Spyware

[darkdragoon88]

Err...I have a problem that will sound really stupid ^^; I turned on
my computer the other day and my desktop wallpaper was replaced with a
little note stating that I had spyware on my computer and that I should
not use the computer until the spyware was removed. It also wouldn't
let me change the wallpaper.

So I ran various spyware removers in hope of solving the problem, but
even after that, the message was still there....Then I did the dumbest
thing I could do (I was seriously tired by this time), I typed 'spy' in
"Find:" and deleted anything that showed up...yeah, dumb, I know ^^; I
figured I deleted some system files...is there any way to fix this? If
you could help me out, I'd really appreciate it.

Thanks in advance.

 

[Joshua D]

If you have SpyAxe, PSGuard, Smitfraud, Sinnaka Advertisments or detections
for Puper or Alemod that can not seem to be removed automatically, please
try this automated removal tool.

AntiPuper v1.0 by secured2k
http://secured2k.home.comcast.net/tools/AntiPuper.exe

What does this tool do?
This tool will attempt to delete several known trojan files. These files are
modified by the malware authors and encrypted to avoid detection.
Fortunately, many of these tend to use the exact same file names. If the
files are in use, locked, protected, ect, this program will schedule Windows
to remove the files upon restarting.

This program will also remove some common security policies that are changed
by viruses and worms. Policies that lock out your desktop changes, windows
update, Windows Firewall, Explorer Run policies, Registry editing, and more
are all reset.

Finally, if you have an infected Alemod WININET.DLL file, this program will
try to copy a clean version from your Windows File Protection folder and
replace the bad copy on restart. If a backup copy can not be found, the tool
will quickly look for McAfee AntiVirus files and attempt to clean a copy of
the file to replace the bad one on reboot. If all of this fails, you will
need to manually replace/clean your WININET.DLL file.

 

[PA Bear]

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

 

[Leythos]

NNTP-Posting-Host: ppp-69-237-53-123.dsl.bkfd14.pacbell.net 69.237.53.123

The poster hiding as Joshua is really PCBUTTS1 (also known in real life
as Chris Butts) and has to keep changing his nickname and address in
order to be able to have posts show up on the Microsoft Servers.

Be careful when following directions provide by BUTTS as you never
really know what you are getting.

This is not to imply that Secured2K is butts, he's actually a very nice
chap with good tools that Butts tries to pass off as though he's part of
the solution.

 

[Joshua D]

Leythos the stalker is at it again

The poster hiding as Joshua is really PCBUTTS1 (also known in real life
as Chris Butts) and has to keep changing his nickname and address in
order to be able to have posts show up on the Microsoft Servers.

Be careful when following directions provide by BUTTS as you never
really know what you are getting.

This is not to imply that Secured2K is butts, he's actually a very nice
chap with good tools that Butts tries to pass off as though he's part of
the solution.

 

[NoStop]

Leythos the stalker is at it again

Looks to be more like a BUTT sniffer than a stalker.

 

[Leythos]

Leythos the stalker is at it again

NNTP-Posting-Host: ppp-69-237-53-123.dsl.bkfd14.pacbell.net
69.237.53.123

All you have to do is stop presenting other peoples works so that it
appears to be your own, and you won't have any issues.

 

[Guest]

I am not a computer geek, so what I present may be something you have already
considered. Did you completely delete the files from your system or are they
still in the recycle bin? If they are there, you can have them restored from
the recycle bin using the restore feature there. If you wish, you can try a
search to find all files modified / deleted that day and correlate them to
those in the recycle bin. I say this not knowing if the files in the recycle
bin show up during a search as I have never done such.

Maybe you cannot get the system to run. If so, possibly you can just put
your operating system disk in the CD and re-install over the top of what is
already there. That should work. I know you may not want to do this, but it
might be the easiest and less time consuming method (ultimately).

gman

 

[David H. Lipman]

From: "gman" <[email protected]>

| I am not a computer geek, so what I present may be something you have already
| considered. Did you completely delete the files from your system or are they
| still in the recycle bin? If they are there, you can have them restored from
| the recycle bin using the restore feature there. If you wish, you can try a
| search to find all files modified / deleted that day and correlate them to
| those in the recycle bin. I say this not knowing if the files in the recycle
| bin show up during a search as I have never done such.
|
| Maybe you cannot get the system to run. If so, possibly you can just put
| your operating system disk in the CD and re-install over the top of what is
| already there. That should work. I know you may not want to do this, but it
| might be the easiest and less time consuming method (ultimately).
|
| gman
|


You question would *best* be anwered by creating a whole new thread and clearing stating
both the problem and the questions related to those problems.

This is an old thread and you have replied to an offshoot of that thread that has gone
astray and your not going to get good support in this thread.