Got a virus/trojan or adware/spyware?

[MSG]

Ok so how do I open the .cmd file or how do I run it? thats the big question Steve.

[Steve!]

start the computer in safe mode.
Then once the computer is on, click on start
then click open My Computer
Double click Local disk ( C: )
Double Click SDFix folder
Then double click "run this"


Follow the instructions!!

[MSG]

cheers mate I will try your way. and report back later. Thanks

[Steve!]

No probs!

[JoeyB]

How did you get on?

[MSG]

Right, I have had no luck what so ever, thats why I hate computers because they don't do what you often ask them to do.

The SDfix file defaults to C:\Programe file\%systemdrive%

So when you open My Computer, choose C: Drive, the sdifix isn't there because it has been installed in Programe folder, so when I try to locate the SDfix in that folder and find it there, click on Sdfix icon, 5 smaller icons appear including the required icon "run me.cmd" and \clicking on it twice opens anothyer window thyat prompts you to find a programme to run that .cmd file. I would have thought the comoputers would sort that itself by knowing what cmd files are about, so it seesm that may be my O/S doesn't recoganise .cmd files and doesn't know how to run it, as I said before I use ME o/s.

so I tried to install it directly on the root directory that is C:\ without going into the program folder, that also resulted in the same senario, i.e "what programe do you want the windows to open "run me.cmd" file with?"

So I have given up for now.

Any way as I have restored my computer to a previous date in October, it appears to be running fine as before, so thanks for your immence help to get my problem sorted it is nevertheless highly appreciated. Cheers.

[Jack]

.cmd files run with C:\Windows\system32\command.com

[Steve!]

start the computer in safe mode.
Then once the computer is on, click on start
then click open My Computer
Double click Local disk ( C: )
Double Click SDFix folder
Then double click "run this"


Follow the instructions!!

did you click the sdfix link before this??

install, then restart computer in safe mode, then follow the above steps

[MSG]

.cmd files run with C:\Windows\system32\command.com

So why is that when I click on the run me.cmd icon, it doesn't know how to choose an appropriate programe file to run, obviously a cmd file won't open with o0ther files that doesn't recoganise that extension, so do i click on the box "open with other" and type windows\system32\command.com? I will give it a go and see if that works. and I will try again as Steve suggested, Cheers again both Steve & Jack .

[JoeyB]

Because for some reason you have installed it to the Program Files folder by the sounds of it. And the cmd file is designed to look for itself in the root of the C:\ drive. Everytime i have installed it the default settings has been to extract straight to the C:\ drive.

Worst case scenario, you just need to do a search on your PC for the rogue SDFix folder and move it to the route of C:\

THEN run the cmd file. Oh, remember to run it in Safe Mode otherwise it will tell you off!

[MSG]

My new laptop is now badly infected and not by any spyware but by a bloody company selling Anti-spyware, if I could find out where this company is I would go around and grab the MD and throttle his neck!!!


Just aparently for absolutely no reason, I didn't even ask, or download any request from this Anti-spyware company or their product, and it has taken over my new lap top and has made it completely useless, unable to run any applications or programmes or go on the internet, except click on a box that will only allow me to make a payment to buy this Anti-spyware software.

This is the mother ****ing company that has cost me a whole ****in day trying to remove their grip on my new lap top, BTW, I am using my old laptop to make this post.
This is the company: www.antispyware2008.com

Their dialogue box that drops down taking over the controls, limiting the cursor to only operate within their dailouge box, so that I can only choose two option 1. sign on and register and pay 2. allow their anti-spyware to continue evaluating threats on my comuter, the later one when I click doesn't do anything, andnthis dialouge box remains on the screen constantly, it won't cross out! so not allowing me to select any other programmes, but the other box if I click on takes me to a payment centre. but I refused to pay.

I approached this company's contact centre, and their help line asking for help to sort out this problem that their software had taken my computer hostage, and the guy could only advise me to purchase their anti-spyware software, 6 months package for £29.99, I am not going to allow myself bullied or be mugged .

Can anyone suggest anything? rather not pay £29.99 to a company like that and can I report them to who????

The threat my computer is seeing is from a rouge "antivirus 2008 xp"

and obviously if this is a rouge spyware then it has been installed by this very company tring to sell me the anti-spyware.

[Nobbie]

Boot into safemode.
Try add/remove programs.
If you've got through to someone they may have a decent uninstaller?.

Or

Kill these processes;

Antispyware2008[1].exe
a.exe
Antispyware-2008.exe
Setup[1].exe

Delete these files;

Antispyware2008[1].exe
a.exe
Antispyware-2008.exe
Setup[1].exe

remove these registry entries

Microsoft\Windows\CurrentVersion\Run\Antispyware-2008.exe
Antispyware 2008
Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Antispyware 2008

[MSG]

Thanks Nobbie , I am doing everything to get this eliminatedb from my computer, I shall try and do that now, in safe mode (F2 on my acer running on XP) this one I am typing from is my old one runnimng on ME.

[Nobbie]

F8 would be your puppy, just after the POST, but before the ms logo.

[MSG]

As I am not too good in sorting out problems, I spent another day trying to get to the bottom of this problem, in the end I had to summon someone I knew who is an IT expert, he spent almost 4 hours going through various updates and downloads and antivirus progarammes and put my lap top through various scans, he downloaded free spybot, and God knows what else, he managed to get rid of the original spyware, the one called the
"antispyware 2008 XP" which the IT experet said was a rouge company and known to him which bluffs its way on the internet as an anti-spyware company, but it is not and it is the culprit in the first place and wants you to buy its anti-spyware product to clean its own installed adware.

Dodgy ****ers, and when they get in your computer, it cause all sorts of major havock so you end up signing on to get their own anti-spyware. Someone needs to find out where this company is based and where their MD lives. He needs a bloody good sorting out, someone give him a knee job!!

Now, having beaten the above spyware, there now seems to be another one that has crept up now!!! it could be the work of the forst one. so now this expert guy had to take my laptop with him to fix from his premeises.

Still want to thank Nobbie for trying his best to help me out. cheers mate.

[MSG]

An IT specialist friend of mine managed to get rid of both spywares that had inflicted their hold on my computer, and he has now installed free AVG anti-virus programmes to stop these spywares from inacting again.
but here is a bit about the fake Anti-spyware product so I am just putting that as a reminder and this link also can help you guide through as did Nobbie's post above which was tremendous help to rid of any infilteration.

http://www.411-spyware.com/remove-antispyware-2008-xp

[Chameleon]

All of a sudden I seem to have picked up a whole host of trojans, such as win32:fakeav-no or win32:fraudo and a whole host of others. I cant see how I've gotten so infected all of a sudden as I am always very careful about emails n attachments etc. Also something seems to be turning off my windows firewall when I reboot? I've run avast n a few anti malware such as Malewarebytes anti malware programs but they always pop back up in an increasing variety. Help!

[Jack]

Try this: http://www.combofix.org/downloadlink.php

Combofix fixes quite a lot of stuff.

[alex1981]

Just another to add to decent anti malware programs: MalwareBytes Anti-Malware. Download from Malwarebytes.org

[FCC_Eddie]

Any mention of Avast or Malwarebytes (just noticed the post above) in here??

I install both of these on clients systems, and in the hundreds I've done, I'm still waiting for a bad report. I use them both on our home systems, along with Windows Firewall as it does do the job just fine.. and again, I'm still waiting for an infection on one of them.

Avast
Malwarebytes

Both free.

[gixerboyuk]

Keep a look out for the new in-carnation of this fooker. Exact same format as the 'antispyware 20XX xp' version but is called 'total xp security' Stops and stalls any .exe files even in safe mode, bit of a PITFA to eliminate. Malwarebytes will find it, but if you aint got it installed already..........

[alex1981]

Had quite a few in with the above infection....sometimes will come off easy, other times really messes things up! Many people are taking their computers into PC World though and getting them formatted/reinstalled as a "repair" of course!