Pls Help: http://www.safetydefender.com/ will not go away

robert1 · May 2, 2006

I have read over the post from "Sticky: safetydefender.com & SecurityBulletin.net - removal " but none of it seems to apply to me...I tried to go through the steps listed but I had not one of the files/programs on my computer to rename/delete/or uninstall. I have gone through the basic steps listed and here are my results so far...

oh, and I am currently operating w/ windows2000 SP4

chaslang · May 2, 2006

Welcome to Majorgeeks!

You should have attach the smitfiles.txt log as requested from running the procedure to remove safetydefender (aka SpywareQuake).

Please attach it and also run the below and attach the runkeys.txt log.

Using GetRunKey

You skipped step 3 of the READ & RUN ME. You have multiple antivirus applications (AVG & Symantec) installed. Uninstall ALL but one. Do this NOW before continuing.

Also you have installed HijackThis exactly where step 7 of the READ & RUN ME specifies not to install it. Please follow the directions in step 7 and install HijackThis properly.

Is your copy of Spy Sweeper a paid version or a free trial? If free, uninstall it. If Spy Sweeper is a paid version, then you can now uninstall Windows Defender.

robert1 · May 3, 2006

1st off, thanks for your help..
I ran the runkeys program and attached the file.
I uninstalled AVG anti-virus.
I also uninstalled Defender because the copy of Spy Sweeper is a paid copy.
I read over and installed Hijackthis in the correct folder and ran it in safe mode again and attached the file.
Also forgot to post the smitfiles.txt last time, so here it is.
I also ran Smitfraudfix this morning and so I attached that file as well.recommendation from a friend who thinks he knows something about computers)

all of a sudden the homepage no longer exists...hopefully what I have done worked with your help. Please look over what I have here and let me know if I need to do anything else.

chaslang · May 3, 2006

robert1 said:

I read over and installed Hijackthis in the correct folder and ran it in safe mode again and attached the file.
Click to expand...

Actually HijackThis should be run in normal boot mode!

Your log is clean now after these last tools were run. There are just two minor lines you can fix with HJT unless you specifically set them this way:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

Other than that, you look clean. Is everything working okay now?

robert1 · May 3, 2006

Everything seems to be working again back to normal! Thank you so much for your help, I don't know what I would have done other than re-installing my operating system and wishing for the best after that. I have already told a bunch of friends about your website and the help you gave me.

Sincerely,
Robert

chaslang · May 3, 2006

You're welcome and thanks for spreading the good word!

If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Pls Help: http://www.safetydefender.com/ will not go away

robert1 Private E-2

Attached Files:

bdscan.txt

Activescan.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

robert1 Private E-2

Attached Files:

runkeys.txt

hijackthis.log

smitfiles.txt

rapport smitfraudfix.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

robert1 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member