TechSpot

Background Spyware Warning and Popups

By Hitman220
Mar 6, 2008
  1. I have been reading a thread on here and another place. I have a blue background screen with a Spyware warning. I also get the little popups from windows warning that my system is infected. MS Internet Explorer Pops up and goes to several sites to download software and also goes to porn sites, pharmacy and dating sites. I do not use explorer I use Firefox.

    I have tried all the suggestions here. It is not a web page warning. I go into explorer and delete it or change it, it will come right back. It is listed as mywallpaper.bmp

    I have used Hijack this and found only one file according to a list I got. I have used Smitfraudfix option 2 which is suppose to erase the background and windows popup. It has not worked. I have used ATF Clean, CCleaner, and AVG antispyware.

    I have cleaned the registry and noticed that soon after I clean it, there are already new items being written to it again. I keep cleaning it for now. I hope someone has the answer, I will keep researching and if I find it I will post it here.
    Thank you to everyone who may help.
     
  2. kritius

    kritius TS Guru Posts: 2,084

    You need to follow all the steps HERE.

    Post back with the three requested logs as attachments. (see how here) And dont forget to let us know the results of the rootkit scan.

    Also its not really a good idea to post your e mail in a public forum unless your a fan of spam.
     
  3. Hitman220

    Hitman220 TS Rookie Topic Starter

    HiJack This Log. Crusty

    I did everything recommended. Hope you get the attached log.
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    In addition, make sure the Windows Messenger Service is disabled. This in not an IM Service- it is for the Administrator to communicate with other systems on the network. But unethical malware uses a screen that appears to be coming from this to trick the user into clicking a rogue site:

    Control Panel> Administrative Tools> Services> scroll down to and right click on Messenger> Properties> change the Startup mode to Disable and Stop the Service. This will at least prevent it's appearance.

    Someone will review the hijack log.
     
  5. Hitman220

    Hitman220 TS Rookie Topic Starter

    Thank you

    So far the advise I have been getting sounds good. I do not use MS Messenger but I do use yahoo and I have disconnected that since I saw the spyware blocking a change for yahoo.
     
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    "I do not use MS Messenger but I do use yahoo"

    Did you not understand that I was NOT referring to the MS Messenger? The Windows Messenger Service is NOT the MS Messenger.
     
  7. kritius

    kritius TS Guru Posts: 2,084

    Where are the combofix and AVG antispyware logs?
     
  8. Hitman220

    Hitman220 TS Rookie Topic Starter

    Blue Screen Spyware Warning and Iexplorer Pop Ups

    I thank you for your support. I found it with a little help here. This is how I got rid of it. I ran the Hijack This and only found one file on a previous list here. I ran a couple of spyware removers recommended here. I erased mybackground for the blue screen and it continued to come back. It was not until I used the Spyware program Spybot Search and destroy that I realized changes kept coming in from the internet to put that warning screen back. Do not use Norton....Long story.... Trend Micro On-line would not work to clean without shutting down my computer. It showed me the problems....I eventually used the trial version of McAfee which found the virus problem and some additional spyware. Kept the spybot on until after you download McAfee.and only accept the McAfee changes which will be clear. I then shut down all the antispyware programs I ran and ran McAfee. It came up with several of the problems including the smitfraud program as dangerous. Another file was Windows\system32\Process.ex Since the McAfee there has not be a single problem. The trial version is free, I also down loaded the firewall protection. I had windows firewall on when this happened and never had a warning. Spybot and McAfee have fixed the problem. Be sure to shut down or erase all the programs you downloaded except spybot or you will have a bunch of pop ups for everthing coming in. At the present time I have just McAfee running and manually use spybot to double check things. For the last 2 days computer on 24 hrs no problems. Nice backround and no pop ups. Thanks for the help I did get. Oh! Norton wanted $100.00 to fix the problem manually that McAfee found.
     
  9. remedy120

    remedy120 TS Rookie

    um hello?

    can some one help me. my dell win 2000 is infected with spyware im told.
    when ever i try to log into the computer the computer restarts after 5 seconds
    what can i do?

    im i posting this in the right place?
    i dot do this stuff alot =/
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...