Re: Please help. Spyware invation.

[David H. Lipman]

From: "ddcc" <dchau@sprynet.com>

| Hello experts,
|
| I have been invaded by spyware/virus. It/they are still in my system
| (Windows XP) I have Norton firewall/antivirus, but it has not been able to
| clean out my system.
|
| I am attaching two screen .jpg shots :
| Please let me know if I can click on the "Protection bar", "Remove adware
| and pop ups", "Scan for spyware" buttons. I am not sure what is safe and
| what is not safe to click on at this point.
|
| Thanks a lot.
|
| ddcc
|

Please don't post graphics in text only, discussion, News Groups.

The charter for this News Group does NOT allow the posting of attachments.

In the alt.* hierarchy, posting attachments is ONLY allowed in the
alt.binaries.* hierarchy.



Two part reply..

Perform Part 1 then perform Part 2.

If the first two parts don't work, perform the alternate section.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.



Part 1
-----------

Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.bleepingcomputer.com/forums/topic43659.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:

S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[ddcc]

Sorry about that.
And thanks for the help.
(Just spanked myself three times)

ddcc

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:wFRrh.2115$R76.1708@trnddc05...
> From: "ddcc" <dchau@sprynet.com>
>
> | Hello experts,
> |
> | I have been invaded by spyware/virus. It/they are still in my system
> | (Windows XP) I have Norton firewall/antivirus, but it has not been able
> to
> | clean out my system.
> |
> | I am attaching two screen .jpg shots :
> | Please let me know if I can click on the "Protection bar", "Remove
> adware
> | and pop ups", "Scan for spyware" buttons. I am not sure what is safe and
> | what is not safe to click on at this point.
> |
> | Thanks a lot.
> |
> | ddcc
> |
>
> Please don't post graphics in text only, discussion, News Groups.
>
> The charter for this News Group does NOT allow the posting of attachments.
>
> In the alt.* hierarchy, posting attachments is ONLY allowed in the
> alt.binaries.* hierarchy.
>
>
>
> Two part reply..
>
> Perform Part 1 then perform Part 2.
>
> If the first two parts don't work, perform the alternate section.
>
> It is suggested that you execute each tool in Normal Mode then in Safe
> Mode.
>
>
>
> Part 1
> -----------
>
> Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool --
> SmitRem.exe
> http://noahdfear.geekstogo.com/click...click.php?id=1
>
> http://www.bleepingcomputer.com/forums/topic43659.html
>
>
> Part 2
> -----------
>
> Download SmitFraud.exe from the URL --
> http://www.ik-cs.com/programs/virtools/SmitFraud.exe
>
> Execute; SmitFraud.exe { Note: You must accept the default of
> C:\McAfee }
> Choose; Unzip
> Choose; Close
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to
> go through your
> FireWall to enable WGET.EXE to download the needed McAfee related files.
>
> Execute; c:\mcafee\clean.bat
> { or Double-click on 'Clean Link' in c:\mcafee }
>
> A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
> C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan,
> it will be
> displayed in your browser (Opera, FireFox or Internet Explorer). However,
> if you are using
> WinXP, Win2K or Win2003 your system will be left in a state where you will
> have to manually
> shutdown/reboot the PC. On Win9x/ME platforms the report will not be
> shown in your bowser
> but your PC will automatically be shutdown. It is suggested that you move
> the report out of
> c:\mcafee before performing another scan.
>
> It would be best to scan in both Safe Mode and in Normal Mode and save a
> copy of the HTML
> report for each session.
>
>
> ALTERNATE:
>
> S!ri's SmitfraudFix
> http://siri.urz.free.fr/Fix/SmitfraudFix_En.php
>
>
> Please Copy and Paste the contents of the HTML Log files;
> C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your
> reply.
>
> * * * Please report back your results * * *
>
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

[David H. Lipman]

From: "ddcc" <dchau@sprynet.com>

| Sorry about that.
| And thanks for the help.
| (Just spanked myself three times)
|
| ddcc
|

Thanx for being responsive. It is greatly appreciated.

In the future you can host the picture(s) on a web site or you can post the picture(s) to a
News Group such as; news:alt.binaries.comp.virus

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[ddcc]

Learn something new everyday. :-)

ddcc

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:4XTrh.3700$hi7.1537@trnddc08...
> From: "ddcc" <dchau@sprynet.com>
>
> | Sorry about that.
> | And thanks for the help.
> | (Just spanked myself three times)
> |
> | ddcc
> |
>
> Thanx for being responsive. It is greatly appreciated.
>
> In the future you can host the picture(s) on a web site or you can post
> the picture(s) to a
> News Group such as; news:alt.binaries.comp.virus
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>