• Sign in to Neowin Faster!

    Create an account on Neowin to contribute and support the site.

  • 0
Sign in to follow this  

Poopack causing Black screen with cursor on startup.

Question

+warwagon    13,366

Just wanted to let everyone know that within the past 2 weeks I've gotten calls from people who have installed a poopack (aka ###### pack of adware) that will break the explorer shell and cause a black screen and cursor on startup.

 

The good news is if you want to remotely connect to them, their internet is fully functional. In my case to get connected to them I have them do a control alt delete. Then have them start the Task Manger.Then have them go to file / New task, and have them type in the web address of my remote assistance software (example www.fastsupport.com) ... this allows them to still download the software and get me connected to their PC even if they can't get the explorer shell.

 

Once connected, in the Task Manager there are 2 processes, both called runonce.exe . Once you kill those the explorer shell auto launches and you get the desktop back. In one case they weren't there, and you just had to kill explorer.exe and manually launch explorer.exe again.

 

After the normal adware cleanup the computer would boot normal.

 

Just a heads up on how to get connected to clean it up.

  • Like 1

Share this post


Link to post
Share on other sites

10 answers to this question

Recommended Posts

  • 0
Intersect    239

Thanks for the heads up on this one, seems easy enough to clear up :)

Share this post


Link to post
Share on other sites
  • 0
sc302    1,770

easier 3 key salute to enter task manager (easier that ctrl alt del) as it brings you directly to the task manager, not an option screen that has a point and click option to enter the task manager.

 

ctrl shift esc

 

and that key combination is all on the left hand side of the keyboard...works on win 2000 to current.

  • Like 2

Share this post


Link to post
Share on other sites
  • 0
+warwagon    13,366

easier 3 key salute to enter task manager (easier than ctrl alt del)

 

ctrl shift esc

 

and that key combination is all on the left hand side of the keyboard...works on win 2000 to current.

 

Good to know!

Share this post


Link to post
Share on other sites
  • 0
Sikh    192

Thanks war for this til.

Sc302: I've knwon about ctrl shift esc since xp. Started using it more since vista since ctrl alt delete sent you to that stupid screen with choices.

Share this post


Link to post
Share on other sites
  • 0
+warwagon    13,366

There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread.

 

We all know that Sourceforge started wrapping all its hosted projects in an installer that put shovelware toolbars and the like on unsuspecting users' computers a while back.

 

I'm here to tell you it's gotten really, really bad. Today I got called into a client office with a completely unusable machine - it hung on a blank desktop, not even the wallpaper rendering, forever on user login.

 

The culprit was WSE_Taplika, installed by the SourceForge wrapper when the user downloaded and installed the Filezilla FTP client yesterday. Confirmed through logs and browser history. I took a look at this thing and it is AWFUL.

 

The process hanging the user login was a W32script in a temp folder under the user's Roaming appdata folder, by way of the user's RunOnce regkey. The actual script being run was obfuscated with octal encoding like a php script dropped on a compromised webserver, and the regkey would restore itself automatically if you deleted it, thanks to a watchdog process.

 

http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/

Share this post


Link to post
Share on other sites
  • 0
Sikh    192

There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread.

 

http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/

 

Every major software distributer like source forge is bundling crap. Its sad but its true. 

  • Like 1

Share this post


Link to post
Share on other sites
  • 0
TAZMINATOR    12,416

There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread.

 

 

http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/

 

FileZilla customers complained to FileZilla creator about it and the forum kept going about it:

 

https://forum.filezilla-project.org/viewtopic.php?f=1&t=31967 

 

I checked the download links on their website by hovering the links and noticed the files are being hosted by Sourceforge.

 

There is no direct links that are hosted by FileZilla.. (not on my end, at least, because I can't find the clean installer.)

 

I guess I will uninstall it and find alternative FTP client.

Share this post


Link to post
Share on other sites
  • 0
+warwagon    13,366

FileZilla customers complained to FileZilla creator about it and the forum kept going about it:

 

https://forum.filezilla-project.org/viewtopic.php?f=1&t=31967 

 

I checked the download links on their website by hovering the links and noticed the files are being hosted by Sourceforge.

 

There is no direct links that are hosted by FileZilla.. (not on my end, at least, because I can't find the clean installer.)

 

I guess I will uninstall it and find alternative FTP client.

 

The worst are those "uninstallers" which try to install about 5 different apps. I had one yesterday and I had to decline about 5 offers just to get the "Uninstaller" to finish.

 

A woman called me on the phone this morning and I could have finished the sentience for her. She said ...

 

"My daughters computer came with a 30 day trial of mcafee, I uninstalled it and installed that one you put on your systems, avast." ...

 

What I wanted to tell her is "And now your system has a bunch of popups" ..

 

She said ... "Now my system has a bunch of stuff popping up all over the place"

 

... Yep, she googled for it... and hit a poo pack.

Share this post


Link to post
Share on other sites
  • 0
TAZMINATOR    12,416

The worst are those "uninstallers" which try to install about 5 different apps. I had one yesterday and I had to decline about 5 offers just to get the "Uninstaller" to finish.

 

 

Creator should have added donate button on their software.. Pretty simple.  And remove sourceforge hosting links from their website. So creator can gain the trust back.

 

It's very lame to add options to the installer and decline apps during the installation...  It's so 90's.

 

I have seen other softwares that have donate buttons these days now. Which is good. Paint.net, for example.

Share this post


Link to post
Share on other sites
  • 0
remixedcat    2,767

I have an old clean build of filezilla if y'all want it...

None of that malware mess.. Its pretty dated but it works and twerks

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.