Microsoft Antispyware

[echolake]

I keep getting a "Warning! Microsoft Antispyware Alert!"
Trojan.Startup.NameShifter.pnscmj trying to install itself
on my computer. The file trying to run
(C:\windows\system32\mbdvlmv.exe)has been blocked from
running.

When I select the "remove" option it also finds two more
Transponder.ABetterInternet.Aurora
Transponder.ABetterInternt.DrPMon

When I remove all three and reboot as instructed, I find
that it does not remove it since the warning window pops
up

Can you help me?

 

[plun]

Hi

Lavasofts Adaware probably removes it.

First remove all temporarily junk with CCleaner
Quick tour and download, http://www.ccleaner.com/help/tour1.asp

Then download/install Adaware
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022-10399602.html?tag=list

Also download Lavasofts plugin for VX2 infections.

http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml

Read instructions carefully how to install and run this plugin.

- Install plugin

- Run plugin step 1

- Reboot

- Start Lavasofts Adaware and choose "Smart scan"

 

[Engel]

Hello Echolake;

Steps to take if you have spyware that is not removed by
Microsoft Windows AntiSpyware (beta)
1) Open up AntiSpyware
2) Click Tools at the top
3) Click "Submit a Suspected Spyware Report"
4) Fill out the form with as much detail so they can
analyze quickly

1) Update both Microsoft Antispyware and your antivirus
application.
2) Restart in safe mode by pressing the F8 function key
before the first Windows screen appears at startup.
3) Do full deep scans with Microsoft Antispyware. Repeat
scanning until a complete scan comes through clean. Ditto
with the antivirus.

This isn't guaranteed, but it works for a great many items
that at first appear not to be cleaned in normal mºde.


http://uk.trendmicro-
europe.com/consumer/housecall/housecall_launch.php


www.ewido.net/en/onlinescan



From: "plun" and Bill

Get Lavasofts Adaware

http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-
8022-10399602.html?tag=list

and the VX2 plugin

http://www.lavasoft.de/software/addons/vx2cleaner.shtml

Carefully read instructions how to use this plugin.

http://www.sunbelt-software.com/CounterSpy-Download.cfm

Also check this, within this URL you have all running
processes for this pest, try to stop them and manually
remove the file.

http://research.sunbelt-software.com/threat_display.cfm?
name=Trojan.Startup.NameShifter.wingu&threatid=41236

http://research.sunbelt-software.com/threat_display.cfm?
name=Trojan.Startup.NameShifter.CQ&threatid=41110

Process = dmxif.exe, kill it !

Check if you have a process named hclean32.exe, Ctrl Alt
Del and
tab pocesses, kill that one.

http://research.sunbelt-software.com/threat_display.cfm?
name=Worm:Win32/Gaobot.dr%20&threatid=41360

From: "Bill Sanderson"

You could also try these rootkit apps:

http://www.f-secure.com/blacklight/

http://www.sysinternals.com/utilities/rootkitrevealer.html

Good luck

Engel

 

[Angelo]

Had a similar problem with a different Trojan Downloader.
Go to Norton(Symantec Site) DOwnload the Trial Norton
Antivirus and run it. I did that, it found my infected
files and fixed them. I decided to buy Norton Antivirus
after that.

Good Luck

 

[Guest]

Unfortunately, the spyware on my system seems to
have "hijacked" the system so that scan results cannot be
sent (get an error message about proxy settings). Also,
starting up in safe mode and rescanning has no effect.

 

[Bill Sanderson]

The proxy settings error is a bug in Microsoft Antispyware--not caused by
any spyware. We don't have a workaround for it, I'm afraid.

I would go with more of the advice posted--specifically, the trend micro
online scanner, and perhaps the Ewido download as well.
--

Unfortunately, the spyware on my system seems to
have "hijacked" the system so that scan results cannot be
sent (get an error message about proxy settings). Also,
starting up in safe mode and rescanning has no effect.