Unusual Firewall Alerts

  Tatiana 09:56 05 Apr 2004
Locked

I am running McAfee Firewall on Winows 98 SE and have broaband internet access.
After visiting some MP3 download sites, and acquiring numerous viruses in the process (which McAfee VirusScan deleted), I am getting alerts on first boot from the Firewall that Rundll32 and Windows Explorer are trying to access the internet. I block the communication and all seems normal, but I can't think of any reason why these programmes should be trying to access the internet. Do I have some other form of virus / worm / trojan?
I have caried out a full system scan with a fully up to date version of VirusScan and nothing was reported.

  Gongoozler 10:03 05 Apr 2004

You have removed the viruses, but have you removed spyware. Download and run Adaware from Lavasoft click here.

  Tatiana 11:35 05 Apr 2004

I hav AdAware 6 installed, and ran it yesterday and deleted the detected items. I updated it today and ran it again. The updated version found another three items, which I deleted. I have now noticed that a new desktop shortcut has appeared and it's properties show c:\windows\rundll32.exe C:\windows\system\MSA64CHK.DLL,DllMostrar Matrix_CoolMP3. I will delete the icon, but should I also delete the other file - this MSA64CHK.dll? (I'll leave rundll32.exe of course!)

  Â ÑÌÇKÑÂMË 11:41 05 Apr 2004

Looks like a browser hijack attemp by the coolmp3 site i assume you searched there site for mp3s,start in safe mode and scan again see if that cures the problem.As for the dll is this any help click here


Regards.

  Mr. Chips 11:52 05 Apr 2004

Hi,

I have a Netgear DG834 ADSL firewall router.

I have tried to add a new workstation to the network. I can see files accross the network on another WIN98 and an XP Home machine.

I get the ADSL icon up and traffic flows OK.

When I try to access the Internet the browser comes back with
"Forbidden - Access died by Access Control List"

How do I get into this list to OK the new connection to the Internet please?

  The Spires 12:41 05 Apr 2004

It appears to be a dialer the removal instructions are click here

  Tatiana 12:43 05 Apr 2004

Firstly, Mr Chips - I don't think you meant to post your problem in this discussion!

Cool mp3 seemed to be the culprit. I followed the instructions on your link, but AdAware must have removed most of the traces already. I deleted the MSA64CHK.DLL file, but then on re-boot, the machine was stil trying to load the file. A further search of the registry revealled other calls of the DLL. I deleted these calls - one of which refered to Cool mp3, and all now seems well.

Thanks for all your help - don't think I'll bother with 'free' mp3 sites - seems like you get owt for nowt! (except a lot of trouble).

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

WPA2 hack: How secure is your Wi-Fi?

HP’s new Surface Pro rival is designed specifically for Adobe-using designers and artists

Best kids apps for iPhone & iPad

Que faire si son iPhone ou iPad est tombé dans de l'eau ?