Help - Search - Members - Calendar
Full Version: Darksma Downloader
BleepingComputer.com > Security > Am I infected? What do I do?
   
Akiraton
Okay so my computer started to have...pop ups and these notices that says "WinAntiSpyware" or "WinAntivirus 2007 get it now!".. and then it would install itself and I cant stop it! I have Yahoo! Anti-Spy and it detects Darksma...And the description of it is that its "design to retrieve and install additional files, often without user's notice or knowledge." I tried to remove it by Yahoo Anti Spy, and then it told me to reboot the computer. When I did, I scanned with the Yahoo Anti Spy again and Darksma is STILL in there...and the location is hkey_local_machine /software/microsoft/dinf...I dont know where that is! I cant seem to delete it...Does anyone know how to get rid of it? I know NOTHING about computers >_< Help anyone? Remember, I know NOTHING about...viruses/downloaders/etc. Please help ! =]
oldf@rt
I would recommend that you start trying to remove the problems with Trend Micro Housecall. once you complete the scan Let it remove everything that it can. When you have done this, please let us know your results.
Akiraton
Well I did run the scan and left it on overnight...This morning there were a list of infections[aobut 10] and vulnerabilities [over 50!]..So I clicked "clean now" and...It's been saying "Deleting Active Grayware and spyware" for over 2 hours and 30 minutes...should I stop it? Well it said "Preparing" for over 2 hours before this and I waited
Okay so the scan is done..but some of the infections couldnt be deleted...and at the bottom of my screen, next to time thingi on the bottom right corner, theres still the red X that says my computer is infected...>_< I restarted the computer after the housecall thing was done too...

Well results...NO MORE POP UPS! YAY~ And...my computer is EXTREMEMLY slow now >_> I think it was like that after I downloaded the updated version of iTunes last night...but I still have Darksma downloader and ..new adwares? [I'm scanning with Yahoo Anti-Spy btw] O_O And I have 3 more questions...

1.When theres a list..with infections and cookies..is it a good idea to delete all of em?

2.I tried to "Ctrl+alt+delete" but it says I cant do it because "task manager has been disabled by your administrator"...Is there a way to fix that?

3.Last night before I ran the scan...I dont know what happened but my desktop went blank after downloading the updated version of iTunes..the background is nothing..just a color..and it wont let me change backgroud when I right click to Properties..Can you also help me with this? Here is a picture:

Thank you! =]
oldf@rt
Download and run Superantispyware. Run the installer, accepting the defaults if the program needs to update, let it. when it is complete, restart the computer in safe mode. Run SAS, select scan your computer, in the next windows, select complete scan and click next to scan. when the scan is complete, click next to begin the removal process. If SAS needs to restart the computer again, let it. Again, let us know your results. Hopefully this will cure the task manager issue also.
Akiraton
Uhmm..before I do anything, what is "Restart computer in safe mode"? =X I dont know what safe mode is...hehe sorry ^_^ I know..barely nothing about this..and is it recommended to select "Protect Home Page"? I installed it already...now this popped up.
oldf@rt
http://www.bleepingcomputer.com/tutorials/tutorial61.html, if this does not work, you can still run the scan in regular mode. EDITLeave the home page alone for now
Akiraton
Okay so I figured it out myself because I want to get this over with! Blehh anyways I did what you told me to do and ...When the computer starts up where the screen is blue and it says welcome...It stay at that screen for a LONG time..where it usually stays there for only 3 seconds? >_< Well I ran Yahoo Anti Spy after SuperAntiSpyware rebooted the comp..and Darksma Downloader is STILL in there ..I still cant change my background and I still cant ctrl alt delete >_< I still have the red X at the bottom that says I'm infected too...Anymore advices?
oldf@rt
Just follow the preparation guide for posting the hijack this log. http://www.bleepingcomputer.com/forums/topic34773.html and then post the log.
Akiraton
QUOTE
- Clean out your temporary internet files and temp files.

Go to "Start" -> "Run" and type in the box: "cleanmgr". Let it scan your system for files to remove. Make sure these 3 are checked and then press "Ok" to remove:
Temporary Files
Temporary Internet Files
Recycle Bin

At this part, for me I only see PRESARIO (C:) and PRESARIO_RP (D:)..Which one do I click? I dont see the 3 listed...
oldf@rt
Click the C Presario only. the d is the recovery partition and is not used for anything but reloading the computer.
Akiraton
Okay well yesterday morning I left for fish camp from 7AM-4PM...And while I was at fish camp, my dad recovered the computer by pressing F10 when the computer is starting up, where the screens says COMPAQ...Now everything seems fine...I cant find the darksma downloader...and when I ran a-squared thingi, there were no viruses o_o the desktop and everything is fine....Is recovering the computer a good idea? I dont know...but I didnt mention this before...this has happened for months already...Whenever we reboot the computer, this pops up..
"Runtime Error!
Program: C:\Program Files\VerizonOnline\bin\mad.exe
abnormal program termination"

Do you know what that means? I want to get rid of it...but I dont know what it is o_O

edit// oh and I didnt do the hijack thing yet because I was planning to do it after fish camp but...i came home and saw...a desktop so..i was like..wtf o_O
oldf@rt
The first thing that you should do is to remove the trial anti virus that came with the machine and then install one of the freeware programs: http://www.bleepingcomputer.com/forums/topic3616.html Next you get to do every windows update known to mankind, make sure the computer has SP 2, and the additional 85 or so updates.
Akiraton
"remove the trial anti virus that came with the machine "...Uhm how do you remove them? o_O I have Norton Internet Security and stuff...and I wanted to get rid of it so I was bout to with Add/Remove programs but...I saw this..and I dont know what the heck it means...so I didnt delete it o_o
QUOTE
Use Extreme Caution!!



Modifing your registry can damage your operating system beyond repair!





Before proceeding, backup your registry! NOW!!

oldf@rt
Did you select a replacement antivirus from the list?

Don't mess with the registry!! This has been known to make windows inoperable, instead, you can download and use the Norton removal tool from Symantec.Uninstall everything that has Norton or Symantec in the add/remove programs list first, restarting as needed, then run the removal tool, then install the av program that you have selected. Caution, make sure that you are not connected to the internet while you are removing/uninstalling norton, and install the new av before reconnection.
Akiraton
Uhm...Theres 2 removal thingis..do I download both? And sorry for asking so many questions...What does AV mean? anti-virus? is a-squared counted as one? because I have it... But I'm really scared because my dad is gonna kill me if I screw the computer up >_< Dont mess with the registry? I dont know if my dad registered or whatever yet when he recovered the computer because I was at Fishie Camp...and I have the Zone Alarm firewall...Whenever I reboot the computer, zone alarm would always ask me "Symantec blah blah is trying to access the internet, ALLOW or DENY" whenever I click DENY, the internet does not work..I have to click ALLOW for it to work...and I clicked allowed already [of course to be here..] O_O soo...Help? >_< Sorry to keep botheringg you!
oldf@rt
The top one, not the .txt file. You never deny your AV (antivirus) access to the internet.
QUOTE
I dont know if my dad registered or whatever yet when he recovered the computer
Not the same as the registry I was commenting on post # 13. EDIT: A2 is an anti malware, not antivirus.
Akiraton
Uhm...what does registry from post 13 meant? I'm trying to understand exactly what it is so I wont do it >_< and you told me to not download the one thats a .txt file...Both of them are .exe o_O I clicked on the word Symantec from your post, post 14. O_O Here's the link.. ftp://ftp.symantec.com/public/english_us_...a/removal_tools
was that a smart thing to do...? And I just downloaded AVG Free if thats what you meant by AV Replacement...and so the steps are...to..
1. Download AVG Free and Norton Removal Tool.
2. Turn off the internet connection.
3. Go to Add/Remove and remove everything that has to do with Norton and Symantec.
4. Restart the computer.
5. Run the removal tool.
6. Install AVG Free.
Wait..when do I install the Norton Removal Tool? And are the steps correct? >_< I'm scared that once I delete Symantec, I cant go on the internet because whenever Zone Alarm blocks it, the internet page says "Cannot find server"
oldf@rt
The bottom one is for windows 95/98/me. Once norton is gone you will have access to the internet, this is the norton firewall conflicting with Zone Alarm, plus you did not allow before. When AVG is installed it will want to access the internet, just allow it so that Zone Alarm will learn AVG. The steps you are doing are good.
Akiraton
I did all the steps in order...and so far, everything seems great! Tho the computer starts up kinda slow...And I realized that I never used an Anti-Virus program before [I realized that when you told me a-squared was an anti malware thing, I'm so slow >_>] ! The only anti-virus I ever had was Norton...but I never used it [my dad did]! YAY~ Thank you so much oldf@rt ! Hopefully I won't come and bother you with all my questions again...=] Thank you so much for all of your advices!! Yayy~ It's finally over..Hopefully.
oldf@rt
Everybody has questions, Always ask!
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.