Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Security Center Alerts...spyware?


  • Please log in to reply
23 replies to this topic

#1 Speedway73

Speedway73

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 03 December 2007 - 09:37 AM

Hey all...newbie here and I'm not sure if I'm in the right place. I recently clicked on something I shouldn't have (a program or download) and now my desktop picture has changed to a black screen with the warning that my computer is infected with spyware. I have run every free spyware and adware program out there and still the same thing. I keep getting an official looking Windows Security Center alert that says my computer is infected. When you click on it...it just sends me to a page trying to sell me anti spyware software. My 'puter is much slower now and I keep getting pop ups stating it's infected. The same pop up everytime. I often have to refresh each page to continue. I'm using Windows XP.

Can anybody tell me how to de-bug this thing and get me back up and running normal??

BC AdBot (Login to Remove)

 


m

#2 buddy215

buddy215

  • BC Advisor
  • 12,621 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:02 PM

Posted 03 December 2007 - 09:46 AM

It is likely Smitfraud or Vundo.
Use Super Antispyware to identify and remove the malware.
Post back with what SAS found and for further instructions.

Install Super Antispyware free. Run it in safe mode. Allow it to quarantine whatever it finds.
http://www.superantispyware.com/

How to Start Windows in Safe Mode:
http://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#3 Speedway73

Speedway73
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 03 December 2007 - 10:36 AM

buddy215...I downloaded SAS to my desktop. no issues there...but when i get into safe Mode and try to run SAS...I get an alert? that says something about administrator wont allow it.

Help??

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:02 PM

Posted 03 December 2007 - 11:10 AM

How to login as Administrator in Windows XP?
How to Use the "Run As" Command to Start a Program as an Administrator.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 buddy215

buddy215

  • BC Advisor
  • 12,621 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:02 PM

Posted 03 December 2007 - 11:10 AM

SAS must be installed before going into safe mode. Not just downloaded. If you HAVE installed and it still want work in safe mode then run in normal mode.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#6 Speedway73

Speedway73
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 03 December 2007 - 01:20 PM

I got it to work...mistake on my part.

so...I ran it in Safe Mode....found a bunch of issues and deleted them.

Re-start computer and......same thing.... black screen.. with warning about Spyware.

Any suggestions?

#7 buddy215

buddy215

  • BC Advisor
  • 12,621 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:02 PM

Posted 03 December 2007 - 01:32 PM

I asked in my first post for you to list what SAS found. Without that info it is only a guess as to whether it is Vundo, Smitfraud or something else.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#8 Speedway73

Speedway73
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 03 December 2007 - 04:00 PM

Yes you did...I'm sorry. I just ran it again in normal mode and it only found 2 issues...yet i just cleaned it out too. I will run it again to see if anything else pops up again.

Thank You!!

#9 buddy215

buddy215

  • BC Advisor
  • 12,621 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:02 PM

Posted 03 December 2007 - 04:42 PM

Run the online scan for Bit Defender in normal mode. Allow it to quarantine whatever it finds.
http://www.bitdefender.com/scan8/ie.html

Post Bit Defender's log here.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#10 Speedway73

Speedway73
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 04 December 2007 - 02:27 PM

buddy215...I ran Bit Defender and came up with nothing. But I did run SAS again AFTER checking for more updates...which there were several. It did find more junk. Here's the log from it:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/04/2007 at 12:56 PM

Application Version : 3.9.1008

Core Rules Database Version : 3354
Trace Rules Database Version: 1353

Scan type : Custom Scan
Total Scan Time : 01:14:35

Memory items scanned : 640
Memory threats detected : 1
Registry items scanned : 5448
Registry threats detected : 1
File items scanned : 49140
File threats detected : 15

Trojan.Unclassified/SLDR
C:\WINDOWS\SYSTEM32\LWINUPDATE.EXE
C:\WINDOWS\SYSTEM32\LWINUPDATE.EXE

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tradedoubler[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@specificclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.adbrite[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@zedo[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adopt.specificclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@e-2dj6wjkocmcpego.stats.esomniture[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adultadworld[1].txt

Trojan.Media-Codec/V4
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#E404Helper [ {6bd36adb-7281-4670-bff3-c029d9d8f2c3} ]

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:02 PM

Posted 04 December 2007 - 02:51 PM

Mostly "tracking cookies" showing. Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups nor do they install malware. As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize this by reading "Blocking & Managing Unwanted Cookies".

Now go to Start > Run and type: regedit
Press "OK" and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the right pane you should see the default entry for Userinit and the "Value data" should read: C:\WINDOWS\system32\userinit.exe,

Let me know what it says but don't make any changes.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 buddy215

buddy215

  • BC Advisor
  • 12,621 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:02 PM

Posted 04 December 2007 - 02:53 PM

Are you still getting the black screen and warnings?

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#13 Speedway73

Speedway73
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 04 December 2007 - 03:24 PM

Mostly "tracking cookies" showing. Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups nor do they install malware. As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize this by reading "Blocking & Managing Unwanted Cookies".

Now go to Start > Run and type: regedit
Press "OK" and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the right pane you should see the default entry for Userinit and the "Value data" should read: C:\WINDOWS\system32\userinit.exe,

Let me know what it says but don't make any changes.


quietman7....Here goes it.

C:WINDOWS\system32\winupdate.exe,c:WINDOWS\system32\userinit.exe

#14 Speedway73

Speedway73
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:02 PM

Posted 04 December 2007 - 03:34 PM

Are you still getting the black screen and warnings?


Yup. My 'puter is much quicker now...probably the quickest it's ever been. The annoying Windows Security Center alerts have disappeared along with the alert bubbles that appeared in the lower right hand corner.

Home page is good now too. No more issues there too.

But the black screen w/warning is still over top of my desktop pic.

What I have noticed is that when I start my computer...after my log on screen...it used to put up my desktop pic and icons right away when loading.
Now (since I ph*cked up this thing),my desktop pic comes up a bit later and stays there while everything is loading. No icons yet though.
After a few minutes of loading...it flashes to the black screen w/warning and THEN my icons appear.

It stays like that as long as my 'puter is on.

#15 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:02 PM

Posted 04 December 2007 - 03:36 PM

Please download SDFix by AndyManchesta and save it to your desktop.
alternate download
When using this tool, you must use the Administrator's account or an account with "Administrative rights"
  • Double click SDFix.exe and it will extract the files to %systemdrive%
  • (this is the drive that contains the Windows Directory, typically C:\SDFix).
  • DO NOT use it just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  • Copy and paste the contents of the results file Report.txt in your next reply.
-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users