UNSOLVED

dlwalters

updated

18 years ago

D

dlwalters

7 Posts

0

1195

April 21st, 2008 17:00

"Warning! Spyware detected on your computer!"

**Originally posted on the virus/spyware thread** 

 

Yesterday my computer began running really slowly and each website I would access would crash.  Then a blue screen took over with a yellow and blue message box that said "Warning!  Spyware detected on your computer!  Install an antivirus or spyware remover to clean your cmputer."

 

I have an Inspiron 6000, purchased in Summer 2005.  I have had Symantec Antivirus on my computer, and I just tried installing SmitfraudFix, as well as Spybot and Spyware Doctor (or something like that).  None of these things seem to be making a difference.  One of the problems is that it's tricky to access the internet.  To just try accessing files or the internet, I get a little gray box titled RUNDLL and says:

 

Error loading C:\docume~1\Deanna\LOCALS~1\Temp\onapcratof.nls

The specified module could not be found.

 

I have to find a way through my start menu to find a valid browser page.  Otherwise, I might get a fake anti-virus software advertisement.  After downloading things like SmitfraudFix, as soon as I select "run", the above gray error box pops up and I'm not sure if anything even got installed.

 

Any ideas?  I talked to Geeksquad and they said it could cost starting at $199 for virus removal!  I'm trying to take care of it without them if I can.  Thanks for any help you can offer!

 

___________________________________

Here is the advice I received and followed from Bugbatter:

 

Try running Malwarebytes' Anti-Malware.
Please download to your desktop Malwarebytes' Anti-Malware from
Here or Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report into a New Message on the HijackThis board. Also include a fresh HijackThis log. Instructions for downloading HijackThis are at the top of that forum.
    1. Just click the New Message button in the HijackThis forum here:
    http://www.dellcommunity.com/supportforums/board?board.id=si_hijack
    to start your own thread requesting assistance for a follow-up check to be sure the malware is gone.
    2. In the Message Body window that opens, simply Right-Click and select Paste.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

_____________________________________

I was able to download and save to my desktop the MBAM-setup, but when I double-clicked it to open it and run it, I received the little gray error box again.  The gray box prevents me from installing or running anything I've tried to use to eradicate the virus.  Any more ideas?

 

 

  • bamajim

    10376 Posts

    431

    0

    Posted April 21st, 2008 19:00

    sorry

     

     



     

    Microsoft MVP Consumer-Security

     


    "The world is what you make of it"


    Message Edited by bamajim on 04-21-2008 03:43 PM
  • Bugbatter

    4 Apprentice

    20487 Posts

    431

    0

    Posted April 21st, 2008 19:00

    Hi, dlwalters,

    Let's try it this way...
    Reboot into Safemode:
    Turn on the computer.
    Immediately begin tapping the F8 key.
    Use the arrow keys to highlight Safe Mode and press the Enter key.
    (Your screen will look different, but just let the computer boot slowly.)
    Can you run MBAM that way?



    ** Note: To update MBAM you may need to select Safemode with networking.
    Message Edited by Bugbatter on 04-21-2008 04:43 PM
  • Bugbatter

    4 Apprentice

    20487 Posts

    431

    0

    Posted April 21st, 2008 19:00

    Great minds think alike.
  • dlwalters

    7 Posts

    431

    0

    Posted April 21st, 2008 20:00

    I rebooted in safemode with networking (just safemode didn't work) and then tried to run the MBAM.  I got the same Rundll box.  I tried a couple of different things instead of clicking the MBAM setup, like right clicking and selecting run or open.  Same thing happened.  I'd be happy to keep trying anything though. 

  • dlwalters

    7 Posts

    431

    0

    Posted April 21st, 2008 20:00

    By the way, I have no idea how easily this problem can be taken care of.  If, in your best judgment, I need to take my computer to be worked on somewhere because I will be unable to fix it myself, I would completely understand.
  • Bugbatter

    4 Apprentice

    20487 Posts

    431

    0

    Posted April 21st, 2008 21:00

    There a couple more things we can try.
    Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

    Link 1
    Link 2
    Link 3






    Double click on Combo-Fix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the C:\ComboFix.txt

    Note:
    Do not mouseclick combofix's window while it's running. That may cause it to stall



  • dlwalters

    7 Posts

    431

    0

    Posted April 21st, 2008 23:00

    Okay, I tried it.  Same thing.  It's downloaded onto my desktop, saved as Combo-fix, but when I tried to run it, the gray Rundll box popped up.  Won't let me run anything.
  • Bugbatter

    4 Apprentice

    20487 Posts

    431

    0

    Posted April 22nd, 2008 01:00

    Let's see if it is possible to do this online scan: F-Secure Online Scanner
    The online scanner is on the bottom right of the page.
    Direct link: http://support.f-secure.com/enu/home/ols.shtml

    Follow the directions on the F-Secure page for proper Installation.

    * You may receive an alert on the address bar at this point to install the ActiveX control.
    * Click on that alert and then click " Install ActiveX component".
    * Read the license agreement and click " Accept".
    * Click " Custom Scan" and be sure the following are checked:
    • Scan whole System

    • Scan all files
    • Scan whole system for rootkits
    • Scan whole system for spyware
    • Scan inside archives
    • Use advanced heuristics

    * When the scan completes, click the " I want to decide item by item" button.
    * For each item found, Select " Disinfect" and click " Next".

    * When done, click the " Show Report" button, then copy and paste the entire report into your next reply.

  • dlwalters

    7 Posts

    431

    0

    Posted April 22nd, 2008 15:00

    I started this process last night and it seemed to be working.  I had to let it scan overnight and when I left this morning, it appeared to be disinfecting what it had found (22 viruses, 7 spyware, etc).  I came back around noon and the windows weren't even open anymore.  I suspect my computer may have shut itself down or something and ended the process.  I've started the F-Secure online scanner again.  Hopefully this time it will be able to finish and then we can see where we are.  I'll get back to you as soon as I know more, hopefully tonight.  Thanks so much for having put hours of time into helping me! 
  • Bugbatter

    4 Apprentice

    20487 Posts

    39

    0

    Posted April 22nd, 2008 18:00

    Thank you for keeping us updated. I'll keep my fingers crossed that things go well.