beta

G

Guest

i downloaded beta spyware and now i have a permanent spyware infection notice
on my desktop that cannot be removed. Also after i run a scan i remove the
problem These warnings just say windows has detected spyware infection. If
i restart my computer i get on error message about c/windows/system32/r.exe
and then this unspyware scan starts and i get another the warning that my
computer is infected with spyware again. Can anyone help me
 
F

Frank Saunders, MS-MVP OE

seahawxtwo said:
i downloaded beta spyware and now i have a permanent spyware
infection notice on my desktop that cannot be removed. Also after i
run a scan i remove the problem These warnings just say windows has
detected spyware infection. If i restart my computer i get on error
message about c/windows/system32/r.exe and then this unspyware scan
starts and i get another the warning that my computer is infected
with spyware again. Can anyone help me

Restart in Safe Mode and run the scan there.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 
G

Guest

I also am experiencing the permanent spyware infection notice on my desktop.
How can I remove this notice?
FJM with thanks in advance!!!
 
G

Guest

Hi FJM

Is better if you create a new message, don't post a question of your own in
response to another question.

From AndyM
Copy and Paste this to notepad and save it so you can still view if needed
as you will not be able to access the Internet in safe mode.

Use Smitrem, Ewido and finally Ccleaner to remove temp files

Download SmitRem

http://noahdfear.geekstogo.com/click counter/click.php?id=1

Save it to your desktop,Double click on the SmitRem.exe file and extract it
to it's own folder on the desktop.

Download Ewido Security Suite

http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background
guard" and "Install scan via context menu". Click on update in the left menu,
then click the Start update button. After the update finishes (the status bar
at the bottom will display "Update successful") Exit Ewido. DO NOT scan yet.

Download Ccleaner (To Remove Temp and unused files from your system)

http://download.ccleaner.com/ccdownload.asp

Install Then close

Now reboot to Safe Mode - Restart your computer and immediately begin
tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe
Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.

Run Smitrem :

Open the smitRem folder, then double click the RunThis.bat file to start the
tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive,
eg; Local Disk C: or partition where your operating system is installed.

Run Ewido

Click on the Scanner button in the left menu, then click on complete system
scan. When ewido finds something, it will pop up a notification.
Select "clean" and check the boxes "Perform action with all infections" and
"Create encrypted backup" before clicking on ok. When the scan finishes,
click on "Save Report" from the bottom of the screen and save it to your
desktop incase you need more help with this.

Run Ccleaner and press "Run Cleaner" then exit.

While still in safe mode reset the Internet Settings : Goto Start Menu then
Control Panel then to Internet Options, Click the Programs Tab and press
"Reset Web Settings" and include the homepage then press Yes, Then goto the
General Tab and enter the homepage you want to use into the space provided
and press Apply .

Then Reboot back to Normal Mode

Let us know if you have any problems

You will need to reload your wallpaper after this tool finishes, Smitrem
will reset it because Trojans related to this infection will display a
spyware warning as a desktop wallpaper which cannot be removed, To change
your wallpaper right click desktop and choose properties, Set the Theme to XP
if you are running XP then goto the Desktop tab and choose your wallpaper
from there. While on the Desktop tab press 'Customize Desktop' then the 'Web'
Tab, In the web pages box look for 'Security' or 'Security Info', if its
there then place a check next to it and press Delete then press OK

Regards
Engel
 
G

Guest

I followed your instructions, but now I can't get my computer in to safemode.
I was able to last night and after I selected windows xp and hit enter this
is what i got.
multi(0)rdisk(0)partition(2)\windows\system32\ntoskrnl.exe. Can you help
me? Is there any other way to get into safe mode besides tapping f8 key?
 
T

Tom Emmelot

Helloseahawxtwo,

your boot.ini file is not correct.
can you sent me the lines of your boot.ini at this moment?

Regards >*< TOM >*<

seahawxtwo schreef:
 
G

Guest

Hi
how do i get this?

Tom Emmelot said:
Helloseahawxtwo,

your boot.ini file is not correct.
can you sent me the lines of your boot.ini at this moment?

Regards >*< TOM >*<

seahawxtwo schreef:
 
T

Tom Emmelot

Hello seahawxtwo,

Edit the Boot.ini File
To view and edit the Boot.ini file:
1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.

Regards >*< TOM >*<

seahawxtwo schreef:
 
G

Guest

here are the lines from boot.ini.exe

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect /NoExecute=OptIn
 
T

Tom Emmelot

Hello seahawxtwo,


change it in:
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect


Regards >*< TOM >*<

seahawxtwo schreef:
here are the lines from boot.ini.exe

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect /NoExecute=OptIn


:

Hello seahawxtwo,

Edit the Boot.ini File
To view and edit the Boot.ini file:
1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.

Regards >*< TOM >*<

seahawxtwo schreef:
 
G

Guest

Hi Tom
Thanks for all your help. Got it fixed.

Tom Emmelot said:
Hello seahawxtwo,


change it in:
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect


Regards >*< TOM >*<

seahawxtwo schreef:
here are the lines from boot.ini.exe

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect /NoExecute=OptIn


:

Hello seahawxtwo,

Edit the Boot.ini File
To view and edit the Boot.ini file:
1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.

Regards >*< TOM >*<

seahawxtwo schreef:

Hi
how do i get this?

:



Helloseahawxtwo,

your boot.ini file is not correct.
can you sent me the lines of your boot.ini at this moment?

Regards >*< TOM >*<

seahawxtwo schreef:


I followed your instructions, but now I can't get my computer in to safemode.
I was able to last night and after I selected windows xp and hit enter this
is what i got.
multi(0)rdisk(0)partition(2)\windows\system32\ntoskrnl.exe. Can you help
me? Is there any other way to get into safe mode besides tapping f8 key?

:




Hi FJM

Is better if you create a new message, don't post a question of your own in
response to another question.


From AndyM


Copy and Paste this to notepad and save it so you can still view if needed
as you will not be able to access the Internet in safe mode.

Use Smitrem, Ewido and finally Ccleaner to remove temp files

Download SmitRem

http://noahdfear.geekstogo.com/click counter/click.php?id=1

Save it to your desktop,Double click on the SmitRem.exe file and extract it
to it's own folder on the desktop.

Download Ewido Security Suite

http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background
guard" and "Install scan via context menu". Click on update in the left menu,
then click the Start update button. After the update finishes (the status bar
at the bottom will display "Update successful") Exit Ewido. DO NOT scan yet.

Download Ccleaner (To Remove Temp and unused files from your system)

http://download.ccleaner.com/ccdownload.asp

Install Then close

Now reboot to Safe Mode - Restart your computer and immediately begin
tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe
Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.

Run Smitrem :

Open the smitRem folder, then double click the RunThis.bat file to start the
tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive,
eg; Local Disk C: or partition where your operating system is installed.

Run Ewido

Click on the Scanner button in the left menu, then click on complete system
scan. When ewido finds something, it will pop up a notification.
Select "clean" and check the boxes "Perform action with all infections" and
"Create encrypted backup" before clicking on ok. When the scan finishes,
click on "Save Report" from the bottom of the screen and save it to your
desktop incase you need more help with this.

Run Ccleaner and press "Run Cleaner" then exit.

While still in safe mode reset the Internet Settings : Goto Start Menu then
Control Panel then to Internet Options, Click the Programs Tab and press
"Reset Web Settings" and include the homepage then press Yes, Then goto the
General Tab and enter the homepage you want to use into the space provided
and press Apply .

Then Reboot back to Normal Mode

Let us know if you have any problems

You will need to reload your wallpaper after this tool finishes, Smitrem
will reset it because Trojans related to this infection will display a
spyware warning as a desktop wallpaper which cannot be removed, To change
your wallpaper right click desktop and choose properties, Set the Theme to XP
if you are running XP then goto the Desktop tab and choose your wallpaper

from there. While on the Desktop tab press 'Customize Desktop' then the 'Web'


Tab, In the web pages box look for 'Security' or 'Security Info', if its
there then place a check next to it and press Delete then press OK

Regards
Engel
--


:




I also am experiencing the permanent spyware infection notice on my desktop.
How can I remove this notice?
FJM with thanks in advance!!!

:







i downloaded beta spyware and now i have a permanent spyware
infection notice on my desktop that cannot be removed. Also after i
run a scan i remove the problem These warnings just say windows has
detected spyware infection. If i restart my computer i get on error
message about c/windows/system32/r.exe and then this unspyware scan
starts and i get another the warning that my computer is infected
with spyware again. Can anyone help me

Restart in Safe Mode and run the scan there.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 
T

Tom Emmelot

Hello seahawxtwo,

glad it worked and your welcome.

Kind regards >*< TOM >*<

seahawxtwo schreef:
Hi Tom
Thanks for all your help. Got it fixed.

:

Hello seahawxtwo,


change it in:
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect


Regards >*< TOM >*<

seahawxtwo schreef:
here are the lines from boot.ini.exe

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect /NoExecute=OptIn


:



Hello seahawxtwo,

Edit the Boot.ini File
To view and edit the Boot.ini file:
1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.

Regards >*< TOM >*<

seahawxtwo schreef:


Hi
how do i get this?

:




Helloseahawxtwo,

your boot.ini file is not correct.
can you sent me the lines of your boot.ini at this moment?

Regards >*< TOM >*<

seahawxtwo schreef:



I followed your instructions, but now I can't get my computer in to safemode.
I was able to last night and after I selected windows xp and hit enter this
is what i got.
multi(0)rdisk(0)partition(2)\windows\system32\ntoskrnl.exe. Can you help
me? Is there any other way to get into safe mode besides tapping f8 key?

:





Hi FJM

Is better if you create a new message, don't post a question of your own in
response to another question.


From AndyM



Copy and Paste this to notepad and save it so you can still view if needed
as you will not be able to access the Internet in safe mode.

Use Smitrem, Ewido and finally Ccleaner to remove temp files

Download SmitRem

http://noahdfear.geekstogo.com/click counter/click.php?id=1

Save it to your desktop,Double click on the SmitRem.exe file and extract it
to it's own folder on the desktop.

Download Ewido Security Suite

http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background
guard" and "Install scan via context menu". Click on update in the left menu,
then click the Start update button. After the update finishes (the status bar
at the bottom will display "Update successful") Exit Ewido. DO NOT scan yet.

Download Ccleaner (To Remove Temp and unused files from your system)

http://download.ccleaner.com/ccdownload.asp

Install Then close

Now reboot to Safe Mode - Restart your computer and immediately begin
tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe
Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.

Run Smitrem :

Open the smitRem folder, then double click the RunThis.bat file to start the
tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive,
eg; Local Disk C: or partition where your operating system is installed.

Run Ewido

Click on the Scanner button in the left menu, then click on complete system
scan. When ewido finds something, it will pop up a notification.
Select "clean" and check the boxes "Perform action with all infections" and
"Create encrypted backup" before clicking on ok. When the scan finishes,
click on "Save Report" from the bottom of the screen and save it to your
desktop incase you need more help with this.

Run Ccleaner and press "Run Cleaner" then exit.

While still in safe mode reset the Internet Settings : Goto Start Menu then
Control Panel then to Internet Options, Click the Programs Tab and press
"Reset Web Settings" and include the homepage then press Yes, Then goto the
General Tab and enter the homepage you want to use into the space provided
and press Apply .

Then Reboot back to Normal Mode

Let us know if you have any problems

You will need to reload your wallpaper after this tool finishes, Smitrem
will reset it because Trojans related to this infection will display a
spyware warning as a desktop wallpaper which cannot be removed, To change
your wallpaper right click desktop and choose properties, Set the Theme to XP
if you are running XP then goto the Desktop tab and choose your wallpaper

from there. While on the Desktop tab press 'Customize Desktop' then the 'Web'



Tab, In the web pages box look for 'Security' or 'Security Info', if its
there then place a check next to it and press Delete then press OK

Regards
Engel
--


:





I also am experiencing the permanent spyware infection notice on my desktop.
How can I remove this notice?
FJM with thanks in advance!!!

:









i downloaded beta spyware and now i have a permanent spyware
infection notice on my desktop that cannot be removed. Also after i
run a scan i remove the problem These warnings just say windows has
detected spyware infection. If i restart my computer i get on error
message about c/windows/system32/r.exe and then this unspyware scan
starts and i get another the warning that my computer is infected
with spyware again. Can anyone help me

Restart in Safe Mode and run the scan there.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 
B

Bill Sanderson

Nice work! I wouldn't touch that stuff with a long pole--thanks.

--

Tom Emmelot said:
Hello seahawxtwo,

glad it worked and your welcome.

Kind regards >*< TOM >*<

seahawxtwo schreef:
Hi Tom
Thanks for all your help. Got it fixed.

:

Hello seahawxtwo,


change it in:
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect


Regards >*< TOM >*<

seahawxtwo schreef:

here are the lines from boot.ini.exe

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home
Edition" /fastdetect /NoExecute=OptIn


:



Hello seahawxtwo,

Edit the Boot.ini File
To view and edit the Boot.ini file:
1. Right-click My Computer, and then click Properties.
-or-
Click Start, click Run, type sysdm.cpl, and then click OK.
2. On the Advanced tab, click Settings under Startup and Recovery.
3. Under System Startup, click Edit.

Regards >*< TOM >*<

seahawxtwo schreef:


Hi
how do i get this?

:




Helloseahawxtwo,

your boot.ini file is not correct.
can you sent me the lines of your boot.ini at this moment?

Regards >*< TOM >*<

seahawxtwo schreef:



I followed your instructions, but now I can't get my computer in to
safemode. I was able to last night and after I selected windows xp
and hit enter this is what i got.
multi(0)rdisk(0)partition(2)\windows\system32\ntoskrnl.exe. Can you
help me? Is there any other way to get into safe mode besides
tapping f8 key?

:





Hi FJM

Is better if you create a new message, don't post a question of
your own in response to another question.


From AndyM



Copy and Paste this to notepad and save it so you can still view if
needed as you will not be able to access the Internet in safe mode.

Use Smitrem, Ewido and finally Ccleaner to remove temp files
Download SmitRem

http://noahdfear.geekstogo.com/click counter/click.php?id=1

Save it to your desktop,Double click on the SmitRem.exe file and
extract it to it's own folder on the desktop.

Download Ewido Security Suite
http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install
background guard" and "Install scan via context menu". Click on
update in the left menu, then click the Start update button. After
the update finishes (the status bar at the bottom will display
"Update successful") Exit Ewido. DO NOT scan yet.

Download Ccleaner (To Remove Temp and unused files from your
system)

http://download.ccleaner.com/ccdownload.asp

Install Then close
Now reboot to Safe Mode - Restart your computer and immediately
begin tapping the F8 key on your keyboard. If done right a Windows
Advanced Options menu will appear. Select the Safe Mode option and
press Enter.
To return to normal mode just restart your computer as you normally
would.

Run Smitrem :

Open the smitRem folder, then double click the RunThis.bat file to
start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your
drive, eg; Local Disk C: or partition where your operating system
is installed.

Run Ewido
Click on the Scanner button in the left menu, then click on
complete system scan. When ewido finds something, it will pop up a
notification. Select "clean" and check the boxes "Perform action
with all infections" and "Create encrypted backup" before clicking
on ok. When the scan finishes, click on "Save Report" from the
bottom of the screen and save it to your desktop incase you need
more help with this.
Run Ccleaner and press "Run Cleaner" then exit.

While still in safe mode reset the Internet Settings : Goto Start
Menu then Control Panel then to Internet Options, Click the
Programs Tab and press "Reset Web Settings" and include the
homepage then press Yes, Then goto the General Tab and enter the
homepage you want to use into the space provided and press Apply .

Then Reboot back to Normal Mode
Let us know if you have any problems
You will need to reload your wallpaper after this tool finishes,
Smitrem will reset it because Trojans related to this infection
will display a spyware warning as a desktop wallpaper which cannot
be removed, To change your wallpaper right click desktop and choose
properties, Set the Theme to XP if you are running XP then goto the
Desktop tab and choose your wallpaper

from there. While on the Desktop tab press 'Customize Desktop' then
the 'Web'



Tab, In the web pages box look for 'Security' or 'Security Info',
if its there then place a check next to it and press Delete then
press OK
Regards Engel
--


:





I also am experiencing the permanent spyware infection notice on
my desktop. How can I remove this notice?
FJM with thanks in advance!!!

:





message




i downloaded beta spyware and now i have a permanent spyware
infection notice on my desktop that cannot be removed. Also
after i
run a scan i remove the problem These warnings just say windows
has
detected spyware infection. If i restart my computer i get on
error
message about c/windows/system32/r.exe and then this unspyware
scan
starts and i get another the warning that my computer is
infected
with spyware again. Can anyone help me

Restart in Safe Mode and run the scan there.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top