anoying virus warnings which are fake

[Guest]

Please help me.
I have got two icons on the taskbar, one is a yellow triangle with an
exclamation mark in it and the other is a green wheelchair that flashes to a
red circle with a strike through it. that pops up saying your pc is infected.
The yellow triangle takes you to www.spyguard.com/?aff=103 the other one
takes you to www.spyfalcon.com/?aff=259
I have done a full norton scan and microsoft spyware scan and it has found
nothing. I am also getting XXX rated pop ups and my home page has changed.
When i change it back to what i want it changes itself back.
Please please help me get rid of this thing..
Many thanks in advance.

 

[David H. Lipman]

From: "James" <[email protected]>

| Please help me.
| I have got two icons on the taskbar, one is a yellow triangle with an
| exclamation mark in it and the other is a green wheelchair that flashes to a
| red circle with a strike through it. that pops up saying your pc is infected.
| The yellow triangle takes you to www.spyguard.com/?aff=103 the other one
| takes you to www.spyfalcon.com/?aff=259
| I have done a full norton scan and microsoft spyware scan and it has found
| nothing. I am also getting XXX rated pop ups and my home page has changed.
| When i change it back to what i want it changes itself back.
| Please please help me get rid of this thing..
| Many thanks in advance.



Two part reply..

Perform Part 1 then perform Part 2.

If the first two parts don't work, perform the alternate section.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version...

C:\Program Files\Java\jre1.5.0_06


http://www.java.com/en/download/manual.jsp



Part 1
-----------

Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic43659.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:

Part 1
-----------

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Part 2
-----------

S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *

 

[Guest]

Thanks David for your indepth reply, i am trying it now. Will post back and
let you know how i get on.

 

[David H. Lipman]

From: "James" <[email protected]>

| Thanks David for your indepth reply, i am trying it now. Will post back and
| let you know how i get on.
|

Please include the requested log files in that reply.

 

[Ron Martell]

Please help me.
I have got two icons on the taskbar, one is a yellow triangle with an
exclamation mark in it and the other is a green wheelchair that flashes to a
red circle with a strike through it. that pops up saying your pc is infected.
The yellow triangle takes you to www.spyguard.com/?aff=103 the other one
takes you to www.spyfalcon.com/?aff=259
I have done a full norton scan and microsoft spyware scan and it has found
nothing. I am also getting XXX rated pop ups and my home page has changed.
When i change it back to what i want it changes itself back.
Please please help me get rid of this thing..
Many thanks in advance.

You should be able to uninstall Spyguard from add/remove programs. If
not then you need to contact them via their support page.

Spyfalcon removal http://siri.geekstogo.com/SmitfraudFix.php

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2006)
On-Line Help Computer Service
http://onlinehelp.bc.ca

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

 

[Guest]

Thank you very much Ron.
All done and sorted. Your link removed the wheel chair icon.
Yippieeeeeeeee

I had already removed the yellow exclamation by using Davids link
http://noahdfear.geekstogo.com/click counter/click.php?id=1

I also used spybot with teatimer enabled (in settings)
I do not know if rons link would have removed that also.....hopefully i wont
ever have to find out.
Many many thanks to both of you.

 

[David H. Lipman]

From: "James" <[email protected]>

| Thank you very much Ron.
| All done and sorted. Your link removed the wheel chair icon.
| Yippieeeeeeeee
|
| I had already removed the yellow exclamation by using Davids link
| http://noahdfear.geekstogo.com/click counter/click.php?id=1
|
| I also used spybot with teatimer enabled (in settings)
| I do not know if rons link would have removed that also.....hopefully i wont
| ever have to find out.
| Many many thanks to both of you.
|

Ron's URL was the Geeks2Go URL for S!Ri's SmitfraudFix.
Another location for S!Ri's utility also in my set of directions; Alternate Part 2.
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

My SmitFraud.exe utility should also have worked and since it includes the McAfee AV command
line scanner it would have added the benefits of signature and heuristic detection and
removal of malware as well as the hard coded set of removal code.

The important thing is that the ZLob/SmitFraud Trojan infection has been taken care of.

Thanx for updating the thread.

 

[Guest]

Hi David
Thanks. Yes i did notice that you have given the correct link.
As yours had lots of links i started trying yours and they did remove part
of the problem. When Ron posted a direct link. I tryed it just because....It
worked. I posted back on this site. Then i went through the rest of your
links and found the same link that ron sent.
Sorry that I did not mention this in my post, but i had writen it before i
went through yours.
Many thanks for your help though. Without your help and others answering
peoples problems there would be 1000's of dead or useless pc in the world.

Thanks again

 

[David H. Lipman]

From: "James" <[email protected]>

| Hi David
| Thanks. Yes i did notice that you have given the correct link.
| As yours had lots of links i started trying yours and they did remove part
| of the problem. When Ron posted a direct link. I tryed it just because....It
| worked. I posted back on this site. Then i went through the rest of your
| links and found the same link that ron sent.
| Sorry that I did not mention this in my post, but i had writen it before i
| went through yours.
| Many thanks for your help though. Without your help and others answering
| peoples problems there would be 1000's of dead or useless pc in the world.
|
| Thanks again
|

Thank you for those kind words James.

 

[Guest]

i want to thank mr.lipman. did what you recomended got rid of
spyfalcon.everythings working great.talked to some people at work, said i had
to wipe everythig out. was driveing me crazy. this is the second time ive had
problem and the suport has been awsome. thank you so much.

 

[David H. Lipman]

From: "gregg easley" <gregg (e-mail address removed)>

| i want to thank mr.lipman. did what you recomended got rid of
| spyfalcon.everythings working great.talked to some people at work, said i had
| to wipe everythig out. was driveing me crazy. this is the second time ive had
| problem and the suport has been awsome. thank you so much.
|


Excellent !

Thanx for replying to the thread.

 

[Guest]

Please help me.
I have got two icons on the taskbar, one is a yellow triangle with an
exclamation mark in it and the other is a green wheelchair that flashes to a
red circle with a strike through it. that pops up saying your pc is infected.
The yellow triangle takes you to www.spyguard.com/?aff=103 the other one
takes you to www.spyfalcon.com/?aff=259
I have done a full norton scan and microsoft spyware scan and it has found
nothing. I am also getting XXX rated pop ups and my home page has changed.
When i change it back to what i want it changes itself back.
Please please help me get rid of this thing..
Many thanks in advance.