help

whilst working i had a pop claiming to be windows security stating there was
a security problem download updates etc... my brain was obviously in neutral
and i clicked the ok button, suprise suprise my pc was infested with virus's
and spy ware, i used several virus scans , pc cillin bit defender and
symantec also spy sweeper and ad ware to remove everything however it looks
like something has embedded itself in IE, when i am on the net i get the
usual dating, pills, gamblig sites magically appearing and some pop ups, all
the so called credible cleanup softweare cant seem to get rid of it, spy
sweeper is picking up netssh.exe but cant remove it, i have tried manually
what can i do ???

rod wrote:

> whilst working i had a pop claiming to be windows security stating
> there was a security problem download updates etc... my brain was
> obviously in neutral and i clicked the ok button, suprise suprise my
> pc was infested with virus's and spy ware, i used several virus scans
> , pc cillin bit defender and symantec also spy sweeper and ad ware to
> remove everything however it looks like something has embedded itself
> in IE, when i am on the net i get the usual dating, pills, gamblig
> sites magically appearing and some pop ups, all the so called credible
> cleanup softweare cant seem to get rid of it, spy sweeper is picking
> up netssh.exe but cant remove it, i have tried manually what can i do
> ???

Run through the following malware removal steps (links follow the
steps). It is crucial that you do your scans in Safe Mode with updated
tools.

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

HijackThis is an excellent tool to discover and disable hijackers, but
it requires expert skill. See below for HijackThis links. A combination
of HijackThis and about:Buster works well in removing the about:Blank
homepage hijacker. Again, this is an expert tool and novices should get
help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtrac...r_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/
http://www.spywareinfo.com/forums/

General:
http://forum.aumha.org/ - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"