Infected sPYWARE

[PuntoDom]

Do you not have protection, i run spybot and spyware doctor everyweek, virus check every two weeks.

[Shades]

yer just like that?

This is a 'broadcast feature' built into windows. It was supposed to be for system administrators to issue messages and alerts to users on a network.
However, as with a lot of things, undesirables have found a way to use it over
the internet. Its pretty much a redundant feature so can be disabled without affecting anything else.

First check that its enabled (if it is this is probably the cause)

Go to Start -> Control Panel -> select (in classic view) Administrative Tools -> Services.

In the right-hand pane find "Messenger" (Please note that this has nothing to do with Windows messenger or anything like that) and double click. The Dialog that opens should already be on the General tab (if not go to it). Half way down that page there should be a drop box called "Startup type", select disabled.

To stop the messages from appearing instantly, without having to wait to restart your PC click on the Stop button.

Let me know if this works

----------------------------
70 Virii!!!

Not visiting so many dodgy sites may help too!

----------------------
A girl should always have protection as you can't rely on others!

[Cat]

Hi, ive checked and it said it is disabled.

SInce doing the scan my pc is super slow, like 3 mins to load a page.
Bastard thing.

[chris gt]

yeah ive got spyware on my comp
it dont let me go on google,msn and others and ive tried all that has been mentioned and none work still says im infected when i try to get on some web pages
any thoughts?

[Shades]

yeah ive got spyware on my comp
it dont let me go on google,msn and others and ive tried all that has been mentioned and none work still says im infected when i try to get on some web pages
any thoughts?

Sounds like you've got a browser hijacker, so yes, I have a few thoughts...

1) Stop visiting dodgy sites!
2) Download the following utilities, if your browser will let you...

• HijackThis (from merijn.org)
• CounterSpy (from sunbelt-software.com)
• ProcessExplorer (from SysInternals.com)

I'm not professing to be an expert or anything but I will try and help you as I've looked on many spyware sites for this kind of info and been left nothing but confused (So I just sort of did things myself, and they worked!).

First of all install and run HijackThis then either post the log it produces here or PM it me (probably best if you PM it, as it can be quite big and I don't think the administrators will be amused!)

[4stroke110]

can you not jsut system restore??






















































...just a thought ???????? sorrry

[Shades]

Hi, ive checked and it said it is disabled.

SInce doing the scan my pc is super slow, like 3 mins to load a page.
Bastard thing.

You've not got LimeWire or something running in the background (starting when your PC does) have you? If your network connector (cable modem/router or whatever) has lights on it do they go mental even when your not doing anything or when your screensaver is running, etc?

can you not jsut system restore??

...just a thought ???????? sorrry

If your very, very, very, very, very, very, very, very....... very lucky, yes!

There is a problem with system restore though. It only contains settings. When you do a system restore no physical files are actually removed etc.

So for example, you create a system restore point, then install 3 programs which you decide you don't like or seem a bit dodgy, you then restore your PC to the point you created and everything looks normal. But, do a bit of digging and you will see not much has changed. All the physical files for the 3 programs you installed are still there, sitting on your hard-drive.

With this scenario in mind remember, it only takes one .exe hiding somewhere on your PC to kickstart a virus infection, change or add settings the virus needs and spawn many files all over your system.

So you do your system restore and you think everything is fine. But, unknown to you you've just allowed the virus to re-infected your PC.

Obviously virus writers aren't dumb. Part of a virus could be to insert a setting into all your system restore points so the next time your PC boots into Windows after a restore (a restore that didn't remove/change any physical files on your PC) the rogue .exe file thats still hiding on your harddrive gets run again and the infection begins again.

Thats why any virus checker worth its salt will go through your system restore points checking for this sort of thing. This is probably the most basic example but there are plenty of ways virus writers can ensure their virus self-propagates(sp?) after a system restore.

Im going to stop now because I've bored myself and you probably get the idea!

[Cat]

You've not got LimeWire or something running in the background (starting when your PC does) have you? If your network connector (cable modem/router or whatever) has lights on it do they go mental even when your not doing anything or when your screensaver is running, etc?

Well it all seems to be ok now. Ive cleared all virus's and its back to speed.
The lights on the router do go mad, all the time, they flash on the ethernet light and the internet light.
But, its all good i think.
Thanks for the advice. x

[chris gt]

yeah cheers that hijack this has got rid of it cheers shades

[mattj_uk]

Cat have you got a firewall installed and running? and i dont mean the windows one.