spyware removal problems

[Guest]

i accidently installed what i thought was a windows media player coded but
turned out to be a spyware program. I have Norton Internet Security and Ad
aware installed on my computer and when codec install began both programs
asked if the download should be continued. Because i allowed that to happen
both Internet security and Adaware do not recognize the spyware program. The
program now flashes on my taskbar and about every 5 minutes it displays a
message saying that my computer is infected. If i click on this message a
window pops up and I am taken to a website about spyware programs. Does
anybody out there have any suggestions on how I can solve this problem? Your
help would be greatly appreciated.

 

[Guest]

I FORGOT TO MENTION A FEW THINGS:

1. THE POP-UP IS FOR SPYWAREQUAKE
2. THE URL IS http://www.spywarequake.com/?aff=247
3. THE POP-UP ON MY TASKBAR SAYS THAT I HAVE A CRITICAL SYSTEM
ERROR AND NEED ANTIMALWARE SOFTWARE.

PLEASE HELP!

 

[Malke]

I FORGOT TO MENTION A FEW THINGS:

1. THE POP-UP IS FOR SPYWAREQUAKE
2. THE URL IS spywarequake.com
3. THE POP-UP ON MY TASKBAR SAYS THAT I HAVE A CRITICAL SYSTEM
ERROR AND NEED ANTIMALWARE SOFTWARE.

PLEASE HELP!

Do not post urls of known bad sites. You have a SpywareQuake infection.

Do all the preparatory work here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

See these sites for SpywareQuake-targeted removal steps:

http://wiki.castlecops.com/Malware_Removal:_SpyAxe_Removal
http://malwareremoval.com/plog/index.php?op=ViewArticle&articleId=85&blogId=3
http://www.bleepingcomputer.com/forums/topic47826.html

Removal can be complex. If you don't want to do this yourself (and there
is no shame in admitting this), take the machine to a professional
computer repair shop (not your local version of BigStoreUSA).

After your machine is cleaned up, read through at least some of the
information here:

Safe Hex:

http://www.wilderssecurity.com/showthread.php?t=27971 - So How Did I Get
Infected Anyway?

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

http://www.claymania.com/safe-hex.html


http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://msmvps.com/blogs/harrywaldron/archive/2006/02/05/82584.aspx - MVP
Harry Waldron - The Family PC - How to stay safe on the Internet

http://www.spywarewarrior.com/rogue_anti-spyware.htm - Eric Howes on
Rogue Antispyware Programs

The information at Eric Howes' site would have saved you from installing
SpywareQuake.

Malke

 

[David H. Lipman]

From: "jas987" <[email protected]>

| i accidently installed what i thought was a windows media player coded but
| turned out to be a spyware program. I have Norton Internet Security and Ad
| aware installed on my computer and when codec install began both programs
| asked if the download should be continued. Because i allowed that to happen
| both Internet security and Adaware do not recognize the spyware program. The
| program now flashes on my taskbar and about every 5 minutes it displays a
| message saying that my computer is infected. If i click on this message a
| window pops up and I am taken to a website about spyware programs. Does
| anybody out there have any suggestions on how I can solve this problem? Your
| help would be greatly appreciated.

Let me take a guess...

You downloade4d and ran a file that has a name something to the effect of;
mediacodec-v4.xxx.exe ?



Two part reply..

Perform Part 1 then perform Part 2.

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp



Part 1
-----------

Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic43659.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072

Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *

 

[Guest]

My reply is at the bottom of your message :

I FORGOT TO MENTION A FEW THINGS:

1. THE POP-UP IS FOR SPYWAREQUAKE
2. THE URL IS < removed >
3. THE POP-UP ON MY TASKBAR SAYS THAT I HAVE A CRITICAL SYSTEM
ERROR AND NEED ANTIMALWARE SOFTWARE.

PLEASE HELP!

First ,don't worry , this is really nasty infection but fortunately can be
removed easily.You only need to know how to scan...

Remove Norton fully .Goto Add/Remove programs in Control Panel

Then , remove Norton , restart , remove Symantec stuff , restart , remove
LiveUpdate , restart.
Goto C:\Program files and manually delete all folders/files that are
connected to Norton,Symantec or Live Update.

Restart.

Make sure you have a firewall and connect to internet.

Visit my web-site http://pandaman.my.contact.bg
and perform the malware removal instructions.SpyBot S&D and Ad-Aware SE (the
latest versions) will take care of this , you only need to scan in Safe Mode
and to turn off System Restore before restarting.
Post back again if you have questions and please , post back your results.


Panda_man
--
Bronze level Contributor
http://www.eset.com
http://www.activescan.com
http://pandaman.my.contact.bg
Please , rate posts