funny, how we are both having the same prob on different puters, visiting the same site
Swordfish
09-16-2005, 11:25 AM
werid, I logged out rebooted changed themes nothing no popup or anything and I have my pop up blocker configured to accept popups from Tcm.
frostyone
09-16-2005, 11:32 AM
Yeah, but if the popup is not coming from tcm?

If it's a popunder you can get it only when leaving another site.
It will popup apparently coming from tcm's.
But the true source is the other site.
leverg
09-16-2005, 11:35 AM
FYI


I got the same error at around 8:30 and just hit cancel. I'm using W2k, IE6 and have all the latest updates.
Ken_ver_1_5
09-16-2005, 11:37 AM
its gone for sure I wish I had right clicked to get the info on it:(

but that was before my morning coffee:)
Deb
09-16-2005, 11:45 AM
We do have a banner ad in the rotation from them, maybe they were playing with the code or something. It's the only thing I can think of...