spywear protection

work

Hi I have a problem with this "virus" starting a few weeks back:

There are two users on my computer me and my wife and different things are happening when you log on the either of us I will explain

1) When I log on to the computer:

• spywear protection (looks like a copy of a windows site) pop ups come up continually trying to get me to scan computer and buy the software.
• I cannot open any software or files

2) When I Log on to the computer under my wifes profile:

• All programmes appear to work OK

IO have used Malwarebytes without any luck removeing it. Can anyone suggest how I may get this off my computer and if too complex for me to remove could anyone suggest somewhere or someone to do sort it out

Thanks for any help offered

bhickey

Do you know if both of the accounts have Administrator rights on the computer?

Try the following :

1. Can you post a screenshot of the popup so that we can see exactly what it is.

2. The fact that it happens in your account and not in others probably means that some or all of it is stored in your user's folders. Download TFC to your desktop

* Open the file and close any other windows.
* It will close all programs itself when run, make sure to let it run uninterrupted.
* Click the Start button to begin the process. The program should not take long to finish its job
* Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

3. Boot into 'Safe Mode with Networking'. Update Malwarebytes and run it again.

4. To give us more information about what's running on your computer, please download DDS and run it.
* When done, two files will open Attach.txt & DDS.txt
* Attach both files to a reply here

5. What antivirus software is on the computer and is it up-to-date?

syklops

It would sound to me that when you set the computer up, you gave yourself Admin rights, but gave your wife a limited account. The computer got infected with something. While on your wifes account it could do limited damage, could not add anything to the startup profile etc. Under your account it did have the rights to make changes to the machine.

A tip for the future would be to have 2 accounts, one with Admin rights, the other one limited. Use the limited account for surfing the web, checking email etc. Use the admin account only when installing programs or updates. This reduces the amount of time you are exposed.

As for removal of this, update your antivirus software, run windows update. Also run and install Spybot search and Destroy, and Microsoft Defender. Let us know once you have run those programs if you are still having problems. Both are free.

work

bhickey wrote: »

. Update Malwarebytes and run it again.

I followed the instructions and updated, this has done the trick, thanks very much, If you still want me to do the latter steps I will?
Thanks again

bhickey

work wrote: »

I followed the instructions and updated, this has done the trick, thanks very much, If you still want me to do the latter steps I will?

Yes please do.

work

Hi attached are the scan results, thanks for the help again. p.s. AVG 8.5 free is the antiviral software I run.

bhickey

work wrote: »

Hi attached are the scan results, thanks for the help again. p.s. AVG 8.5 free is the antiviral software I run.

Looks alright but can you do af ew things to be sure :

1. Disable the following startup item using Start > Run > msconfig :
uRun: [Spyware Protection] c:\documents and settings\mark\application data\defender.exe

2. Nothing to do with viruses but you appear to have 2 wireless cards configured : a Belkin PCI card and a Netgear WG111v3 USB adapter. If you're not using one of them then you might uninstall the relevant software.

3. Update Java. Start > Control Panel > Java > Update > Update Now.

4. Remove AVG and replace with MSE or Avast. AVG has had a bad 2010.

5. Remove Adobe Acrobat Reader and replace it with Foxit Reader.