Re: Spyware Infection
David H. Lipman
| Hi out there, for the past 3 months ive been receiving this pop up stating
| that windows is infected with spyware and to click the balloon to prevent it.
| Ive ran spyware apps, updated windows till it couldnt be updated anymore and
| still nothing...its a little red circle on my start bar with a white "X" in
| the middle of it. I click it and nothing happens...any other
| suggestions...Thank You
To get the *best* responce to target the malware effectively, please respond with the EXACT
(word for word) text of the pop-up stating " that windows is infected with spyware and what
is the URL that you are directed to for its removal.
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
PA Bear
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.**
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org
Frank Saunders, MS-MVP OE
news:62E64DBF-9105-4C63...@microsoft.com...
> Ok, the message says: Windows has detected spyware infection! It is
> recommended to use special antispyware tools to prevent data loss. Windows
> will now download and install the most up to date antispyware for you.
> Click
> here to protect your computer from spyware. But when i click on the
> balloon,
> it disappears and nothing happens... no new web browser pops up to direct
> me
> anywhere :-(
That is not a legitimate Windows message. You are infected. Don't download
that program, it's malware.
So How Did I Get Infected Anyway?
http://www.wilderssecurity.com/showthread.php?t=27971
Help with Hijackware
All MS - MVP Sites.
http://aumha.org/a/parasite.htm
(http://aumha.org/a/quickfix.htm)
http://www.elephantboycomputers.com/page2.html#Removing_Malware
(http://mvps.org/winhelp2002/unwanted.htm)
(http://inetexplorer.mvps.org/darnit.html)
(http://www.mvps.org/sramesh2k/Malware_Defence.htm)
Unexplained computer behavior may be caused by deceptive software.
http://support.microsoft.com/kb/827315
--
Frank Saunders, MS-MVP OE/WM
"Anyone who prefers security over freedom deserves neither."
David H. Lipman
| Ok, the message says: Windows has detected spyware infection! It is
| recommended to use special antispyware tools to prevent data loss. Windows
| will now download and install the most up to date antispyware for you. Click
| here to protect your computer from spyware. But when i click on the balloon,
| it disappears and nothing happens... no new web browser pops up to direct me
| anywhere :-(
Alright then...
Two part reply..
Perform Part 1 then perform Part 2.
If the first two parts don't work, perform the alternate section.
It is suggested that you execute each tool in Normal Mode then in Safe Mode.
If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.
Simple check, look under...
C:\Program Files\Java
The only folder under that folder should be the latest version...
C:\Program Files\Java\jre1.5.0_06
http://www.java.com/en/download/manual.jsp
Part 1
-----------
Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
http://www.bleepingcomputer.com/forums/topic43659.html
Part 2
-----------
Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe
Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.
Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }
A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.
It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.
ALTERNATE:
Part 1
-----------
Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.
http://secured2k.home.comcast.net/tools/AntiPuper.exe
http://forums.mcafeehelp.com/viewtopic.php?t=65072
Part 2
-----------
S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php
Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.
* * * Please report back your results * * *
101scor...@gmail.com
Thanks to all of you guys working for infection removal.
David H. Lipman
> When I detected that my pc is responding slower and it seemed like
> infected then I moved
> to several forums and security sites. among lots of suggestions and lots
> of infection
> removal tool, I selected an automatic removal tool to get rid of my PC
> related problems. I
> free PC. Thanks to all of you guys working for infection removal.
--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp