UNSOLVED

rcrmly

updated

19 years ago

R

rcrmly

3 Posts

0

12237

May 6th, 2007 19:00

Spyware Help

When I access Internet Explorer the home page displays a warning box about infected files and when I click OK it takes me to a site wanting me to download spyware software.  I cannot get this off of my homepage.  There is an icon at the bottom of my screen blinking and when i click on it i go to another spyware site.  It is a blue question mark flashing a red circle with a slash through it.  Please help.  Every time I start internet explorer the warning box comes up how do i take it off???
 
System Info:
Dimension 9150 XPS 400    Operating System XP 2002
  • ky331

    5 Journeyman

    •

    15636 Posts

    •

    45078 Points

    375

    0

    Posted May 6th, 2007 19:00

    You didn't mention any specifics... any particular NAMES attached to these warnings/messages... but the odds are it's a SmitFraud variant.   Both RogueRemover as well as SuperAntiSpyware can remove many [but not all] SmitFraud variants.   If you wish, you could try these (links below)... RogueRemover runs really fast, and so is the more efficient to use  when it works... be advised that a complete SuperAntiSpyware scan can run 20 to 40 minutes, because its scan is far more comprehensive.  Be sure to let us know which one, if either, worked for you.
     
     
     
    ====================================================
     
    If these attempts don't succeed --- or even if they do, but you'd like further confirmation that you're fully clean, then you can post a HiJackThis log in the HJT forum, where the helpers can offer you personalized assistance --- please do NOT try to proceed with HJT "fixes" on your own!  
     
    Here's the information on HiJackThis, in case you decide to pursue it:
     
    Download a self-extracting copy of the latest version of HJT (HiJackThis) (version 1.99.1) from
    Save it to your Desktop.
    Double-click on the file    hijackthis_sfx.exe    file, and allow it to self-extract [by clicking on UnZip] into the suggested/default folder,
    C:\Program Files\HijackThis
     
    Use Windows Explorer to navigate your way into this folder, and then double click on HiJackThis. exe

    Click on  Do a System Scan and Save a LogFile

    This will automatically open NotePad

    Copy the entire file from NotePad:  EDIT/SelectAll, EDIT/Copy

    Then go to the forum dedicated for HiJack This logs (**NOT** back here), and  PASTE the results there:

    http://forums.us.dell.com/supportforums/board?board.id=si_hijack

    Be sure to include a detailed description of any problems/errors/warnings you are encountering.

    Hopefully, one of the HJT experts will get to it as quickly as possible.

     

    WARNING:  HiJack This is a VERY POWERFUL tool.  While it's  completely safe  for you to download, generate, and post your log (as described above), you should *NOT* attempt to do anything else (in particular, do NOT use it to delete/fix any entries) until you are advised to do so by a forum expert!!   Improper use of this tool can severely damage your system.


    Message Edited by ky331 on 05-06-2007 04:48 PM
  • Gmanson

    2 Intern

    •

    508 Posts

    375

    0

    Posted May 6th, 2007 23:00

    There was a problem i fixed on another computer that had a problem with this. Probably a adware module or lots of em. http://www.xoxide.com/evnopad.html Update/lok for the gear for general hav evrything checked. Scanning part 1st should be checked and all of the memory and registry should be checked. Then proceed then scannow have perform full system scan selected and both circls checked then clck next.
  • ky331

    5 Journeyman

    •

    15636 Posts

    •

    45078 Points

    375

    0

    Posted May 7th, 2007 12:00

    GManson:
     
    " There was a problem i fixed on another computer that had a problem with this".    As I pointed out, the original poster's summary was rather vague --- at least to my understanding--- so it's difficult for me to understand how you can say you fixed " a problem like this".
     
    The xoxide link you gave was to Evercool Notebook Cooling Pad, "a light and portable solution for laptop cooling".   Is this the link you really intended???   Does this have even any remote connection to adware/spyware/malware???  
    And even if you really believe this is the appropriate link to fix this problem, it's a paid product ($18.99), and we we make every effort in these forums to recommend only free products... especially when there are good free alternatives available.
     
    Having considered the specifics of your reply, I would also like to address a more general issue here:
     
    I realize there are no rigid rules in the virus/spyware forum to prevent you, or others, from entering this [as well as any other] thread.   But given that I had already replied here with what I believe to be sound advice, would it have been asking too much for you to wait and allow the original poster a chance to consider and try what I had suggested?   Or for the poster to write back that they weren't happy with my suggestions, and would prefer to receive some other advice?  
     
    Granted, there may be more than one way to solve a problem.   But for several people to bombard a user... who for all we know is potentially a "newbie"... with lots of alternative [and perhaps conflicting] procedural choices...  presents that person with the daunting and overwhelming task of sorting it all out.  The bottom line being, that unless you believe that my advice was inappropriate or incorrect, or worse yet, that it was potentially dangerous if followed, I think common courtesy would suggest you [and others] wait for a reply from the original poster, before trying to "second-guess" the first advice offered.
     


    Message Edited by ky331 on 05-07-2007 09:38 AM
  • Bugbatter

    4 Apprentice

    •

    20487 Posts

    375

    0

    Posted May 7th, 2007 14:00

    rcrmly,
    The suggestions posted by ky331 should take care of your problem. If you need to post a HijackThis log, make sure you read the announcements at the top of that board, and please give us a more detailed description of your problem. Thanks :)
  • Gmanson

    2 Intern

    •

    508 Posts

    375

    0

    Posted May 7th, 2007 20:00

    Yeah sorry about that had a memory conflict on pasting. http://www.lavasoftusa.com/products/ad-aware_se_personal.php
  • rcrmly

    3 Posts

    375

    0

    Posted May 8th, 2007 15:00

    Thanks the antispyware fixed the problem.  Would anything in that fix affect my background on my desktop?  My background turned white and from my control panel I can't seem to change the background.
  • Bugbatter

    4 Apprentice

    •

    20487 Posts

    375

    0

    Posted May 8th, 2007 15:00

    The infection changed your background. When it was removed, you were left with a white background.
    • Quit Internet Explorer and quit any instances of Windows Explorer.
    • Click Start, click Control Panel, and then double-click Internet Options.
    • On the General tab, click Delete Files under Temporary Internet Files.
    • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
    • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
    • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
    • Click OK.
    Next Click Start, click Control Panel and then double-click Display.
    Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

    See if that helps.