Spyware problem

[new]

When i turn on my pc, it has a black bg that says:

 

WARNING!

Dangerous spyware

Following viruses were found on your computer: Trojan horse, PassCapture and etc.

Your private information may be potentially transferred to third parties.

 

Please, check your computer using advanced software.

Thanks.

 

And also in the windows taskbar it has and icon represented by a red X, that says:

Warning! Security report

Your computer is infected. It is recommended to start spyware cleaner tool.

 

And i also cannot use the internet on that pc.

 

Please help me solve this.

[zinglebarb]

When i turn on my pc, it has a black bg that says:

 

 

 

And also in the windows taskbar it has and icon represented by a red X, that says:

 

 

And i also cannot use the internet on that pc.

 

Please help me solve this.

 

can you open the security report and tell us what the product is its trying to sell you? there are loads of these about all needing different treatments. The latest one ive had to deal with was WIN PC Defender which acts the same as this

[new]

can you open the security report and tell us what the product is its trying to sell you? there are loads of these about all needing different treatments. The latest one ive had to deal with was WIN PC Defender which acts the same as this

 

How exactly do i go about opening the security report?

[zinglebarb]

How exactly do i go about opening the security report?

This programs only goal is to sell you itself. There should be some identifying name to it. By your clock hover your mouse over each ican and list what they are for us. These apps always run from startup and as a rule do show themselves

 

you could try running malwarebytes free software if the system will allow you

[Jelly Bean]

Hello there.

 

Go here for Malware Removal:

 

Malware Removal Forums

 

Jelly Bean.

[Plastic Nev]

Hi New,

We can go through the process of how best to download, rename and then use one or more of the anti-malware tools if you wish.

 

But to be honest, your best bet is to follow the link provided by Jelly Bean, they are more qualified to deal with these difficult to remove infections.

 

Hopefully we will acquire a security expert in the future, but at the moment that is the best course of action for that type of malware.

Nev.

[zinglebarb]

Ive cleared systems of these kinda things loads of times its just a matter of finding out which it is all the info is out there to manually delete files and reg entries

[new]

Ok i will post my problem on that site.

[Plastic Nev]

Hi again New, it is perhaps the simplest way forward at the moment.

 

Hi Zinglebarb, in most cases a combination of Malwarebytes and Superantispyware will deal with those that are basically ransom ware nasties, however there is always the problem of getting the software onto an infected machine in the first place.

 

The best way being by access to a clean computer, download to that, then transfer to memory stick after renaming the file, then install to the infected machine.

 

There are other ways as well such as removing the infected hard drive from the machine, connecting it to a clean machine then either using anti-malware software from the clean machine to scan the hard drive and remove the nasties, or in stuborn cases copy all relevant but clean data as a way of backup.

Then reformat the infected drive. No doubt there are other ways as well, but those have been the methods we have used recently.

Nev.

Edited May 25, 2009 by Plastic Nev

[zinglebarb]

His USB does not work ;)

 

I visited a client the other week and his machine was infested with WinPCDefender 2009 I think it was. Standard warnings buy me and ill get rid kinda things no internet connection etc . All I had to do was stop its runnign process browse using my mobile phone to find reg entries search them out delete the keys or entries a couple of other little files and it was gone. It did not take long really

[Plastic Nev]

Yep Zingle, I have seen the other thread, hence the mention of physically removing the drive and connecting that directly to a clean machine. :p

You have to remember that you were there in person in the instance you quote.

Here we are trying to ask a member to do all these things on a remote basis, and maybe with that member being not that technically minded. :o

Long winded explanations of methods to do things, can be mind blowing to someone who has never done anything like that before ;)

Best regards mate,

Nev.

[zinglebarb]

If we could assertain what spyware it is we would be able to hold his hand while doing it ;) you are asking the same member to possibly remove a drive add it to a new machine possibly risk infection to the second machine which is also not easy for the none tech ;)

 

op could perhaps try this Free F-Secure Rescue Bootable CD to Clean Virus and Malware

Edited May 25, 2009 by zinglebarb

[new]

Yeah i am not that technically minded, and can't really trust myself to remove the hard drive and replace it properly.

 

So should i run that Cd thing or wait for a response from that other site?

[Plastic Nev]

Having had a quick look at the "Rescue CD" thing, there is a quite definite warning there that if a system file is infected, the process may render windows unable to start again. I feel that is perhaps a risk you may not be happy to take, however that is up to you.

Myself I would advise letting a security expert on the malware forum lead you through everything, they are good at it, and even though it may take some time, it should be worth it.

Nev.

[zinglebarb]

Having had a quick look at the "Rescue CD" thing, there is a quite definite warning there that if a system file is infected, the process may render windows unable to start again. I feel that is perhaps a risk you may not be happy to take, however that is up to you.

Myself I would advise letting a security expert on the malware forum lead you through everything, they are good at it, and even though it may take some time, it should be worth it.

Nev.

 

 

That will be the case no matter what if a system file is infected the chances of cleaning it are pretty slim and the end result would be the same. The other option at this point would be to download malwarebytes and superantispyware and burn to a cd and try and install them from a cd.

 

New did you look at the icons by the clock for some sort of rogue app it will be pretending to be a security app hit win key and run and type msconfig click start up tab and list what is there (this could have been disabled by the malware thought)

[new]

Having had a quick look at the "Rescue CD" thing, there is a quite definite warning there that if a system file is infected, the process may render windows unable to start again. I feel that is perhaps a risk you may not be happy to take, however that is up to you.

Myself I would advise letting a security expert on the malware forum lead you through everything, they are good at it, and even though it may take some time, it should be worth it.

Nev.

 

Ok thanks for that advice.

 

That will be the case no matter what if a system file is infected the chances of cleaning it are pretty slim and the end result would be the same. The other option at this point would be to download malwarebytes and superantispyware and burn to a cd and try and install them from a cd.

 

New did you look at the icons by the clock for some sort of rogue app it will be pretending to be a security app hit win key and run and type msconfig click start up tab and list what is there (this could have been disabled by the malware thought)

 

I see. What exactly should i be looking for in the startup list?

[zinglebarb]

something that sounds like a security app list them for us

[new]

igfxtray

hkcmd

igfxpers

RTHDCPL

SkyTel

ACLMTR

NeroCheck

jusched

Reader_sl

IMJPMIG

ImScInst

TINTSETP

TINTSETP

qttask

iTunesHelper

Firefox Ultimate Optimizer

avp

NMBgMonitor

MsnMsgr

axcmd

IDMan

DTProAgent

Adobe Gamma

[Tootech]

The malware removal is being dealt with over at Malware Removal Forums

 

To avoid duplication and confusion the thread is now closed.