PLEASE HELP-comcast worm or virus

Question

I sure hope I can get some advice here.  Starting yesterday, when I go to use my laptop for internet access, a screen pops up which reads 'Welcome to Comcast....' and gives a one-page intro to high-speed internet access.  It is NOT real, and I do not use Comcast in any form, and I cannot rid myself of it.  No matter what page I try to pull up, whether by icon or by typing it in, I get the same screen, reloading itself.  I cannot access my messenger, nor e-mail, and have not had any luck researching what exactly this is and how to rid myself of it.  I will purchase indicated Virus Removal software, as needed, but I am concerned that I get the correct brand/remedy, and also wonder how I can get updates.  If the problem is too new for off-the-shelf virus removal, how can i even call up the updates from the internet, if I can't get past this fake comcast screen?

ky331 · Answer

Preliminary note: When attempting the following directions, if you can't access the internet or perform the indicated download of HiJackThis (HJT) on your "infected" machine, you should download it onto another "good" machine (a friend's, or one at work?), then transfer it via floppy (it's a tiny file) [or memory stick, or CD-R/W] to the infected machine, run the extracted .EXE file on the infected machine, and finally transfer the generated log over to the good machine, to post your log online.

Download a self-extracting copy of the latest version of HJT (HiJackThis) (version 1.99.1) from

http://downloads.malwareremoval.com/hijackthis_sfx.exe

Save it to your Desktop.

Double-click on the file hijackthis_sfx.exe file, and allow it to self-extract [by clicking on UnZip] into the suggested/default folder,

C:\Program Files\HijackThis

Use Windows Explorer to navigate your way into this folder, and then double click on HiJackThis. exe

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.

Hopefully, one of the HJT experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. While it's completely safe for you to download, generate, and post your log (as described above), you should *NOT* attempt to do anything else (in particular, do NOT use it to delete/fix any entries) until you are advised to do so by a forum expert!! Improper use of this tool can severely damage your system.

pemurray · Answer

One more thing. I asked the guy at Comcast if the 'Welcome to Comcast' page was coming from the hard drive or the Internet? He said, 'It is definately coming from the Internet.'

It is just like when you turn on your Wi-Fi enabled laptop in a hotspot that requires that you pay for the service. You can type in any URL you like, but you are still going to end up on the page where you enter your credit card number to continue.

The problem with Comcast is that they don't tell you that your modem is stuck in 'registration' because they inadvertently deactivated you!!

pemurray · Answer

Maybe I can shed some light on this.  First it is not a virus.   I just spent four hours last night and another four hours tonight trying help my mom get her CallVantage Internet Phone service back up and running.   We did everything.  Checked the wiring, power cycled the modem and router in the right order, and nothing.   Then I had my mom log into CallVantage.com to reactivate her TA.  She couldn't get anything but the 'Welcome To Comcast' screen.  I did a quick search, found this forum and told my mom not to disable her firewall or anti-virus.   I did an online chat with Comcast support and was told that her modem was deactivated (and no they couldn't tell me more because I was not the account holder).   I then called Comcast, got a nice guy on the phone named Adam who said yes, the modem was deactivated, and okay, here goes, its fixed now.   I thanked him, called my mom back, had her reactivate her TA at callvantage.com and the phone worked fine.   I then called Comcast, asked for a supervisor and told her that they shouldn't be inadvertently deactivating modems for clients who pay their bills.  I said the 'Welcome To Comcast' screen should state, 'If you are on this page, there may be a problem.  Call Comcast at 1-800-Comcast'.   Right?  If you type in www.callvantage.com and you get 'Welcome To Comcast', that's not right!!   As an aside, Debbie (employee id 7172) was only moderately apologetic that my mom (age 76) spent many hours crawling under her desk rewiring everything per CallVantage because nobody know that Comcast had shut her down.  I was unhappy because I spent 4 hours on Friday night and another 4 hours on Saturday night trying to work things through with my mom via the phone.  Debbie, though, did not seem concerned and could promise nothing as she was only a technical support supervisor for Comcast.  I suggested that she consider a career change.   PEM

ky331 · Answer

sorry to hear about all the problems you and you mom were experiencing. unless you just felt the need to "vent" out of "frustration", there's nothing now that's related to Dell, nor virus/spyware.

bottom line: your mom's problem has been fixed, yes?

EDIT: I hadn't noticed that the last reply was from a different person ( pemurray ) than the original poster ( mahleezah )... so i take it, you're offering your "experience" here as a potential solution to the problem.

Message Edited by ky331 on 01-22-200608:06 AM

Message Edited by ky331 on 01-22-2006 08:06 AM

pemurray · Answer

To: KY331

Yes that is exactly right.

I had the exact same problem and did a google search and found this thread.

I am posting so that others who search for this problem will not think they have a virus. When the Comcast modem is 'deactivated' it still works. I think they have a DNS trap on their end that simply routes all traffice to their home page "Welcome To Comcast".

Our friend who did the original post, probably did not know that the ISP for whereever he was is Comcast and that they communicate poorly.

Below is the record of the chat session with Comcast:

chat id : 9d512d5d-57c6-4605-8e48-82a1bd1c8c19

Problem : Comcast.net Site/Lost/Forgot my Comcast.net password

Gloria > Hello, I am trying to help my 76 year old mom get on the internet. She is on the phone with me but is two hours south in Barnegat, NJ. Everytime that I hhave her type a URL into the IE address bar, it just says welcome to Comcast. Is this a virus or are you guys doing that? She says she has never seen it before and that when she clicks on install, it tells her to disable her anti-virus and firewall which doesn't sound cool.

Lois.12435 > May I have your name, please?

Gloria > Paul

Lois.12435 > HI, Paul

Lois.12435 > I can help you with that, please hold for one moment while I look up your information.

Gloria > thank you.

Lois.12435 > What is her email address?

Gloria > XXXXXXXXX@msn.com but she can't read email because she can't get past the welcome screen (which one board says is a virus).

Lois.12435 > Thank you, can you please hold while I verify your information.

Gloria > sure.

Lois.12435 > Does she have a comcast account?

Gloria > she has a comcast cable modem so I think she has an account...

Lois.12435 > Does she have a router hooked up?

Gloria > yes, a d-link router

Lois.12435 > Sounds like she needs to power-cycle.

Gloria > power cycle the d-link?

Lois.12435 > Hold, please.

Lois.12435 > 1. Shut down your computers

2. Unplug the power cord of your cable modem

3. Unplug the power cord of your router

4. Wait 2 minutes

5. Plug the power cord of your cable modem back in

6. Wait for the online or pc light on the cable modem to turn solid green (This can take up to five minutes)

7. Plug the power cord of your router back in

8. Wait 2 minutes

9. Restart your computers.

Lois.12435 > Please try these suggestions. If you require further assistance with this issue, please contact us at 1-800-COMCAST (266-2278) and an agent will be able to assist you.

Gloria > My mom's Comcast Subscriber Number: XXXXXXX

Lois.12435 > I have documented this chat. If you require further assistance with this issue, please refer to this number:

Lois.12435 > 53782059

Lois.12435 > Thank you

Lois.12435 > Have her follow the above steps, if it does not work, have her call in.

Gloria > We have done this a bunch of times. Where is the fake screen coming from? Why doesn't it just state "web site not found" when she types in www.callvantage.net?

Lois.12435 > Sometimes that comes up if there have been a disconnection or a change on the account.

Gloria > Really we have done it a bunch in trying to get her callvantage phone to work. I can only reach her via her cell phone

Lois.12435 > Here is something else she can try.

Gloria > Is it safe to go through the install steps that it is suggesting?

Lois.12435 > Let me check her modem.

Gloria > Can't we go into dos and ping comcast?

Gloria > okay

Lois.12435 > Sorry, she will need to call 1-800-comcast for technical support.

Lois.12435 > The modem needs to be activated.

Gloria > How do you mean?

Lois.12435 > I can not do that from here.

Lois.12435 > To better assist you we require a more free flowing dialogue, please contact technical support at: 1-800-COMCAST.

Gloria > I have a cable modem and I have never had to activate it

Lois.12435 > This happens sometimes.

Gloria > Please answer the question: is it safe to have my mom go through the installation steps as indicated on your comcast page?

Lois.12435 > They will be happy to help her with this.

Gloria > Every one that talks to my mom always has her changing cables...

Lois.12435 > She can try that, if it does not work, she will have to call in.

Gloria > The light on the d-link router is flashing yellow which means that it IS connected to the internet

Lois.12435 > To better assist you we require a more free flowing dialogue, please contact technical support at: 1-800-COMCAST.

Gloria > you could start, please simply by answer the question about the install from the comcast home page.

Lois.12435 > The modem has been deactivated. I cannot give you anymore informatioon than that as it is not your account.

Gloria > WELL NOW WE ARE GETTING SOMEWHERE. I WISH YOU JUST SAID THAT BEFORE. GOODBYE.

Lois.12435 > Have a great day.

Lois.12435 > Thank-you for contacting Comcast, it has been a pleasure assisting you today. We hope you enjoyed your time online with us.

Virus & Spyware

PLEASE HELP-comcast worm or virus

Was this post helpful?