Do you have Adware, Spyware, Virus/Trojan or a Browser Hijacker?

My friend gave me his computer 2 days ago because it was completely screwed up. It was full of spyware, trojans and viruses. Right when you turn on the computer you get the message CRSS.EXE has crashed and Windows will reboot in 1 min, and it keeps rebooting. It also had all these porn icons on the desktop that one of the spyware created, and it had a whole lot more stuff that the trojans did. Even IEXPLORER.EXE was actully trojaned and binded with another executable. Anyway I was able to get rid of all that and fix almost everything. However, there was something that I couldnt change and I want to see if anybody has seen that before. Basicly the laptop had this spyware that was trying to imitate the Windows new security feature and it would pop a bouble by the clock and say "Your computer apears to be infected. Windows will now download and install the latest antispyware for you". Then it would install this program called SpyCherif and run it which would then ask for activation that of course you have to pay for. The other thing this one spyware did is change the desktop wallpaper to a wallpaper that says "Your computer is infected".

The problem is that I could not change that desktop, when you go to the display properties and try to change the desktop it is greyed out and the all the fields are locked so you cant change anything. Even after I got rid of the spyware itself and removed it, the desktop is still there and still cant change it.

Any ideas?
Thanks

 

I gave him the laptop yesterday because he really needed it so I cant test your ideas right away but as soon as I can.

 

I dont know if you asked to find out or to see what I did wrong but it's a good thing you did anyway because others can learn from this.

 

This is basicly what I did as I remember. I am probably going to miss something.

1. To stop Windows from rebooting after a critical process crashes, you can use the '[bold]shutdown -a[/bold]' command to abort the shutdown.

2. Then I deleted all the temp files in all temp directories, which includes:
C:\Windows\temp = %systemroot%\temp
C:\Documents and settings\username\Local Settings\temp =
%userprofile%\local settings\temp
All Internet temp files.

For the user profile temp file I did this to all the users.

3. Browsers history/cache/cookies/plugins were all removed.

4. I used '[bold]msconfig[/bold]', '[bold]msinfo32[/bold]' and the registry hive [bold]Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run[/bold] to find all the programs starting at startup and removed all the non-necessary.
For the suspicous programs I searched the harddrive for them and deleted them.

5. Then after finding that IEXPLORER was trojaned I deleted the whole internet explorer folder and installed Firefox and downloaded a brand new IE6setup from Microsoft.com

6. After installing Internet Explorer I went through all the Windows and IE updates, including SP2.

7. I installed Spybot and Ad-aware and searched the computer and removed all what they found.

8. Afterwards, I went to housecall.trendmicro.com and did a full scan.

9. I forgot to say this in the begenning but before I did most of this I went through the whole Add/Remove Programs list and uninstalled all the programs that he didnt recognize.

10. Of course I made Firefox the default browser and I updated Microsoft Office too.

11. Edited and cleaned the '[bold]hosts[/bold]' file.

12. I feel like I am missing something but cant remember now.


Anyway this is a good idea of what I used to clean his computer.

 

Yea I've used that too but I am not a big fan or automating programs. I like to do things like that myself so I know what's going on. It's a good idea to save time but you can do everything it does manually. you know?

 

err

big fan of*

 

One thing i just remembered is that I also disabled the Guest account which really should never be enabled unless you know what you are doing.

 

Thanks CJC. Just installed and used Adware Away. It found quite a few hijacker files.

I'll also take this opportunity to say "hello" to everyone. Look forward to reading through the forum.

Thanks again!

 

"hi"

 

lol

 

are you posting to increase your count? you do that again and i'll have to report you. say bye bye if you do that again.

 

Are you only looking at what i post or are you reading other posts too? You really need to read the whole page before you start threatening people buddy.

This guy said "hello" and i said "hi". And then i said lol because i thought it was funny.

I dont know what your major malfunction is but go ahead and report what you wish, I am sure the Admins have a little more common sense than you.

 

well let me tell you that there is an edit post button, you can always edit posts by clicking on the notepad in the top right hand corner of your posts. most of your posts are one after the other, you could have edited the first one.

there has definately been an increase in useless posts and this has been emphasized by the moderators and some members, specifically darthnip and pop_smith. watch your mouth.

 

I am aware of the Edit button and it has its own uses, but you shouldnt be talking. Look at the previous page (page 7) and you have posts one after the other too so worry about your own business first. I dont have more than 2 posts in a row at all.

Just for your information I dont give a damn about those titles they put under the names.

 

Anyway, you are wasting space and pages out of this forum for no reason and that's not good for people looking for help here. So if you have anything else to say just PM me.

 

pg. seven was not on purpose, slow server reactions, notice i edited my post. also the point of my post was too inform you that there is no purpose of posting just a hi and lol one after the other. i understand that u did not initiate the conversation but im sure you can add more to your response.