Problem removing spyware/virus

[Squid_uk]

Hey guys!

Im having a bit of a problem removing some spyware/viruses,

The problem they are giving me are they keep opening windows and switching between windows that are already open.

This one appears

http://i35.photobucket.com/albums/d152/Squid_uk/windowsalert.jpg

This one just keeps popping up when clicking no nothing happens but if you click yes it tries to open a webpage which keeps failing to open but the url is softwarerefurral.com

http://i35.photobucket.com/albums/d152/Squid_uk/spywarealert.jpg

Also keep getting this one

http://i35.photobucket.com/albums/d152/Squid_uk/mie.jpg


I don't know about this but there is also and icon in the tray that is a flasing red and white cross when putting the cursor over it there is no information given but when it is clicked nothing happens it just keeps flashing and showing the same message shown in the picture

http://i35.photobucket.com/albums/d152/Squid_uk/cross.jpg

Now i tried using AVG antivirus and spyware, hijack this and Spy Bot search and destroy but they still appear,

Any ideas how i can get rid of these?

[Dv8ted2]

click on the start button - click on run - type in %temp% and hit enter

Delete all the files in this folder---Turn off system restore to clear the system restore points - ---- delete the temporary internet files------This is a start.

After you do all that, let us know if it is still happening.

[Squid_uk]

Dv8ted2 tried what you said but no luck the pop ups are still appearing and now i have this and if i click in the empty space on the desktop it takes me to this window again

http://i35.photobucket.com/albums/d152/Squid_uk/mie.jpg

This is what my desktop has chaged to without me doing anything!

http://i35.photobucket.com/albums/d152/Squid_uk/desktop.jpg

[redwudz]

I assume you know those popups are part of the malware, not anything from your OS. Don't follow any directions from them, that will only make it worse.

Here's one reference to the first one, and they may all be part of the same malware. Scroll down the page a bit and see if you have the same problem as the poster. http://www.techsupportforum.com/security-center/hijackthis-log-help/186001-ultimate-de...-included.html Does this sound similar?

I've been struck by malware attack resulting in the following:
Multiple IE's opening (URLs: udefener.net, yourprivayguard.com and others)
3 Desktop icons leading to: http://virusprotectinproonline.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Fake Window Security Alert dialogues popping up
Desktop backgroud altered
Major slow down of PC performance...

(I've altered some addresses)

Hijack This is available here: http://www.spywareinfo.com/~merijn/programs.php It's a bit involved to use, but that looks like the type of program you need to remove it all.

You might want to be a bit more careful in the future at what you download and where you go on the internet. And make sure your anti-malware programs are always up to date.

[Squid_uk]

I have already tried using hijack this and it did pick up but when i remove it using hijack it just comes straight back, also it seems to be setting the software referral.com as the homepage so when i open IE it tries to go that page.

What can i do to get rid of the desktop image that is being displayed?

[redwudz]

I would turn off system restore, unplug from the internet and start in safe mode, then run Hijack This. Malware can reside in the system restore files and may have pointers or links in the registry to restore it back.

I suspect each time you boot the system, it all starts up again and re-installs. That particular malware may be a little harder to remove and may take more than just Hijack This.

If all else fails, consider backing up your files and re-install the OS. I would also try to determine where you got all this from. Most likely attached to a program recently downloaded. If so, you don't want to back up your files with it in there and just have it install again.

[Bjs]

You may want to look at : http://forums.whatthetech.com/installed_malware_t83818.html (blade81)

A good point to start with , which should narrow problems down .

----

Pc specs related : Sp2 not included

Please go to control panel > administrative tools > services > messenger .
Stop this service
Then disable this service
Click apply , then ok
Close box
Close services window

See what happens now .

[isogonic]

thats the classic indication of the smitfraud trojan. fake popups about your computer is "at risk" fake taskbar icon. there is a fix just for it. i will post it and instructions if somebody else dosnt.

[Squid_uk]

hey guys i started using the information given in the link http://www.techsupportforum.com/security-center/hijackthis-log-help/186001-ultimate-de...-included.html and got as far as where the user Pancake has asked him to create the commands in notepad, i have not done this but the problem has seem to have gone, only thing is i seem to have lost the use of the display on the desktop, it is just a white background the icon are usable but all of them have a blue out line, when i try and change the desktop image nothing seems to happen