May-Day May-Day, Im sinking (Spyware)

R

Ronza

Active Member
Joined
May 16, 2005
Messages
36
Reaction score
0
Location
Durban
Good-people please help,

I get this annoying pop-up at the bottom-right of my windows tool-bar, which warns me of Trojan Virus that is in my PC. When the warning is clicked, it opens this website: antispylab.com; I am using spyboat and AVG 7.1 (both fully updated) - tried everything I knew, no luck thus far.

What pisses me off is that it 'greys-out' all IE menus - hence I can't make any security changes whatsoever. Im ruuning windows XP, SP2.

Please help, Eishhhh
 
Unfortuantely, I can't - it's a company PC. I use FX at home and I never experienced this shiddd...
 
Ronza said:
Unfortuantely, I can't - it's a company PC. I use FX at home and I never experienced this shiddd...
Click to expand...

Your IE got hijacked by a driveby download (there is a new exploit in the wild) and is now being held hostage by this trojan and antispylab.com is a bogus security product.

Your only hope is a spyware cleaner product like the free Microsoft AntiSpyware.
 
Use Spybot and Immunize IE.. I've never once had a problem in any way with IE.. your best bet is to stay away from dodgy sites though ;)
 
Nic777

You 've got me there (on AVG) but spybot is part of the corporate computer image. I guess I need to install FX.

Im busy running the software you 've suggested - fingers crossed
 
I take your point MAD - guess I owe serials.ws some smackkk
 
MS antispyware wont help i had the same thing on my home pc and bloody thing kept popping up in systray. Ronza just do a search in google "how to remove antispylab.com" or quakespyware. Theres a good chance it will find the results on the avg forums
 
tibby.dude said:
No wonder.
Click to expand...

Easy there T/D, Im paying my dues already - learnt the hard way (actually, Im still learning cos I 've had zore success - contemplating re-imaging the whole laptop). :mad:
 
Best thing for serialz sites

1) use linux - now some sites require downloads and other sh1te and will not work on linux, so
2) use VMWare - install win2000 or something that needs no activation in a VMWare session. Once installed and working, CLONE IT!
3) Download pr0n sites and warez sites in there.
4) When it corrupts, load the clone, make a new clone and continue.

Also good for eDonkey, Kazaa etc etc etc.
For an even safer experience, run the VMWare app from Linux.

Nothing like two 'doms for those wh0re sites.

:D
 
TIP for when hunting these fsking adware hostage holders :
- Goto the Windows\System32 folder.
- Ensure that you can see hidden and system files.
- Sort by Date.
Anything with today's date / yesterdays date is part of the infection ... get ride of them.
 
stoke said:
TIP for when hunting these fsking adware hostage holders :
- Goto the Windows\System32 folder.
- Ensure that you can see hidden and system files.
- Sort by Date.
Anything with today's date / yesterdays date is part of the infection ... get ride of them.
Click to expand...

*NOT* to be done on the day you have just re-installed your PC (M$ users, that is the first Monday of every month, err week).:D
 
Nightmare almost over

stoke said:
TIP for when hunting these fsking adware hostage holders :
- Goto the Windows\System32 folder.
- Ensure that you can see hidden and system files.
- Sort by Date.
Anything with today's date / yesterdays date is part of the infection ... get ride of them.
Click to expand...

You are a genius STOKE

Used Windows Defender as a 'Task Manager' to identify what each active system file is all about (by de-activating each file and check whether the spyware is still ACTIVE). Wallllla, I found it inside c:/windows/system32 with a file name winsrv32.exe. Tried to delete - no success - turned-on DOS - its all history. But Im still afraid of what other associated files are still up to....

Thanks to everybody....Can breath again, till next time
 
Ronza said:
Good-people please help,

I get this annoying pop-up at the bottom-right of my windows tool-bar, which warns me of Trojan Virus that is in my PC. When the warning is clicked, it opens this website: antispylab.com; I am using spyboat and AVG 7.1 (both fully updated) - tried everything I knew, no luck thus far.

What pisses me off is that it 'greys-out' all IE menus - hence I can't make any security changes whatsoever. Im ruuning windows XP, SP2.

Please help, Eishhhh
Click to expand...

damb stupid windoze users.

use any of these and then dont worrie lol
 
ad aware is a waste of time - its a dangerously useless app that makes people think they're secure. Spy Bot is a good first step. Then cross check with Scan Spyware. Then have Avast running perm on the side, to catch malware and keydropper trojans that sites quietly load on your pc. And run spybot and scan spyware after every session that you use IE, to clean out the rubbish that this causes.
 
TIP: install Spybot-SD and run the Resident portion. Get to know which programs run on your machine: run task manager daily, anything strange suddenly showing up is probably spyware. Search for the file name, check it's properties. Spyware often has dodgy details about who created them.

To remove spyware rename the file(s) first (windows won't let you delete it while it's loaded), search your registry and remove any references to the files and reboot immediately. Then delete the file(s) and search your registry again to be sure. Do each step with all the files simultaniously to be sure you don't leave any installers behind.

Be sure you're removing spyware only and don't mess up your registry. It's can get confusing sometimes since these files are often named similarly to windows system files.
 
Prometheus said:
To remove spyware rename the file(s) first (windows won't let you delete it while it's loaded), search your registry and remove any references to the files and reboot immediately. Then delete the file(s) and search your registry again to be sure. Do each step with all the files simultaniously to be sure you don't leave any installers behind.

Be sure you're removing spyware only and don't mess up your registry. It's can get confusing sometimes since these files are often named similarly to windows system files.
Click to expand...

Thank you all for this info
Promethues, do one need to use a speacial application to delete all files associated with a spyware inside the registry :( - as you said - sometimes it gets confusing b'cos names might be similar to windows' files.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X