spyware detected on my pc

redballoon_2

i have a balloon pop up telling me i have 4 active spyware applications on my computer. it says to click to resolve so i download the sortware, it says i have x amount of infected files etc... but i have to pay to fix the problems!

i have downloaded ewido anti spyware, followed the instructions from the sticky thread. it's found one infected file already.

will this software fix the problem?

redballoon_2

ps its been running for 15 minutes , scanned over 18,000 files

redballoon_2

and i also get a "floating" info box (grey with red border) saying my computer is infected

Rikki

Are you scanning with ewido?
My last ewido scan took nearly two hours. It will clean or quarrantine anything it finds.

Browntoa

this is a different infection, ewido will not cure it on its own

stop the Ewido Scan

what is the software called they are trying to get you to buy ??

Browntoa

ok, do this first

Step 1: Run SmitfraudFix

The first step is to download SmitfraudFix here.
It's a ZIP file, so once it has downloaded, you will need to extract (unzip) it. (Click here if you're not sure how to unzip files).

The SmitfraudFix download site also offers instructions on how to use SmitfraudFix. Follow the instructions exactly

redballoon_2

there was four different ones. one called busta virus or something similar? it was yellow and black? there where some others. i can't remember the names. i will rack my brains

Browntoa

Next, you will need to reboot into safe mode.

• Restart your computer and press F8 just before windows starts (before the Windows logo screen appears).
• Choose Safe Mode from the menu that appears.

Now, run the Ewido anti-malware program and have it check your PC for infections.

1 Click the "Scan" tab to return to scanning options.

2 Click "Complete System Scan" to start.

3 When the scan has finished you will be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

4 Click on "Save Report" to view all completed scans. Click on the most recent scan you just performed and select "Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\ewido anti-spyware 4.0\Reports\

5 Exit Ewido when done

Browntoa

redballoon wrote:

there was four different ones. one called busta virus or something similar? it was yellow and black? there where some others. i can't remember the names. i will rack my brains

no problem, run the smitfraud fix i posted above first

the boot into safe mode and run ewido as shown above

only follow instructions from me, Pchelpman or alfonso from this point on

Browntoa

if you find Smitfraud and ewido do not clear the infection then follow these instructions, but only if you still have problems

1. Print out these instructions as we will need to close every window that is open later in the fix.
2. Download roguescanfix_setup.exe from here:
   
   roguescanfix_setup.exeConfirm that the file roguescanfix_setup.exe now resides on your desktop.
3. Double-click on the roguescanfix_setup.exe file found on your desktop.
4. Select your language from the drop down menu and then press the OK button.
5. Now press the Next button.
6. Select the option that says I accept the agreement and press the Next button
7. Press the Next button again.
8. Now click on the Install button.
9. The installation program will start installing RogueScanFix into C:\Program Files\Roguescanfix and then display a new screen. At the next screen, leave the checkmark in the Launch RogueScanFix and press the Finish button.
10. RogueScanFix will automatically be started and you will be presented with the Credits screen. At this screen press the spacebar and you will be presented with a menu. Press the number 1 on your keyboard and press enter. At the next screen simply press the spacebar on your computer to start the removal process.
    
    Note:Please note that when the program starts it will download a program from the Internet that it needs to use during the cleanup. If your firewall gives an alert about this, please allow the download.exe or run.bat program to access the Internet.
    When the program starts, your desktop will disappear, which is normal, so please do not be concerned. It will then start the SpywareQuake uninstallation program. When that program starts, click on the Uninstall button. When it has finished uninstalling, you can then press the OK button to finish the uninstalling of SpywareQuake.
    
    When this program is finished, and it was able to delete all the files, you will see a small prompt that says Completed script execution. Simply press the OK button. It will then open the Brute Force Uninstaller program. Close this by press ing the Exit button. If there a notepad open called task.txt, you can close that as well.
    If there were more files that needed to be deleted, the program will prompt you to reboot your computer. Press the Yes button and allow the computer to reboot. When you are back at the desktop, close the task.txt notepad if it is open

redballoon_2

thanks! my pc crashed but its just loaded up okay. one of the programs was called virus blast