Serious: MSAS cant detect and remove look2me and P.S.Guard spyware

[Guest]

I live in networked workplace, and two of our computers have been attacked by
those two evils. They are deadly parasites. Look2me assist this website (DONT
CLICK IT) www.ad-w-a-r-e.com to display pop ups advertising some products.
PSGuard takes over the desktop and disable most of the programs in the
computer.
I have some light in dealing with spyware and adware, so Im trying to clean
up those infected computers. Those parasites wont go away. One day I used
little known program called EWIDO, it discovered a file in System32 folder
that protect any deletion of look2me's dlls. I have used all the major
cures, MSAS, ad-aware, spybot, spysweeper, spy doctor with no success. the
only way those computer work is in safe mode. Download.com listed MSAS as one
of the big anti-spyware house. And its here im coming for HELP.

NB: MSAS in the future should consider including "active internet
connections tab" on the system explorers. And the tab should have capacity to
resolve DNS names of the addresses. this may help in avoiding "bad" websites
such as www.ad-w-a-r-e.com

 

[Guest]

Will,
The best way to remove all of that garbage is to run all of your removal
process's in safe mode.
My best opinion to you would be to run the following programs in safemode.

Microsoft Antispyware
Ad-Aware LE
Spy-Bot Search & Destroy
Webroot spysweeper

Make sure that the computer that you are running these on is **NOT**
connected in anyway to your lan. In fact unplug the lan cable from the back
of your computer.

I would suggest running all 4 of these programs in safe mode at least twice.
Just let them run and do there thing.

Hope this helps

 

[Guest]

Hekllo Eric,
The easiest word to use is loop. These parasites have a mechanism of coming
back from the dead. Once cleaned using ALL the of the said cures, after
booting normally, it takes a shortwhile for them to surface again. Im told
the only way is to format the harddisk. I want it to be the very, very last
option.
Suggestions please.

 

[Dave M]

I suggest you use the Symantec look2me removal tool:
http://securityresponse.symantec.com/avcenter/venc/data/spyware.look2me.html
followed by your choice of a updated definition full virus scan.

 

[Guest]

Delete the contents of c:\windows\prefetch (XP only). If that doesn't work
download and run Trend Micro's CWShredder
(http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe).

Alan