GOD DAMNIT!@

[MAME]

I downloaded and installed a file that was 2.3 megs of pure spyware. Now, even after my best efforts to delete it, I get IE popups every minute or so.

I ran adware, spybot, hijackthis, MS's anti spyware and trend micro. I checked for any processes running that I don't recognize and it looks ok.

There's a few things that come up in adware every time, but otherwise it says everything is fine.

The 5 things are registry keys, and the path is as follows:
HKEY_CRENNT_USER:software\LQ

Even when I delete the values, it regenerates instantly.

God damnit, this is SO not what I needed with my paper due tomorrow. I will have to format during spring break :|

 

[Fenixgoon]

doh

 

[SynthDude2001]

Why did you download and install spyware? :evil:

 

[ArmenK]

restart in safe mode and run adaware, spybot, and your antivirus
go into msconfig or startup in registry and take out all the crap

 

[MAME]

Originally posted by: ArmenK
restart in safe mode and run adaware, spybot, and your antivirus
go into msconfig or startup in registry and take out all the crap

I did, and it's still there

there's a program that I believe is running that will not show in task manager called elitenua32.exe

It re-selects itself in the startup list under msconfig. I went to the location where it is supposed to be, and alas it is not there.

I moved the internet explorer executable and I got a windows error from elitenua32.exe, probably because it couldn't load the internet explorer executeable. And again, it does not show in the list of running processes.

 

[Specop 007]

I re-formatted just last week.
Nothing beats the feeling of a squeeky new install.

 

[Mill]

Microsoft AntiSpyware > all

 

[imported_Mike]

what are the names of the items that keep returning in the adaware scans?

 

[imported_Mike]

Originally posted by: Mill
Microsoft AntiSpyware > all

yea, go DL the ms antispyware beta and run it in SM

 

[JustAnAverageGuy]

*patiently awaits the FireFox fanboys to come along any time now*

Have you tried CWShredder or HijackThis? The Microsoft BETA is actually pretty damn good

 

[imported_Mike]

Originally posted by: SynthDude2001
Why did you download and install spyware? :evil:

probably pr0n

 

[KK]

you tried hijackthis?

 

[mobobuff]

The answer is here

 

[MAME]

Originally posted by: JustAnAverageGuy
*patiently awaits the FireFox fanboys to come along any time now*

Have you tried CWShredder or HijackThis? The Microsoft BETA is actually pretty damn good

I am using firefox. I installed a program that had a million of these fvckers in it, which has nothing to do with my browser

 

[MAME]

Originally posted by: CheapArse

Originally posted by: SynthDude2001
Why did you download and install spyware? :evil:

probably pr0n

no, it was a crack for an avi -> mpg converter. And it's not even for me, damnit!

 

[DangerAardvark]

You've got a deep infestation. Try Hijack-this, and post your logfile to an appropriate forum. Not me, cause I'm too lazy... but,you know, to someone who cares. Also try X-cleaner, it sometimes mops up what Adaware and Spybot miss. And if you haven't already, enable Tea-timer in Spybot, it'll notify you every time something tried to change something in the registry.

 

[neonerd]

fdisk

 

[MAME]

Originally posted by: mobobuff
The answer is here

I looked and I did all of that already. The file simply does not appear in windows/system32

I even tried command line

 

[mobobuff]

Originally posted by: MAME

Originally posted by: mobobuff
The answer is here

I looked and I did all of that already. The file simply does not appear in windows/system32

I even tried command line

You're screwed. Format C:

 

[neonerd]

Have you tried safe mode, running some scans, deleting anything you can, and then going in and deleting everything manually?

EDIT: Did you run those scans in safe mode?

 

[MAME]

Originally posted by: CheapArse
what are the names of the items that keep returning in the adaware scans?

ebates moneymaker
all registry values

 

[MAME]

Originally posted by: neonerd
Have you tried safe mode, running some scans, deleting anything you can, and then going in and deleting everything manually?

EDIT: Did you run those scans in safe mode?

I did :|

 

[neonerd]

try this as well

make sure all definitions are updated

 

[MAME]

Originally posted by: DangerAardvark
You've got a deep infestation. Try Hijack-this, and post your logfile to an appropriate forum. Not me, cause I'm too lazy... but,you know, to someone who cares. Also try X-cleaner, it sometimes mops up what Adaware and Spybot miss. And if you haven't already, enable Tea-timer in Spybot, it'll notify you every time something tried to change something in the registry.

I just tried hijackthis, everything looks fine

 

[aidanjm]

Originally posted by: MAME
I downloaded and installed a file that was 2.3 megs of pure spyware. Now, even after my best efforts to delete it, I get IE popups every minute or so.

I ran adware, spybot and trend micro. I checked for any processes running that I don't recognize and it looks ok.

There's a few things that come up in adware every time, but otherwise it says everything is fine.

The 5 things are registry keys, and the path is as follows:
HKEY_CRENNT_USER:software\LQ

Even when I delete the values, it regenerates instantly.

God damnit, this is SO not what I needed with my paper due tomorrow. I will have to format during spring break :|

do you have the windows xp restore function turned on? (it's turned on by default). Most geeks seem to turn it off, but if it is on, you can get your computer to revert to the state prior to the install of the spyware software.