i'm infected! please help!
|
Original Message
|
Name: ihatespyware
Date: May 11, 2007 at 21:27:42 Pacific
Subject: i'm infected! please help!OS: Windows XP proCPU/Ram: 1gig |
Comment: I was running a spybot scan and found Smitfraud-C.CoreService, which of course I could not get rid of. But I apparently have several other problems as well. Whenever I open a microsoft product (IE, wordpad, etc.) spybot resident will popup saying something is trying to add a registry entry. I also noticed several folders (C:\Program Files\xerox\nwwia, C:\Program Files\ѕеcurity\ѕеcurity, C:\Program Files\InetGet2, C:\Program Files\Outerinfo) that I can't delete because they are being used by another person or program. On top of all of that, I have an extra smss.exe process running that I can not kill and according to forums is another trojan. I'm sure there are other problems (i have several items disabled on system startup via spybot) so I could really use some help with some of this mess. =(
Report Offensive Message For Removal
|
|
Response Number 1
|
Name: ihatespyware
Date: May 11, 2007 at 21:34:53 Pacific
Subject: i'm infected! please help! |
Reply: (edit)I also noticed that doing a HijackThis scan also brings up the Spybot resident alert (about the attempted registry addition). The entry is 'IESet' and the newdata is 'IExplorer.dll'. This, additionally launches another Explorer.exe process (new one capitalized) which pegs my cpu. Something smells very fishy!
Report Offensive Follow Up For Removal
|
|
Response Number 2
|
Name: live-n-learn
Date: May 11, 2007 at 21:46:50 Pacific
Subject: i'm infected! please help! |
Reply: (edit)(C:\Program Files\xerox\nwwia, C:\Program Files\ѕеcurity\ѕеcurity, C:\Program Files\InetGet2, C:\Program Files\Outerinfo)-->check to see if any of these match in the add/remove programs list and remove it from there first, then try deleting anything left over. My question is, what brought this to your attention? Was it because of a spy ware scan? As far as your extra smss.exe use this link...it's all laid out in alphabetical order. Great info on this website! http://www.answersthatwork.com/Task... Bless
Report Offensive Follow Up For Removal
|
Use following form to reply to current message: