Im posting for someone else until she creates a name...



------------


I have a problem with my computer. I was looking someting up on google and it had a name as some porn thingie I guess and I clicked on it not realizing what it was at first but I got snoopy when I gt in ther ad went in too far. I made a bad mistake and will not do it again, I definately learned from this. But the codecvideo compressor 9.0 deal was downloaded on my computer and virusburst was too adn that is a trojan also. But I removed both of them through the add or remove program but htese little warnings by my clock there keep popping up. One is a yellow triangle with a ! mark in the middle saying System Alert: Malware threats and goes on about a trojan and someitmes its a virus. But if I click on it, an add of AntiVernins or pest control or something lik that comes up whcih are also trojans (I looked them up). Thre is another deal that is a yellow question mark and it switches back and forth from that to a blue or black circle with a yellow x in the middle and that warns of a critical system alert or something but that comes ut as the virusburts deal.

And I get these popups that have virus/spyware/trojan warnings or pictures of naked people. And I was looking on my add or remove program and I found a couple of htings that I'm not sure if htey are supposed to be there or not. LIke if they are what ehse little deals are coming from. They are Public Messenger ver 2.03 and Safety Alerter 2006. And I have these two sheild icons on my desk top adn the green one is security troubleshooting and the blue one is ONline Security guide (I htink this was on there before but I'm just not sure now). But I'm not sure what to do.
I have Norton Antivirus, Webroot SpySweeper, and Ad-Aware SE Personal on my cmputer but they d't seem to want to remove any of htese. I just put the Adaware program on today. I had it on but i had updated my spysweeper when runnign spysweeper adn that was a bad mistake so my computer had to be restarted completely adn I had to download the Adaware deal again But the trojans wn't let me go on downloads.com, it instead directs me to this spydoctor which I looked up and is another trojan. I did get the Adaware cuz I clicked on the download button before the trojan got ot it. But is there any free programs that can remove this stuff thats on my computer or stuf at reasonalbe price or if not, what are the good ones? Are the ones that I do have supposed to do this or isthere another program that is made for removing them adn teh ones i have are just for checking? I am so lost. i'm sorry if this is so long adn i hpe this is clear, I tried to explain it as best as I could. I hope this is in the right place too, I accidently posted in the guys forum, I had searched for another spyware thread and found one, but I ddnt realize it was the guys forum, I searched while in the general discussion area adn I guess I stupidly assumed that it would just search in teh general discussion part but I was worng.

Thank you 365 days gone for posting this. i really appreciate it. I'm the girl who asked for help in the oter forum> I didnt put the same user name down. But its me. I have windows xp if that helps more.

Also, when I was burnng a mix cd for my car cd deal, my windows media play siad that it couldn't detect a cd or dvd burner (I dnt have a dvd burner though). I do have roxio and it might work there but I was wondeirng if was affected by the trojan or malware virus too. there is also this warnign about the backdoor trojan too.

Hello 365_days_gone & MN2006, Welcome to bleeping computer...
You didn't provide much specifics,,, So I'll assume you are using XP or 2000. Were there any messages, what are the pop ups? What AV and spyware apps do you have? Which firewall are you using?
In SAFE MODE,install AVG Antispyware. This may take quite some time, an hour or so, depending on speed and infection How to start Windows in Safe Mode

First go here and print out the instructions on install / scan with AVG

Be sure to check for the any updates to the program after you install these.
Download and run ( formerly known as ewido) AVG Antispyware 7.5

Following these instructions Download and run Spybot Search & Destroy 1.4 (with out tea timer option)

Download and run SUPERantispyware, free version Home User

Now Run Windows OneCare Live
Be sure to click ONLY on the grey box below the picture of a wrench “Full Service Scan”
Again this may take some time especially it it needs to defragment the drive.
Please post back with any questions and results
Click "yes" to install any active X components these sites may ask for..
Post back if you have any further questions

I am using Windows XP and I have Norton antivirus, webroot spysweeper, and Ad-Aware SE Personal. I dn't know what firewall I have though. It says Windows Firewall when I went to the change firewall settings.

The pop ups were pictures of naked women, some were warnings of viruses and showed the system and percentage o what was affected I think. But mainly warnigns of viruses, spyware, adn trojans. I cnat remember word for word. also one cam up for hte toolbars. I forgot to mention the protection bar that is on my broswer on Internet Exploreer. I dn't remember it being there before, it reads Protection bar, remove adware popups, spam protection, scan for spyware and security test from left to right. I cna't turn it off, I tried but it wn't go off. But I have this yellow triangle with an exclamation point in the middle warning me "Security Alert: NetWorm-i.Virus@fp, type:virus/Network worm damage level: high, Description virus that infects executable files. Recommendation: Delete/quarantine immediately, protection: Click this baloon to download certified Antivirus software." this is what this one says, it comes up with diffeernt ones too, like a backdoor trojan adn others that I cna't remember. I have this yellow question mark that goes from that to a dark blue circle with a yellow x in the middle and that is critical system Alert. If I click on this one, Virus Burst popup comes. If i click on teh triangle one, AntiVermins or a pest something program pops up. I got the videocodec compressor deal uninstalled and virusburst uninstalled but hese little deals by my clock are still here.

Also I cna't get on www.downloads.com. It comes up with this systemdoctor deal that is also a trojan all the time now.

hello
If you can't run any of the links ( not even AVG or One Care) I provided then I suggset you follow these instructions for Posting a Hi Jack this Log, Let one of our experts take you thru this...
Remember once Log is posted DO NOT make any changes to your PC.. You will be helped and fixed

The critical System Warning popup came, its a small gray one with a triangle with exclamation mark in center and it reads "Your System is probably infected with latest version of Spyaware.Cyberlog-X. And it goes on with the type, infection length, risk, systems infected, behavior, symptoms, and protection and at the botto its ok or cancel." then I got anothe rpopup while posting htis that says, "Notice: If your computer has been running slower than normal, it may be infected with viruses, adware or spyware. WinAntiVirus Pro 2006 can perform a quick and completely FREE scan of your system for malicious programs. download WinAntiVirus Pro 2006 FREE now!" then it says ok or cancel at the bottom but sometines when I push x, it just goes on to the pagea nyways.

Thanks, I'm actually pringint the instructions out so I now what to do when I try it. I"m a littl slow here but what did you mean byt the Remember once log is posted, do not make any changes to your PC?

I'm talking about if after you run the AVG, SUperAnti spyware,Spybot and One care scans. If they don't fix it you would post a log in the HIJACK forum. Then you can't make any changes . But for now do all the things in my first post. I think you may need to run a Vundo fix, but we'll worry bout that if needed.

By the way there are free firewalls HERE . They are more protective than the windows firewall. But first do the above stuff. once your cleaned up, you can replce the firewall..

Ok, I put my computer in safe mode, restarted it, and it came back with a black background but it had the icons. so I clicked on the itnernet explorer and it came up page canot be displayed. I clicked on favorites for htis link to this site and the same thing came up so I don't know how t download the AVG AntiSpyware on safemode. Is there something else I'm supposed to do to when it restarts? I follwoed the directions and put it backto normal mode when it restarted and restarted it again. Is that it or should I try again with the safe mode/ I did the manual safe mode. But after I did the run thing and the box came up, it showed it already being clicked on the selective startup, but mine was on normal startup when it came up. Did that do something to it? I hope I'm not geting too annoying with all my quesitons.

OK I see, DOWNload and install from normal mode then run them in safe mode .. At least the AVG( ewido). The latest update for Super (Yesterday should allow it to riun in normal)

Thank you guys so much. It did work and I am not seieng the little warnings pop out of the little box by my clock deal, nor am I getting popups.

But nw i have a quesiton, are these programs that I installed on my computer for htis free? I kwno a couple ofthem are, but is there one that I'm on free trial for? I thought I saw that somewhere but I"m can't remember. But if I take them off, will it put the trojans that were on this before bak on here? I'll keep the free ones, but I can't afford to pay for them. i am going to have to renew the Webroot spysweeper and norton anitvirus soon and thats going to add up (I"m a college student adn trying to stay on a budget ). But thanks again, I am glad I was led to here, cuz i"m sure if I brought it in, I woul dhave payed a 100 dollars or more, maybe less but I dnt know. I"m going to check out those firewalls you posted, boopme an put them on my computer.

That's great and you're welcome.
No they won't put anything back.
You should do the firewall now. The windows wall only blocks traffic one way.
From that link with the fire walls are also free AV's. When you're ready to renew Norton ,I say don't, uninstall it completely ( we have a guide here for that) and use one of the free ones.
I think you talking about the trial of AVG ( ewido)or Super you can always run the free, but you have to remember to run their updates manually at least once a week. Spybot and adaware are free.
Read thru some of the pinned topics here
http://www.bleepingcomputer.com/forums/forum25.html
Feel free to ask for any further assisrtance
Have a nice day

btw another great free tool is Site Advisor gives advise on the safety of a site
http://www.siteadvisor.com/

hello i ave the same stupid triangle. i tried running adaware, and advanced windows cleaner but i got rid of alot but not this apparently.
thanks for any help

I am running 2000
and here is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:58:17 PM, on 6/24/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
E:\Access Remote PC 4.9\rpcsetup.exe
C:\WINNT\system32\msasvc.exe
C:\MSSQL7\binn\sqlservr.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\MSSQL7\binn\sqlagent.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Video ActiveX Access\iesmn.exe
C:\Program Files\Video ActiveX Access\imsmain.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Video ActiveX Access\imsmn.exe
C:\Program Files\Video ActiveX Access\iesmin.exe
C:\Program Files\Oqfkfuf\Macp.exe
E:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\system32\NvCplDaemon.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\REFLEXIVE GAMES\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {B8C5186E-EC37-4889-9C2E-F73649FFB7BB} - C:\Program Files\Video ActiveX Access\iesplg.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Video ActiveX Access\iesbpl.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OWS Setup CmdLine] "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\40\bin\cfgwiz.exe" /pkg "Office 2000 Server Extensions"
O4 - HKLM\..\Run: [Rijwbm] C:\Program Files\Oqfkfuf\Macp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] C:\WINNT\system32\NvCplDaemon.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [none] C:\Program Files\Video ActiveX Object\pmsngr.exe
O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video ActiveX Access\iesmn.exe
O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Program Files\Video ActiveX Access\imsmain.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...html?p=ZJfox000
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Administrator\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - http://www.worldwinner.com/games/shared/wwlaunch.cab
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINNT\system32\dlvenum.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\system32\browseui.dll
O22 - SharedTaskScheduler: hellenophile - {6f396a67-f473-48c9-9950-636ce17e584e} - C:\WINNT\system32\yesgnhr.dll
O23 - Service: Access Remote PC Service 4.9 - Access Remote PC (www.access-remote-pc.com) - E:\Access Remote PC 4.9\rpcsetup.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINNT\system32\msasvc.exe
O23 - Service: Office Server Extensions Notification Service (OWSTimer) - Unknown owner - C:\Program Files\Microsoft Office\Office\OWSTIMER.EXE

--
End of file - 8733 bytes