Poopack causing Black screen with cursor on startup.

[+Warwagon MVC]

Just wanted to let everyone know that within the past 2 weeks I've gotten calls from people who have installed a poopack (aka ###### pack of adware) that will break the explorer shell and cause a black screen and cursor on startup.

 

The good news is if you want to remotely connect to them, their internet is fully functional. In my case to get connected to them I have them do a control alt delete. Then have them start the Task Manger.Then have them go to file / New task, and have them type in the web address of my remote assistance software (example www.fastsupport.com) ... this allows them to still download the software and get me connected to their PC even if they can't get the explorer shell.

 

Once connected, in the Task Manager there are 2 processes, both called runonce.exe . Once you kill those the explorer shell auto launches and you get the desktop back. In one case they weren't there, and you just had to kill explorer.exe and manually launch explorer.exe again.

 

After the normal adware cleanup the computer would boot normal.

 

Just a heads up on how to get connected to clean it up.

[Intersect]

Thanks for the heads up on this one, seems easy enough to clear up

[sc302 Veteran]

easier 3 key salute to enter task manager (easier that ctrl alt del) as it brings you directly to the task manager, not an option screen that has a point and click option to enter the task manager.

 

ctrl shift esc

 

and that key combination is all on the left hand side of the keyboard...works on win 2000 to current.

[+Warwagon MVC]

easier 3 key salute to enter task manager (easier than ctrl alt del)

 

ctrl shift esc

 

and that key combination is all on the left hand side of the keyboard...works on win 2000 to current.

 

Good to know!

[Sikh]

Thanks war for this til.

Sc302: I've knwon about ctrl shift esc since xp. Started using it more since vista since ctrl alt delete sent you to that stupid screen with choices.

[+Warwagon MVC]

There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread.

 

We all know that Sourceforge started wrapping all its hosted projects in an installer that put shovelware toolbars and the like on unsuspecting users' computers a while back.

 

I'm here to tell you it's gotten really, really bad. Today I got called into a client office with a completely unusable machine - it hung on a blank desktop, not even the wallpaper rendering, forever on user login.

 

The culprit was WSE_Taplika, installed by the SourceForge wrapper when the user downloaded and installed the Filezilla FTP client yesterday. Confirmed through logs and browser history. I took a look at this thing and it is AWFUL.

 

The process hanging the user login was a W32script in a temp folder under the user's Roaming appdata folder, by way of the user's RunOnce regkey. The actual script being run was obfuscated with octal encoding like a php script dropped on a compromised webserver, and the regkey would restore itself automatically if you deleted it, thanks to a watchdog process.

 

http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/

[Sikh]

There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread.

 

http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/

 

Every major software distributer like source forge is bundling crap. Its sad but its true. 

[TAZMINATOR]

There is some more info about it here. Mostly this link talks about how sourceforge is now bundling crapware on their installers. But in the post also explains the issue of this thread.

 

 

http://www.reddit.com/r/sysadmin/comments/2ux2uy/sourceforge_has_gotten_really_really_bad/

 

FileZilla customers complained to FileZilla creator about it and the forum kept going about it:

 

https://forum.filezilla-project.org/viewtopic.php?f=1&t=31967 

 

I checked the download links on their website by hovering the links and noticed the files are being hosted by Sourceforge.

 

There is no direct links that are hosted by FileZilla.. (not on my end, at least, because I can't find the clean installer.)

 

I guess I will uninstall it and find alternative FTP client.

[+Warwagon MVC]

FileZilla customers complained to FileZilla creator about it and the forum kept going about it:

 

https://forum.filezilla-project.org/viewtopic.php?f=1&t=31967 

 

I checked the download links on their website by hovering the links and noticed the files are being hosted by Sourceforge.

 

There is no direct links that are hosted by FileZilla.. (not on my end, at least, because I can't find the clean installer.)

 

I guess I will uninstall it and find alternative FTP client.

 

The worst are those "uninstallers" which try to install about 5 different apps. I had one yesterday and I had to decline about 5 offers just to get the "Uninstaller" to finish.

 

A woman called me on the phone this morning and I could have finished the sentience for her. She said ...

 

"My daughters computer came with a 30 day trial of mcafee, I uninstalled it and installed that one you put on your systems, avast." ...

 

What I wanted to tell her is "And now your system has a bunch of popups" ..

 

She said ... "Now my system has a bunch of stuff popping up all over the place"

 

... Yep, she googled for it... and hit a poo pack.

[TAZMINATOR]

The worst are those "uninstallers" which try to install about 5 different apps. I had one yesterday and I had to decline about 5 offers just to get the "Uninstaller" to finish.

 

 

Creator should have added donate button on their software.. Pretty simple.  And remove sourceforge hosting links from their website. So creator can gain the trust back.

 

It's very lame to add options to the installer and decline apps during the installation...  It's so 90's.

 

I have seen other softwares that have donate buttons these days now. Which is good. Paint.net, for example.

[remixedcat]

I have an old clean build of filezilla if y'all want it...

None of that malware mess.. Its pretty dated but it works and twerks