Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Did I make a big mistake?


  • Please log in to reply
10 replies to this topic

#1 pietrzak

pietrzak

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 October 2008 - 08:42 AM

Did I make a mistake by buying anti-spyware online? From www.antispywarebot.com apparently. I now have their icon on my computer. Is this legit or am I now infected? Am I in danger of having info stolen? The problem I was having was when I would google something it would redirect me to an ad when I clicked on the subject on the Google page and would not give me the correct site. So I paid for the service and everything is working fine now.

P

BC AdBot (Login to Remove)

 


#2 Maniac

Maniac

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria, EU
  • Local time:02:34 AM

Posted 27 October 2008 - 08:48 AM

You are done, perhaps the biggest mistake of your life! AntiSpywareBot is a rogue program.

A rogue program is a malicious program that is disguised, for instance, as trustworthy anti-spyware programs or registry cleaners. But these programs are only put on the market to scare you into buying these programs because they make exaggerated claims about the safety of your computer or, worse still, give erroneous scan results or put their own malware in your system.


AntiSpywareBot is a corrupt antispyware application created to goad users into purchasing its full rogue version. AntiSpywareBot may be installed without your permission and consent through web security loopholes or via malicious Trojan parasites. Once installed on your computer, AntiSpywareBot will issue fake notifications claiming that your computer is suffering from spyware woes. These messages shouldn't be trusted and AntiSpywareBot is recommended to be removed immediately. Additionally, AntiSpywareBot may be very difficult to get rid of manually because of its ability to re-install itself.


Now:

Scan with MalwareBytes' Anti-Malware:

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Then, submit log file ESET SysInspector, to see what the situation.

Download ESET SysInspector
http://www.eset.com/download/sysinspector.php

- Start program through the SysInspector.exe
The program will collect information about the situation on your machine.
- When "inspector" is ready and log file - generated, select File> Save Log
- Confirm their wish

Choose to save the file somewhere and then upload on http://4storing.com/ (when you open the page, click on the Great Britain flag to open the page in English), then give me the link.


Edited by nod32fen, 27 October 2008 - 08:53 AM.

Posted Image

#3 pietrzak

pietrzak
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 October 2008 - 09:58 AM

Okay I finished, but not the sysinspector.exe, I dont see that on the screen, just 32 and 64 bit downloads.

Malwarebytes' Anti-Malware 1.30
Database version: 1328
Windows 5.1.2600 Service Pack 3

10/27/2008 10:23:25 AM
mbam-log-2008-10-27 (10-23-25).txt

Scan type: Quick Scan
Objects scanned: 43796
Time elapsed: 8 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AntispywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\documents and settings\all users\start menu\programs\antispywarebot\ (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSpywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
C:\Documents and Settings\lg\Application Data\AntispywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
C:\Documents and Settings\lg\Application Data\AntispywareBot\Log (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareBot\AntispywareBot on the Web.lnk (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareBot\AntispywareBot.lnk (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
C:\Documents and Settings\lg\Application Data\AntispywareBot\Log\2008 Oct 24 - 10_45_49 AM_453.log (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Desktop\AntispywareBot.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully.

#4 Maniac

Maniac

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria, EU
  • Local time:02:34 AM

Posted 27 October 2008 - 10:08 AM

Download ESET SysInspector from:
http://download.eset.com/download/sysinspe...ysInspector.exe
Posted Image

#5 pietrzak

pietrzak
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 October 2008 - 10:14 AM

I am dumb to this. How do I save the file to somewhere?

#6 Maniac

Maniac

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria, EU
  • Local time:02:34 AM

Posted 27 October 2008 - 10:23 AM

Here's a little more simply explained:
1. Download the program from:
http://download.eset.com/download/sysinspe...ysInspector.exe (Click on this link right mouse button and select "Save Link As" and pointed to record a desktop).

1. Click twice with the left mouse button over the SysInspector.exe
2. Wait
3. In the upper right corner, click on File and select "Save As".
4. Indicate log files to be saved on the desktop.

Then, upload on http://4storing.com/ (when you open the page, click on the Great Britain flag to open the page in English), then give me the link.
Posted Image

#7 pietrzak

pietrzak
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 October 2008 - 10:23 AM

I saved it to My Documents but the 4 storing wont take it keeps saying error. I assume I type in the file name in my Documents which is SysInspector-VALUED-CB7D4

#8 pietrzak

pietrzak
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 October 2008 - 10:34 AM

Okay I think I got it. The download link is http://4storing.com/zymta/981d8e63bdc1bff3...ae70b26278.html There is also a delete link do you need that?

#9 Maniac

Maniac

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria, EU
  • Local time:02:34 AM

Posted 27 October 2008 - 10:50 AM

Delete Link is unnecessary in this case. MalwareBytes' Anti-Malware has done its job very well. You're clean!
Posted Image

#10 pietrzak

pietrzak
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 PM

Posted 27 October 2008 - 11:05 AM

I thank you very much unless you are a spy also. So am I safe to order on line? Of course, the company does have my CC number because I bought from them online. Dumb, dumb, but live and learn. In the future I will never do anything like that again. I have to stay away from those porno sites. ;)

#11 Maniac

Maniac

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria, EU
  • Local time:02:34 AM

Posted 27 October 2008 - 12:47 PM

If more careful, you will be well protected. When you have a problem, write in the forum. ;)
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users