PDA

View Full Version : nasty adware won't go away



MusicMan
2008-03-16, 19:54
sorry for the vague title...I've never posted here before, and I realize that I'm not providing nearly enough adequate information for anyone to really help and it's just a bunch of vague random information, so please let me know how to post the logs and whatever else.

I'm running the newest version of spybot (1.5.2.20) and it's fully updated and immunized. I get little balloons that show up in the bottom right-hand corner saying I need to run and full scan and "click here." my background has been changed to this, and I can't change it.

http://i32.tinypic.com/wuovnp.jpg

When I run spybot, I get these problems found: 180solutions.searchassistant, 2020Search, CoolWWWSearch.Leftovers, Microsoft.WindowsSecurityCenter.TaskManager, SecondThought.STCLoader, Smitfraud-C, and Zango

Even though it says it fixed all of them, the Task Manager is still unavailable when the microsoft.WSC.TM one is deleted.

Most are in the windows directory. Whenever I run a scan and fix the problems it says all the problems are fixed, but I still get balloons and popups of a fake windows security center saying I need to install spyware remover software. I can run a scan immediately after a previous scan and get the same problems even though it just said they were fixed.

There some system startup entries that were adware programs, namely two entries of ctfmon.exe. There were also 4-5 entries of "spybotdeleting," which I unchecked.

Also, I can't access my task manager, I get a popup saying that it's been disabled by the administrator.

While I'm running a scan of spybot, AVG pops up a few times with virus warnings.

I've run many scans in safe mode, and even then it doesn't fix anything, and the popups persist.

tashi
2008-03-16, 20:16
Hello,

I get little balloons that show up in the bottom right-hand corner saying I need to run and full scan and "click here." my background has been changed to this, and I can't change it.


That infection will need to be removed manually if normal methods do not work.

Please follow the procedure in this link:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a helper will advise you when available.

Best regards.

MusicMan
2008-03-16, 20:26
you can go ahead and delete this, I figured it out on my own. You were a HUGE help, thanks :P :angel:

tashi
2008-03-17, 01:29
Thank you for letting us know. :)

BulbusMaximus
2008-03-17, 10:16
Thank you for letting us know. :) i thought i shoud let you know that that virus is going around you need to avoid torrent files used by media downloads , if your player wont play it. meaning windows media player, then dont watch it. just make sure you go to microsoft and get all the codec they offer