aggressive spyware problem

[Guest]

Hello all. If anyone could tackle my latest spyware challange I would
greatly appreciate it.

Several things are happening. first Shortcuts are being placed on my desktop
for things like: cheap travel, spyare removal, insurance, etc. I can't find
any programs to uninstall. when I delete the shortcuts they come back after
a while.

second whenever I open internet explorer or mozilla additional windows
quickly pop up for a variety of advertisements but the most prevalent is for
Winfixer. It pops up windows when I close the web browser telling me my
computer is infected and I need to download there software. Of course I do
not do this. Browser windows for insurance and travel pages also pop up.

I have run adware, symantec anitvirus client, spybot search and destroy,
microsoft antispyware beta, trend micro cw shredder. They are all current
and updated but seem to be ineffective. Help would be greatly appreciated.
Thanks much!

 

[SUMMONER]

Run them again, but this time while the computer is running in Safe Mode
(hold F8 key on start-up and select safe mode from the list).

Hope this helps.

Kind Regards

Malte

 

[Donny Broome]

The page below details several fine products. Try more than one. I
personally scan machines with Ad-Aware while running in Safe Mode. Also,
SpySweeper is a good one.
http://www.broomeman.com/spyware/

 

[David H. Lipman]

From: "Abusimbel" <[email protected]>

| Hello all. If anyone could tackle my latest spyware challange I would
| greatly appreciate it.
|
| Several things are happening. first Shortcuts are being placed on my desktop
| for things like: cheap travel, spyare removal, insurance, etc. I can't find
| any programs to uninstall. when I delete the shortcuts they come back after
| a while.
|
| second whenever I open internet explorer or mozilla additional windows
| quickly pop up for a variety of advertisements but the most prevalent is for
| Winfixer. It pops up windows when I close the web browser telling me my
| computer is infected and I need to download there software. Of course I do
| not do this. Browser windows for insurance and travel pages also pop up.
|
| I have run adware, symantec anitvirus client, spybot search and destroy,
| microsoft antispyware beta, trend micro cw shredder. They are all current
| and updated but seem to be ineffective. Help would be greatly appreciated.
| Thanks much!

Two phase answer...

Perform Part 1 the perform part 2

Part 1
------------
Download Adware-Virtumundo Removal Tool v1.5 --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.

* * * Please report back your results * * *

 

[Fitz]

And in addition to what everyone else has said, if this is your "latest
spyware challenge", then you are not practicing Safe Hex. You are being
re-infected and will continue to be re-infected. Check the group
alt.privacy.spyware for good info.

--
***
NEVER download files from anywhere unless it is from the website of the
developer, manufacturer or some entity that you trust. Developer websites
ALWAYS have the most up to date files that haven't been tampered with by
some third party who is "hosting" (read Leeching or Stealing) those files
without permission. Never open email attachments from people you don't
know. It's called Safe Hex.
***