Virus and pop up problem...

GreatCornholio

Junior Member
Nov 7, 2007
2
0
0
I was directed to this site from another site when I said that I was having computer problems. It looks like there is a lot of good advice on here so I thought I'd give it a try and see what you guys think I can do to my laptop to get it working properly again.

I'll be the first to admit that I did something stupid and clicked on a "active X controller" update. As soon as I clicked on it I knew it was bad and thats when the problems started. I've run some antivirus antispyware stuff but that still hasn't gotten rid of the problem. Things I've run so far are CCleaner, Mcaffe that comes with AOL, and superantispyware.

Here are the basics of the computer. Its a laptop that was bought in Aug of 05. Lucky for me I was too lazy to rip the sicker off it says "Compaq Presario M2108US". It has Windows XP and the only thing I've really done to it was to add some RAM.

Every few mins a window pops up that says "Windows Security Alert" then "Windows has detected and Internet attack attempt... SOmebody's trying to infect your PC with spyware or harmful viruses. Run full systems scan now to protect your PC from Internet attacks, hijacking attempts and spyware! Click here to download spyware remover for total protection" then it was ok and cancel button. I click cancel.

Then other balloons will pop up in the bottom right corner by the status bar and will have a flashing red stop sign looking thing with a white x in the middle saying "System Alert"... "System detected virus activities. These may impact the perfomance of your computer. Please, use recomended antispyware software to proctect your system from parasite programs." (misspellings were in the balloon same as I typed here)

A second gray pop up box shows up and says "spyware alert" "security warning! Worm.Win32.NetSky detected on your machine. This virus is distributed via the Internet through e-mail and Active-X objects The worm has its own SMTP engine which means it gathers e-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. this process should be removed from your system.
Type Virus
System Affected Windows 2000, NT, ME, XP, Vista
Security Risk (0-5) 5
Recomendations: click yes to remove it from your PC immediately. "
Yes and No buttons. I click No and a full screen Internet Explorer pop up shows up.
(misspellings same as it shows on pop up)

Besides that the computer is just acting weird. And the hard drive sounds like it is running a lot more than normal when I'm doing things on the computer. Also my IE home page keeps getting hijacked to a page that promotes "ultimate cleaner" and A2 can't keep my homepage protected. And the work offline pop up box comes up every few mins as well.

And these 3 programs keep getting installed on my desktop even if I delete them. "Privacy Protector" with a blue shield and sword. "Error Cleaner" with red sheild and magnifying glass. "Spyware&MalW Protection" with red shield and mop.

Any help would be much appreciated. If you guys need screen shots let me know, but I've never done one of those before so as stupid as I sound I would need you guys to tell me how to do that. Also how important is it that the scans be run in safe mode? I wrote this on my desktop which is not infected because I want to keep my laptop un-connected from the internet until I hear from you guys.

Thanks
Great Cornholio
 

mechBgon

Super Moderator<br>Elite Member
Oct 31, 1999
30,699
1
0
Sounds like the typical Zlob stuff from the VideoAccessCodec branch of the family. Here are some blanket removal steps you could start with:


1. REMOVE ROOTKITS

Scan for rootkits using Panda AntiRootkit and McAfee Rootkit Detective. These should be run in normal Windows, not Safe Mode:

http://www.majorgeeks.com/Panda_Anti-Rootkit_d5457.html
http://vil.nai.com/vil/stinger/rkstinger.aspx


2. REMOVE VIRUSES, WORMS, AND TROJANS

Make sure your antivirus is current-generation software, not old stuff from several years ago. Update your antivirus software's virus definitions/DATs, then run a full antivirus scan. Besides your own antivirus software, also get a "second opinion" from some additional online antivirus scanners, such as these, for increased coverage (no single company detects all malware):

http://support.f-secure.com/enu/home/ols.shtml
http://safety.live.com
http://www.pandasoftware.com/products/activescan.htm
http://housecall.trendmicro.com


3. REMOVE SPYWARE AND ADWARE

Scan for spyware using SUPERAntiSpyware's free version:
http://www.superantispyware.com

Scan for spyware using Spybot Search & Destroy, which is also free:
http://www.safer-networking.org


4. ADVANCED TECHNIQUES

After the preceeding steps, run HijackThis. Start Windows in Safe Mode to use HijackThis (HJT) most effectively. If you get an error when you run HJT, rename it to something random and run it again (some malware will block it by name):

http://www.spywareinfo.com/~merijn/programs.php
http://hijackthis.de/en (online HJT logfile analyzer)

To start Windows in Safe Mode so you can run HijackThis properly, begin tapping the F8 key (preceded by the F-Lock key, if your keyboard has one) when you know the first Windows startup screen is about to show, the one with the scrolling bar. If you want access to the online log analyzer, you can start in Safe Mode With Networking instead.

Since you evidently have a VideoAccessCodec infection, refer to this picture for some of the places that it typically installs stuff: http://i240.photobucket.com/al...ff237/mechBgon/nmc.gif

Next, run SmitFraudFix, following these directions: http://siri.urz.free.fr/Fix/SmitfraudFix_En.php It?s not unusual for this download to be detected by antivirus software because some of the files it contains could be used for malicious purposes. In this case, however, it?s OK.


After that, you could run HijackThis again and post a log for going-over.

By the way, the whole thing is all an elaborate sham aimed at getting you to pay $40 for the worthless software they're trying to sell you (and to get hold of your credit-card number for further fraudulent activites too, I'm sure). The videos, the download, it's all a fraud scheme. Clickfraud is usually involved too.
 

GreatCornholio

Junior Member
Nov 7, 2007
2
0
0
Thanks for the quick reply. Do I need to run all of the scans in safe mode or just Hijack this? I'll start on this and let you know how it turns out.

Thanks again,
Great Cornholio