help.

Discussion in 'Malware Help (A Specialist Will Reply)' started by KickUInNutsNRun, Jun 12, 2006.

  1. KickUInNutsNRun

    KickUInNutsNRun Private E-2

    I honestly don't see why this bull shit is even legal.

    I followed all the steps in the DO THIS BEFORE ASKING FOR HELP stuff...didn't help.

    My problem: C:\Windows\System32\users32.exe

    I would shut it down but:
    http://img147.imageshack.us/img147/7633/task5ru.png
    apparently, I'm not allowed.

    Every couple of minutes I get a little message from the Windows Security Center saying some shit about spyware(...it almost looks legit). Also, I am greeted by this every 5 or so minutes:
    http://img56.imageshack.us/img56/7255/bs3xx.png
    If I close this, click, or click the message I get to go to antispywarebox.com. I simply don't believe that site is legit for a split second.

    About every 15 minutes I get this little treat:
    http://img150.imageshack.us/img150/8517/sysshut7kl.png
    followed by:
    http://img55.imageshack.us/img55/8655/bserror2pw.png
    and by clicking cancel, the countdown to shut down is quite conveniently aborted so you can be redirected to antispywarebox.com. Maybe they think that I am now scared enough to download their virus by now.

    That system shutdown window is probably the only legit window that ever comes up.

    After doing all the DO THIS BEFORE ASKING FOR HELP stuff I was actually quite optomistic about restarting the computer a normal mode. First thing I did was open internet explorer and was greeted by some more Windows Security Center bs along the URL about:blank (the homepage I chose). Click here to see it (probably a little too big to post in a forum).

    I have only attached a HijackThis log file because I didn't save any other log files. If you would like me to attach any other log files, let me know and I will gladly redo the scan.

    Quick question: If any file is replaced a couple seconds after deletion, how do I stop this from occuring.


    edit: My noob ass forgot to search, and I found something about smitfraudfix, and I forgot to mention I was unable to use CounterSpy or Windows Defender while I was doing all the preliminary stuff.
     

    Attached Files:

    Last edited: Jun 12, 2006
    KickUInNutsNRun, Jun 12, 2006
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    You should rethink the choice of user names that you select on websites. We don't really like to se names like this in the Forums on Majorgeeks!

    Please complete step 6 of the READ ME and attach the logs. Also you should have paid attention to the Special Removals Procedure link given a few times in the READ ME. You have problems mention in those threads. In particular, you should run the below and attach the smitfiles.txt log:

    SpywareQuake & SpyFalcon Removal Procedure

    Then also attach a new HJT log.

    Why couldn't you run CounterSpy??
     
    Last edited: Jun 12, 2006
    chaslang, Jun 12, 2006
    #2
  3. KickUInNutsNRun

    KickUInNutsNRun Private E-2

    Nevermind, I have solved the problem...

    Yea, my bad on the name. I didn't even know I had a name on this website. This name actaully happens to be my AIM name..
     
    KickUInNutsNRun, Jun 12, 2006
    #3

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds