[montesquieu]

Hi there, have been through every step in the list, Spybot search & destroy identified two 'families' and deleted 13 files but I still have popups either advertising adult services or urging me to by psguard or other software .... please help!

Edited by montesquieu, 24 September 2005 - 04:42 PM.

[Advertisements]

Fingers crossed but running the various cleanup programmes and then a few reboots using ewido seems to have done the trick in taming psguard. You guys are awesome, I can't thank you enough.

Edited by montesquieu, 24 September 2005 - 04:23 PM.

[montesquieu]

Fingers crossed but running the various cleanup programmes and then a few reboots using ewido seems to have done the trick in taming psguard. You guys are awesome, I can't thank you enough.

Edited by montesquieu, 24 September 2005 - 04:23 PM.

[g2i2r4]

Welcome montesquieu to Geeks to Go!

I don't think there's anything but the tool we use to get ride of this malware.

But before I offer my services I'd like to know if this is a company computer.

[montesquieu]

Welcome montesquieu to Geeks to Go!

I don't think there's anything but the tool we use to get ride of this malware.

But before I offer my services I'd like to know if this is a company computer.

It is indeed a company laptop (but my f*ck-up though) - I really needed to get this sorted before heading into the office next week as I'm new with this company and I don't know what their policy is for dealing with this sort of thing - I picked up the problem while working abroad earlier this week and surfing out of hours ...

Fingers crossed though, Ewido seems to be doing the trick, will probably purchase at end of the trial. Any guidelines for a donation (per your sig)? Your FAQ, if followed closely, seems to have done the trick (apparently so anyway). I'm incredibly grateful.

I don't get these problems on my home kit which is all Apple (20 years on Macintosh and never had any virus/trojan/malware of any description).

[g2i2r4]

Let's check first; please post me a fresh HijackThis log to see what's in there.

[g2i2r4]

Please read these instructions carefully. You may want to print them. Copy the text to a Notepad file and save it to your desktop! We will need the file later.
Be sure to follow ALL instructions!


Download smitRem.exe version 2.5 and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

***

Place a shortcut to Panda ActiveScan on your desktop.

***

Please download the trial version of ewido security suite.Install ewido security suite
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".

Launch ewido, there should be an icon on your desktop double-click it.
The program will prompt you to update click the OK button

The program will now go to the main screen
You will need to update ewido to the latest definition files.On the left hand side of the main screen click update
Click on Start
The update will start and a progress bar will show the updates being installed.
Once the updates are installed, close Ewido for now.

***

If you have not already installed Ad-Aware SE 1.06, please download and install AdAware SE 1.06.
Check Here on how setup and use it - please make sure you update it first.

***

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

***

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed.
Post me the contents of the smitfiles.txt log as you post back.

***

Open Ad-aware and do a full scan. Remove all it finds.

***

Now open Ewido Security Suite:* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop
Reboot your computer.

***

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

***

Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan.
Save the report and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.


EDIT:
As there has been no reply from the original poster for more than two weeks this topic is now closed.

If you are the original poster and still need assistance, please send me a PM.

Edited by g2i2r4, 15 October 2005 - 04:11 PM.