Undetected spyware!

[QuestionGirl]

I downloaded Version 1.4 last night and installed it. It detected this whole list of things on my machine and cleaned almost all of it up. It gave an error when trying to remove the spyware and prompted me to restart the computer - so that it could scan at startup. It did so - and things looked well. BUT!!! When I open any web page - I see words/phrases double-underlined as hyperlinks - taking my cursor on top of these words - shows the message 'Search for: ..' followed by the text of the word that is underlined. And a big message box like a toop-tip shows next to the word with info on a website.
Help! I know this is a spyware/adware program - but Spybot is unable to clean this creep from my system. Its my mistake - I accidentally let something install on my machine and am paying for my sins... :(

Any related help is very welcome...

Thanks!
QuestionGirl

[tashi]

Hi there.
Could you post a Spybot-S&D log please so we can take a look at the system in question.
Spybot-S&D
Open SpyBot, check for and get any updates available, close all browsers, check for problems and fix everything found. Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except:

uncheck[ ] Include a list of services in report.
Uncheck[ ] Include uninstall list in report.

Now select (near the top) view report.
Press export in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach that report.

If you have any problems attaching the Spybot log please go ahead and copy paste the log.
Cheers.

[QuestionGirl]

Hi Tashi...
Thanks for your note. I did what you asked me.
The version of SpyBot is updated with the latest updates.
I ran SpyBot and it congratulated me on having no immediate threats. I exported the report. In a fix report from the first time I ran SpyBot on 10/24, I saw that the dll that SpyBot could not delete was NEM.dll for the Optimizer software. I looked into the Windows folder and found it sitting there - but nicely named by SpyBot as NEM.dll.TobeDeleted or something. I was able to delete it. There was nothing else in the fix log which showed a status of 'Failed'.
That has not helped. I am attaching the logs from the first scan and the fix log on 10/24 apart from the log from today. Hopefully you can analyze it and help me out.
One more thing - I tried to update my mcAfee version- and the update froze on me midway - I could not even shutdown. I had to hardboot twice for a successful reboot.

Thanks for your help...
QG

[tashi]

Hello QuestionGirl.

Thank you for the logs. :)

In order for the infection to be removed entirely you will need to go to a forum that removes malware using a program called HijackThis. (HJT)

A good place to start: Removed.

Hope that helps. :)

EDIT:

Members, we now have a malware removal forum:
Follow the procedure in this link: "BEFORE you POST" (http://forums.spybot.info/showthread.php?t=288) Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22)

[plteng]

hi

I have xperienced a similar problem with the following:
hxxp://pcturbopro.com/.storage/index.php?aid=nm_ik_pctp_launch_au_en_ed2&lid=keyin&affid=
nm_67333_7d818d7aed6a11dbb14d003048895bfc_320d180e+76d1099703064d689cf9499b94be4841&ax=1&p
=14&ex=1&h=10&j=1&w=0

I have tried to rid my comp of this with no success. I have snet in a log and continually get pop ups trying to 'optimize' my comp. I have run Norton and SpyBot with no success. Can you please advise me on how to stop these ass clown sites.
Thanks in advance

[tashi]

Hello plteng.

The topic you responded to is from 05-10-25. :)

Please follow the procedure in this link:
"BEFORE you POST" (http://forums.spybot.info/showthread.php?t=288)

Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) and a helper will advise you as soon as available.

Cheers.