Warning: Spyware threat has been detected on you PC

Status
Not open for further replies.
They look good, able to get into the task manager yet?

You should get a firewall as well, either, these firewalls are all free, (I recommend Comodo)

I would like you to do an online scan so that we can what else may be in your system,
Run Kaspersky online scanner
With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
Do not go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.

Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    o Scan using the following Anti-Virus database:
    o Extended (If available, otherwise use standard)
    o Scan Options:
    o Scan Archives
    o Scan Mail Bases
  • Click OK
  • Under select a target to scan, select My Computer
  • The scan will take a while so be patient and let it run.
  • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
  • Click the Save Report As... button (see red arrow below)

    Kas-SaveReport-1.gif

  • In the Save as... prompt, select Desktop
  • In the File name box, name the file
  • In the Save as type prompt, select Text file (see below)

    Kas-Savetxt.gif

  • Attach the report in your next post.

Do not delete anything it finds yet
 
i am able to get into task manager. still getting the same error message when i try to d/l a program from yesterday (noticed when i need ccleaner). been using my roommates laptop and my external hd to transfer the programs to my cpu. after we get settled i'll grab Comodo or whenever you think it's best to d/l it.

getting started on the online scan. let you know if i run into trouble.
 
i noticed the error when i tried to d/l the ccleaner. got the ie cannot download ____.exe message.....cannot be found - try again later. everything you've asked me to use i've been grabbing from my mates laptop and transfering to the infected cpu.
 
i'll just let it run if it will be that long. gonna run out for real this time, it's my birthday today and this was not on my agenda of great things to do on my b-day. i'll check back with you later and update you. most likely round 6pm eastern time. thanks for all your help this morning...
 
thanks for the b-day wishes. got home and the scan was finished. attached the log. did not close out of the online scan window, not sure if you need anything else from the program before i close it. let me know where to from here or what i should do next.
 
Not really sure how your going to take this.......but...........your all clean!!!!

Uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
  • CF_Cleanup.png
You can also delete any logs we have produced, and empty your Recycle bin.

Now we can remove the tools that we used.

Please download OTMoveIt2 and save it to desktop.
  • Double-click OTMoveIt2.exe.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt2 attempting to contact the internet, please allow it to do so.

  • Disable and Enable System Restore. - If you are using Windows XP or Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and re-enable system restore here:

    Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

    This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

    Instructions for Spybot S & D

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
  • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
    Using Winpatrol to protect your computer from malicious software

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Your logs are all clean, so were just going to have to wait and see about the browser troubles.
 
having no pblms now. can d/l programs and install with no more try again errors. finished almost everything. adjusted all the settings in IE, updated avg, updated windows, installed spybot (configured & scanned cpu), installed spyblaster and configured, also d/led and installed comodo. did not grab mvps hosts or winpatrol (still a good idea?) and also will shortly swith to firefox. thank you so much for your help. is there anything else you suggest i do to prevent this from happening again? i'll try to keep better track of these issues in hopes of not getting to this point again! eternally grateful!
mike
 
The list I provided is your best bet, I would get the host file though, one of the problems that you had was that the hosts file was corrupted.

And your very welcome, all the best with everything.
 
i will be sure to grab the host file sometime tonight. quick question after all the programs i've installed there's a few sites that i frequent that i immediately receive the IE cannot display webpage after after trying to load a few seconds. mostly netflix.com, imdb.com & liveblackcrowes.com. this happens as i try to log in. also some of my bittorrent sites that i'm a member i'm having trouble d/ling or saving the torrent file. when i try i'm still receiving the try again error message from before. is there a setting that i need to change to allow these sites to load (sorry if this is a stupid question!)
 
installed firefox and all the web issues went away. everything is running smoothly except now when ever i open a program, no matter what one (firefox, notepad, spybot, dvd decryptor, etc.) i receive a error message stating the location of the program and after i click ok on the message the program opens up normally and runs like usual. this was also happening when converting flac audio files and saving them into another folder for each flac file i got an error, clicked ok and the file converted fine to the correct destination. any ideas?
 
Ill have a look into it for you. Just remember that I specialise in Malware removal though, not really general computer stuff.
 
no biggie you've gone above and beyond helping me already. i'll start checking around myself to see what i can find. just thought you may have ran across something like this before after we fixed the other issues. thanks for all your help!
 
sorry but i have one last/new question for you before i ride off into the sunset... i rebooted my cpu after receiving all these error messages when opening programs to see if the problem continued or would stop and now upon boot up i get the blue screen stating beginning of physical memory dump noting the win32k.sys at address BF840845 base address BF800000. i'm stuck from there, cannot get windows to run to troubleshoot (not that i'm sure what to do anyway). not sure if this is a hardware issue or stems from any of the programs we've installed. is this pure dumb luck and these are two seperate issues? not sure where to from here. any ideas? (wont be able to check back until later as i'm at work and on break) thanks again for any suggestions.
 
Status
Not open for further replies.

Similar threads

D
Mini PCs sold on Amazon contained factory-installed spyware
Replies
16
Views
390
Fastturtle
F
Daniel Sims
"Content Warning" is the latest Steam hit to suffer from server issues
Replies
0
Views
118
Daniel Sims
Daniel Sims
Daniel Sims
"Triangulation" iPhone spyware used Apple hardware exploits unknown to almost everyone
Replies
13
Views
433
jeffbert
J

Latest posts

Back