"stealth" spyware

Dave,

For the users having trouble getting into Safe Mode, remembrer we have
the free BootSafe application:
http://www.superadblocker.com/bootsafe.html

Support all versions of Windows and is free. So far it has been well
received.

Nick Skrepetos
SuperAdBlocker.com
http://www.superadblocker.com

From:

| Dave,
|
| For the users having trouble getting into Safe Mode, remembrer we have
| the free BootSafe application:
| http://www.superadblocker.com/bootsafe.html
|
| Support all versions of Windows and is free. So far it has been well
| received.
|
| Nick Skrepetos
| SuperAdBlocker.com
| http://www.superadblocker.com


Do'h !

Yes I completely forgot about this -- Thanx Nick !

Hula:
Sorry Hula, I should have suggested Nick's utility. It is new and I forgot all about it.

I do suggest this utility to boot into Safe Mode.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

David,
Thank you very much for your last reply - which proved helpful up to a point.
I replaced my earlier versions of SpyBot and Ad-aware with those you
recommended, and ran them both in both modes. In Safe mode SpyBot detected
some five rogues and sucessfully removed four. Unfortunately, one -
Smitfraud-C remains resolutely immoveable.
And:-
I have just received a popup which I suspect, but can not be certain, is a
rogue: what should I do with it? It reads:-
CRITICAL ERROR
Attention! Security module responsible for popup windows blocking has been
deleted by computer virus. To block adware popups you need to download one of
the security patches published by our official partners:
WinAntiSpyware;WinAntiVirus Pro:& Spy Fighter.

Am I correct in being highly suspicious?


I run the Norton Antivirus & Firewall programmes , not the McFee programme
you appear to recommend elsewhere.

Sincerely,
David Hooley
--
gideon fennell


"David H. Lipman" wrote:

From: "david hooley"

| I have encountered a very similar problem over the past two or three days.
| It seems to me that a virus of some kind is being used to try and corner me
| into purchasing an anti-viral, anti-popup programme that i dont need and cant
| afford. It claims that my computer is affected by several dozen germs and
| bacteria of various kinds, especially a trojan called
| iworm-attck-v122.02a.Norton, adaware and spybot alL agree that my computer is
| clean - but still the pesky things popup. PUZZLING!!!

You are infected with adware/spyware making false claims to get you to purchase other
software most likley a rogue anti spyware aplication.

Are you using Ad-aware SE v1.06 and SpyBot Search and Destory v1.4 ? If they are older
versions you need to remove the older versions and then installed the latest versions and
update them and then scan in Safe Mode.

Download HiJack This! -- http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Create a log and post the log in one of the various forums where you can get expert advice
for HiJack This! (HJT) logs.
NOTE: Registration is REQUIRED before posting a log
NOTE: Web sites NOT listed in any particular order

http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/security
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/forumdisplay.php?f=24
http://www.cybertechhelp.com/forums/...splay.php?f=25
http://www.geekstogo.com/forum/Malwa..._Here-f37.html
http://gladiator-antivirus.com/forum...?showforum=170
http://forum.iamnotageek.com/f-130.html
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://boards.cexx.org/viewforum.php?f=1
http://www.malwarebytes.biz/forums/i...hp?showforum=5

{ borrowed from the alt.privacy.spyware News Group }


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

From: "david hooley"

|
| David,
| Thank you very much for your last reply - which proved helpful up to a point.
| I replaced my earlier versions of SpyBot and Ad-aware with those you
| recommended, and ran them both in both modes. In Safe mode SpyBot detected
| some five rogues and sucessfully removed four. Unfortunately, one -
| Smitfraud-C remains resolutely immoveable.
| And:-
| I have just received a popup which I suspect, but can not be certain, is a
| rogue: what should I do with it? It reads:-
| CRITICAL ERROR
| Attention! Security module responsible for popup windows blocking has been
| deleted by computer virus. To block adware popups you need to download one of
| the security patches published by our official partners:
| WinAntiSpyware;WinAntiVirus Pro:& Spy Fighter.
|
| Am I correct in being highly suspicious?
|
| I run the Norton Antivirus & Firewall programmes , not the McFee programme
| you appear to recommend elsewhere.
|
| Sincerely,
| David Hooley

Use the following two phase approach to remove the SmitFraud and its accomplices.

The solution in Part 2 does use a McAfee command line AV scanner and it does NOT need to
pre-exist on your PC.
All components will be downloaded for your use. Just take a note on the FireWall issue
noted in Part 2.

Run both in Normal Mode and then run them both in Safe Mode.

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html

Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

And that is absolutely a neat program!
***

"David H. Lipman" wrote in message
...
From:

| Dave,
|
| For the users having trouble getting into Safe Mode, remembrer we have
| the free BootSafe application:
| http://www.superadblocker.com/bootsafe.html
|
| Support all versions of Windows and is free. So far it has been well
| received.
|
| Nick Skrepetos
| SuperAdBlocker.com
| http://www.superadblocker.com


Do'h !

Yes I completely forgot about this -- Thanx Nick !

Hula:
Sorry Hula, I should have suggested Nick's utility. It is new and I
forgot all about it.

I do suggest this utility to boot into Safe Mode.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

From: "Fitz"

| And that is absolutely a neat program!
| ***
|

Yeah I know. Nick emailed me about it last week. And I blew it ! I completely forgot all
about.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

He emailed me also about the same time but you beat me to it!

--
***
NEVER download files from anywhere unless it is from the website of the
developer, manufacturer or some entity that you trust. Developer websites
ALWAYS have the most up to date files that haven't been tampered with by
some third party who is "hosting" (read Leeching or Stealing) those files
without permission. Never open email attachments from people you don't
know. It's called Safe Hex.
***

"David H. Lipman" wrote in message
...
From: "Fitz"

| And that is absolutely a neat program!
| ***
|

Yeah I know. Nick emailed me about it last week. And I blew it ! I
completely forgot all
about.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm