Help re: malware infection

[Guest]

If anyone could help, i'd be very grateful.....

I have a "dangerous malware infection" on my PC. I have found where the
infected files are but cannot delete them as they are in use. can anyone tell
me how to stop the program automatically running on start-up so i can then
delete the files.

A red circle with a white cross in flashes over the windows update icon on
the toolbar and a message appears in a box with a yellow triange/black
exclamation mark icon in it.

Thanks

 

[BobH]

If anyone could help, i'd be very grateful.....

I have a "dangerous malware infection" on my PC. I have found where the
infected files are but cannot delete them as they are in use. can anyone
tell
me how to stop the program automatically running on start-up so i can then
delete the files.

A red circle with a white cross in flashes over the windows update icon on
the toolbar and a message appears in a box with a yellow triange/black
exclamation mark icon in it.

Thanks

Mike, try this newsgroup with your post. You will find lots of help
there..........alt.privacy.spyware...........Hope this helps you.

 

[Rick \Nutcase\ Rogers]

Hi,

AdawareII www.lavasoft.de
Spybot www.safer-networking.org

From MVP Richard Harper on cleaning up malware infested systems:
http://rgharper.mvps.org/cleanit.htm

This one can help you avoid these programs from being installed in the first
place:
Spyware Blaster: www.javacoolsoftware.com/spywareblaster.html

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/?kbid=827315

Many are best run in Safe mode:

How to start in Safe mode:
http://www.rickrogers.org/fixes.htm#Safe mode

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[David H. Lipman]

From: "Mike payne" <Mike (e-mail address removed)>

| If anyone could help, i'd be very grateful.....
|
| I have a "dangerous malware infection" on my PC. I have found where the
| infected files are but cannot delete them as they are in use. can anyone tell
| me how to stop the program automatically running on start-up so i can then
| delete the files.
|
| A red circle with a white cross in flashes over the windows update icon on
| the toolbar and a message appears in a box with a yellow triange/black
| exclamation mark icon in it.
|
| Thanks



Two part reply..

Perform Part 1 then perform Part 2.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp




Use the alternate if the first two parts are ineffective...
Note: Alternate only for Win2K, WinXP and Win2003 Server

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.

Alternate:

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *