Re: Spyware Infection Notice -- NEED HELP

From: "admannj" <admannj@xxxxxxxxxxxxxxxxxxxxxxxxx>

| I use Windows XP Home with Norton Anti-Virus 2005, Microsoft Anti-Spyware
| Beta 1 and Ad-aware 6. Some how, my computer became seriously infected with
| spyware over the weekend. Still not sure how this happened, but that is
| irrelevant for now.
|
| Anyway, Windows XP Home recognized the spyware issue and replaced my desktop
| image with a black box inside a blue screen with the following text:
|
| SPYWARE INFECTION
| Your system is infected with spyware. Windows recommends you to use a
| spyware removal tool to prevent loss of important data and increase system
| performance. Using this PC before having it cleaned from spyware threats is
| highly discouraged.
|
| After hours of "deep cleaning" via Norton, Microsoft Anti-Spyware an
| Ad-aware, Windows has stopped popping up "infection" messages and I believe
| my system is 100% clean. However, the desktop image still remains. I cannot
| "right-click ... properties" and change my desktop image back to what it was.
|
| Any thoughts / help is GREATLY appreciated.
|
| Thank you.



Two part reply..

Perform Part 1 then perform Part 2.

Use the alternate if the first two parts are ineffective...
Note: Alternate only for Win2K, WinXP and Win2003 Server

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.

Alternate:

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


.

Relevant Pages

  • Re: Computer Hijacked
    ... Ad-aware is a fine program, but you need more than just one spyware ... run CWShredder and HijackThis from http://aumha.org/freeware.htm. ... Do not install driver updates from Windows ...
    (microsoft.public.security.virus)
  • Re: using search, locks me up???
    ... Use Ad-Aware, MSAS and/or Spybot Search & Destroy to remove it. ... LSPFix- all versions of Windows http://www.cexx.org/lspfix.zip ... Ad-Aware and Microsoft Anti-spyware- removed the spyware. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: adware(flashtrack)
    ... It seems as if there is much more spyware around. ... Ad-aware is a program to help find and remove adware/spyware/malware. ... Adware is advertising supported software. ... MS-MVP Windows Shell/User ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: IE7 and OE "freezes" when both open
    ... You may be seeing the effects of a hijackware infection! ... Format & reinstall Windows. ... Spyware Warrior: Help with spyware removal ... How many messages are located in your Inbox folder right now? ...
    (microsoft.public.windowsxp.general)
  • Re: Wast.exe file
    ... It's a spyware component. ... The following file is supposed to fix the problem on Windows 2000 and XP" ... >>Ad-Aware should help with this problem. ... >>Outgoing mail is certified Virus Free. ...
    (microsoft.public.windowsxp.general)