So like a huge moron I downloaded spyware... PLEASE HELP ME!

Did you uninstall and delete whatever it is that you downloaded? Look in Add/Remove programs too and make sure you uninstall anything related to what you downloaded.

If still having a problem, your next steps are below.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis​

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy - only for Windows XP, 2K, & NT users
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

The same instructions still apply! If you want help, please follow the instructions given.

 

Re: Results from my cleaning process ATTN:chaslang

Please remain in one thread!!! I merged you back to your other thread.

You have HijackThis installed exactly where step 7 specifies not to install it. Please fix this now.

Also you are missing two required logs.
runkeys.txt - the log from GetRunKey.bat
newfiles.txt - the log from ShowNew.bat

 

There is not real true installation so there is no real uninstall. If you had followed the directions in the READ ME and also download the copy of HijackThis from our link, it would have automatically by default been installed into the proper location and all you would have to do is rename the EXE file. You can either move your current copy to the correct folder or you can delete your current copy and download from the link in the READ ME and run the self-extracting program which will put it in the correct location. Then you need to rename the hijackthis.exe file to analyse.exe

 

You don't really have any active malware showing. You just have a few things to do.

Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
C:\Documents and Settings\All Users\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

Uninstall Java 2 Runtime Environment, SE v1.4.2_03 and install the current Sun Java version per step 6 of the READ ME.

Also delete the below infected key generator:
C:\Documents and Settings\Trevor Anderson\My Documents\Downloads\Adobe.-.Photoshop.And.ImageReady.CS2.v9.0.KeyGen.Only-PARADOX.rar

Delete the below folder if still found:
C:\Program Files\windupdate\

Then empty your Trend Micro Quarantine

And then it is time to do our final steps and when you get to step 9 this will remove the malware collected in System Restore.

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you run Avenger, you can delete all files related to Avenger now.
7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
9. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Experience at doing this kind of stuff.

Nothing! If there was anything wrong, I would have told you to fix it. That is a help file for your Trend Micro Antivirus, thus, Panda was wrong.

 

You're welcome!

That's purely your discision. If you would like to, you can PM me with an email address.