Unavoidable downloaded program

[Benzowner]

I was on the internet, and when I came off there was a program saying I had several trojans which could cause problems with my PC. I have Adaware, Norton Antivirus and Registry Mechanic, ran all of them and cleaned everything up, except a program called Spywareblocked. I removed it from add/remove programs and then did a search which brought up 3 other entries which it will not let me delete. Worst of all, this software costs $49 US, but I can't get rid of it. It wont let me delete because the program is running or protected, even though it has been removed Any suggestions

 

[recycled]

have you tried editing your registry.
HKEY LOCAL USERS.
Next time you have pop ups telling you that your computer is full of trojans just be careful as it is an enticement to make you download more adware / malware.
I guess you have tried microsofts malicious software removal tool?

 

[grober]

hijack this http://www.majorgeeks.com/download.php?det=3155

 

[masqueraid]

Worst of all, this software costs $49 US

Grrrr !! - this is one of the most annoying of Internet scams - software that pretends to be cleaning up your computer and then essentially tries to blackmail you into sending money to have it removed

It can be removed safely and isn't harming your PC just trying to scare yuo into parting with you hard earned.

It will take a bit of unpicking to get rid of it though. Grober's HiJackThis suggestion is a good place to start. You can download the tool unpack it to a separate folder on your computer and run it. You get an option to create a log file. Do this and then cut and paste the result to the web at www.hijackthis.de . You can then get a link to your file that lasts for three days you can post here for advice.

I would strongly suggest yuo don't use HiJackThis to remove any settings yourself unless you are certain what you are doing - it is a deceptivly powerful tool for its tiny size.

 

[Chris_J]

Try Spybot Search & Destroy too. That's pretty good for getting rid of stuff like this.

 

[masqueraid]

Actually was just having a look at the latest Spybot S&D data list.
Sounds like it should sort this one without having to resort to HJT.

Spybot S&D or Adaware SE

Once installed and updated restart your PC in "Safe Mode" (basically start hittting the F8 key once it boots until you get a choice of how you want to start Windows). Then run both to scan and clean your system. Doing this in Safe Mode gives the nasties fewer places to hide!

 

[Sp!ke]

It wasn't unavoidable, you didn't have to install it. You selected to install it.

You didn't read the terms and conditions either that spelt out what lay ahead of you and hit the I agree button before installing this software.

Funny what people do in a virtual world that they wouldn't dream of doing in reality.

 

[Benzowner]

Hi all, tried Spybot, Malware SE and no luck. I am lost. All there is on the PC bottom right is a flashing circle blue with a question mark that then changes to red circle with red band accross. Every now and then it pops up a message that there are a load of trojans etc and my PC is not safe, click here to fix problem. It then guides you to Spywareblocked web page, this is then asking you to down load and pay the $49. Obviously I have not.

So Sp!ke I did not agreed to anything or click any little boxes and the little gremlin was downloaded from a site I was looking at, havn't got a clue which one. Don't judge others by actions you may take

 

[grober]

why dont you try some of the free "online" virus/security checks offered by the big anti virus/security companies Symantec Trend http://housecall.trendmicro.com/ Kaspersky http://www.kaspersky.com/virusscanner etc where they will scan your computer from their website. they sometimes have little utility progs to download to remove specific threats.

 

[grober]

driveby install?

It wasn't unavoidable, you didn't have to install it. You selected to install it.

You didn't read the terms and conditions either that spelt out what lay ahead of you and hit the I agree button before installing this software.

Funny what people do in a virtual world that they wouldn't dream of doing in reality.

MAYBE NOT? There but for the grace etc. etc. Could be a driveby install ?? http://en.wikipedia.org/wiki/Rogue_software

 

[Sp!ke]

So Sp!ke I did not agreed to anything or click any little boxes and the little gremlin was downloaded from a site I was looking at, havn't got a clue which one. Don't judge others by actions you may take

You most definately did have a choice in this.. I'll wager whatever money you like on it.

You had a pop up telling you you had spyware etc and that this software would solve your problems. You believed this popup and followed the bouncing ball.

Nothing is installed on any PC involuntarilly. You either hit YES I agree and installed something with a nasty buried inside or you have changed the default windows security settings allowing javascripts to install stuff automatically. Accidental or otherwise, the cause of the problem is between the keyboard and chair.

 

[recycled]

Can we all take it easy please. No need for confrotation. it is indeed possible .spike and geoff are both right. sometimes when you download something innocently likea peer-peer network criminal elements tend to send it attached with malware without you knowing. so even though you think you are downloading one thing and click i agree, you are in fact downloading three or four.
Basically to be safe do not download anything unless you get it fronm the original source.
E.g there are lots of sites like you tube offering free flash player to watch videos. but they come with stuff you know nothing about.
If you need flashplayers go straight to adobe acrobat sites.

So it is possible and please ignore pop ups in future and just install pop up blockers from microsoft and not some cheap website.

 

[Sp!ke]

I'm easy, read my post recycled and you'll see I listed both means of install - either way there was a choice.

Its just the post header "Unavoidable Downloaded Program" that I didnt agree with - pure scaremongering.

 

[scotth_uk]

If I may make a recommendation - might be a good time to reinstall your system from scratch anyway. The machine's likely going to run really well, with all new drivers, etc.

 

[Rob77]

If I may make a recommendation - might be a good time to reinstall your system from scratch anyway. The machine's likely going to run really well, with all new drivers, etc.

I'd probably go that route too. Once found this piece of malware that was just impossible to get rid of. A few of the checkers would see it and I could even remove it sometimes but the core program was good at hiding and it would replicate when you weren't looking.

 

[recycled]

I'm easy, read my post recycled and you'll see I listed both means of install - either way there was a choice.

Its just the post header "Unavoidable Downloaded Program" that I didnt agree with - pure scaremongering.

You are right spike sorry bout that

 

[recycled]

i suggest you reinstall your system from scratch because this stuff can do sone serious damage to your system especially if it is logging your keystrokes password.

All your details will be at stake. just back up your important docs so you can reinstall them and then take heart as it is not the end of the world.

 

[Benzowner]

Sp!ke,
I do not know anyone who decides to install a virus, otherwise there would be no need for antivirus software. I have installed a little piece of do do, noy by choice, that sits in my tool bar telling me to go to another web site to download a program. I cannot find where this little piece of software is in my PC to delete it. And for those who think this is getting a little hot, calm down its only a discussion

 

[Sp!ke]

I'm not suggesting you meant to install this, I was just saying it was totally avoidable.

One should only install software from a reputable source.


As for your problem now, I'd make sure I was logged on as an Administrator, go into MSConfig and see whats firing at startup and kill anything that shouldnt be there.

Then I'd reboot and find the path to these executables and overwrite the files with my own safe (non working) versions. Once done I'd trawl through the registry and remove any reference to them. But thats me, I wouldnt necessarilly suggest that everyone should do it this way.

 

[Chris_J]

Start - Run and type in msconfig

Go to the startup tab and see if this program is in there. Say yes to save the change, reboot and see if you can remove it then with one of your spyware programs.