+Warwagon MVC Posted January 29, 2015 MVC Share Posted January 29, 2015 Just wanted to let everyone know that within the past 2 weeks I've gotten calls from people who have installed a poopack (aka ###### pack of adware) that will break the explorer shell and cause a black screen and cursor on startup. The good news is if you want to remotely connect to them, their internet is fully functional. In my case to get connected to them I have them do a control alt delete. Then have them start the Task Manger.Then have them go to file / New task, and have them type in the web address of my remote assistance software (example www.fastsupport.com) ... this allows them to still download the software and get me connected to their PC even if they can't get the explorer shell. Once connected, in the Task Manager there are 2 processes, both called runonce.exe . Once you kill those the explorer shell auto launches and you get the desktop back. In one case they weren't there, and you just had to kill explorer.exe and manually launch explorer.exe again. After the normal adware cleanup the computer would boot normal. Just a heads up on how to get connected to clean it up. neo158 1 Share Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/ Share on other sites More sharing options...
Intersect Posted January 29, 2015 Share Posted January 29, 2015 Thanks for the heads up on this one, seems easy enough to clear up Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596736572 Share on other sites More sharing options...
sc302 Veteran Posted January 29, 2015 Veteran Share Posted January 29, 2015 easier 3 key salute to enter task manager (easier that ctrl alt del) as it brings you directly to the task manager, not an option screen that has a point and click option to enter the task manager. ctrl shift esc and that key combination is all on the left hand side of the keyboard...works on win 2000 to current. Aergan and +Warwagon 2 Share Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596736658 Share on other sites More sharing options...
+Warwagon MVC Posted January 29, 2015 Author MVC Share Posted January 29, 2015 easier 3 key salute to enter task manager (easier than ctrl alt del) ctrl shift esc and that key combination is all on the left hand side of the keyboard...works on win 2000 to current. Good to know! Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596736662 Share on other sites More sharing options...
Sikh Posted January 29, 2015 Share Posted January 29, 2015 Thanks war for this til. Sc302: I've knwon about ctrl shift esc since xp. Started using it more since vista since ctrl alt delete sent you to that stupid screen with choices. Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596736846 Share on other sites More sharing options...
+Warwagon MVC Posted February 6, 2015 Author MVC Share Posted February 6, 2015 There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread. We all know that Sourceforge started wrapping all its hosted projects in an installer that put shovelware toolbars and the like on unsuspecting users' computers a while back. I'm here to tell you it's gotten really, really bad. Today I got called into a client office with a completely unusable machine - it hung on a blank desktop, not even the wallpaper rendering, forever on user login. The culprit was WSE_Taplika, installed by the SourceForge wrapper when the user downloaded and installed the Filezilla FTP client yesterday. Confirmed through logs and browser history. I took a look at this thing and it is AWFUL. The process hanging the user login was a W32script in a temp folder under the user's Roaming appdata folder, by way of the user's RunOnce regkey. The actual script being run was obfuscated with octal encoding like a php script dropped on a compromised webserver, and the regkey would restore itself automatically if you deleted it, thanks to a watchdog process. http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/ Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596745290 Share on other sites More sharing options...
Sikh Posted February 6, 2015 Share Posted February 6, 2015 There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread. http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/ Every major software distributer like source forge is bundling crap. Its sad but its true. goretsky 1 Share Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596745298 Share on other sites More sharing options...
TAZMINATOR Posted February 6, 2015 Share Posted February 6, 2015 There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread. http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/ FileZilla customers complained to FileZilla creator about it and the forum kept going about it: https://forum.filezilla-project.org/viewtopic.php?f=1&t=31967 I checked the download links on their website by hovering the links and noticed the files are being hosted by Sourceforge. There is no direct links that are hosted by FileZilla.. (not on my end, at least, because I can't find the clean installer.) I guess I will uninstall it and find alternative FTP client. Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596745386 Share on other sites More sharing options...
+Warwagon MVC Posted February 6, 2015 Author MVC Share Posted February 6, 2015 FileZilla customers complained to FileZilla creator about it and the forum kept going about it: https://forum.filezilla-project.org/viewtopic.php?f=1&t=31967 I checked the download links on their website by hovering the links and noticed the files are being hosted by Sourceforge. There is no direct links that are hosted by FileZilla.. (not on my end, at least, because I can't find the clean installer.) I guess I will uninstall it and find alternative FTP client. The worst are those "uninstallers" which try to install about 5 different apps. I had one yesterday and I had to decline about 5 offers just to get the "Uninstaller" to finish. A woman called me on the phone this morning and I could have finished the sentience for her. She said ... "My daughters computer came with a 30 day trial of mcafee, I uninstalled it and installed that one you put on your systems, avast." ... What I wanted to tell her is "And now your system has a bunch of popups" .. She said ... "Now my system has a bunch of stuff popping up all over the place" ... Yep, she googled for it... and hit a poo pack. Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596745388 Share on other sites More sharing options...
TAZMINATOR Posted February 6, 2015 Share Posted February 6, 2015 The worst are those "uninstallers" which try to install about 5 different apps. I had one yesterday and I had to decline about 5 offers just to get the "Uninstaller" to finish. Creator should have added donate button on their software.. Pretty simple. And remove sourceforge hosting links from their website. So creator can gain the trust back. It's very lame to add options to the installer and decline apps during the installation... It's so 90's. I have seen other softwares that have donate buttons these days now. Which is good. Paint.net, for example. Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596745400 Share on other sites More sharing options...
remixedcat Posted February 7, 2015 Share Posted February 7, 2015 I have an old clean build of filezilla if y'all want it... None of that malware mess.. Its pretty dated but it works and twerks Link to comment https://www.neowin.net/forum/topic/1245132-poopack-causing-black-screen-with-cursor-on-startup/#findComment-596746082 Share on other sites More sharing options...
.thumb.jpg.958469f789995895cc0de1fb3c106d00.jpg)
Recommended Posts