please help spyware virus #384

[Snooky]

This keeps coming up as my homepage don't seem to be able to change it, can you help please.

Detected SPYware! System error #384
__________________________________________________________________________

Your IP address is 2**.1*4.2*0.2*8. Using this address a remote computer has gained anaccess to your computer and probably is collecting the information about the sites you've visited and the files contained in the folder Temporary Internet Files. Attention! Ask for help or install the software for deleting secret information about the sites you visited.

__________________________________________________________________________

Your computer is full of evidences!


ISP of transmission: ONSPEED
Your IP address: ***.**0.**0.**8
They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Your computer is: Windows XP
Risk status for further investigation: VERY HIGH RISK




To protect from the Spyware - click here
To prevent information transmission - click here
To delete the history of your activity, click here
____________________
Bikes i've owned Aprilla Rs125, Vfr400 Nc24, Triumph TT600, Currently riding '02 R1 (now a streetfighter after losing the front on a roundabout)

[NSR Mick]

Its an anoying bit of spyware, try this
Download SmitfraudFix by S!Ri from either of these mirrors to your desktop:

https://siri.urz.free.fr/Fix/SmitfraudFix.zip
https://siri.geekstogo.com/SmitfraudFix.zip

Right click SmitfraudFix.zip and Extract (unzip) the SmitfraudFix folder inside to your desktop.

Restart your computer in Safe Mode by doing the following:


Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Further instructions on restarting in Safe Mode can be found here:
https://www.virusvault.co.uk/fusionbb/showtopic.php?tid/54/


Once in Safe Mode, open the SmitfraudFix folder on your desktop and double-click smitfraudfix.cmd

Select option #2 - Clean by typing 2 and pressing "Enter" to delete the infected files.

You will then receive the following prompt:

"Registry cleaning - Do you want to clean the registry ? (y/n)"

Type Y for yes and press "Enter" to remove the Desktop background and clean the associated registry keys for this infection.

The tool will then check if the file wininet.dll is infected.

You may be prompted to replace the infected file with another copy from your machine (if found):

"Replace infected file ? (y/n)"

Type Y for yes and press "Enter" to restore a clean copy of the file on your machine.

Restart your computer to complete the removal process.

(A log file of the fix can be found at the root of your system drive, usually at C:\rapport.txt)

Although the infection should be removed at this point, scanning your computer in Safe Mode with Ewido Anti-Malware should remove any leftovers. Download and setup instructions for Ewido can be found here:
https://www.virusvault.co.uk/fusionbb/showtopic.php?tid/33/
____________________
If you dont like the way that I ride.......Stop trying to keep up!!!

[Lawnie]

Not being able to see your browser, I will propose that your browser has been hijacked - showing you an ad as your homepage instead. Quite often what these anti-spyware companies will do is target you through fake "spyware detected" messages - where obviously you are advised to download and buy their program to 'remove' it.

By the way, on the subject of net abuse, I'd delete your IP address from your first post if I were you.

[simon1221]

Onspeed huh? Delete your IP address from that thread
____________________
DNA50 (sorry) ->> TZR125l >> GPZ500S

[carvell]

https://www.google.co.uk/search?q=%22Your+computer+is+full+of+evidences%21%22&start=0&ie=utf-8&oe=utf-8

Plenty of removal tips for that specific one there.
____________________
Yamaha TDM 850

[Snooky]

Thanks for your replies will try that out,probably wasn't a good idea to give out my ip address, but changing isp in a couple of days anyway.
____________________
Bikes i've owned Aprilla Rs125, Vfr400 Nc24, Triumph TT600, Currently riding '02 R1 (now a streetfighter after losing the front on a roundabout)

[Lawnie]

There's still one there!

[Snooky]

Thanks mate, not quite with it
____________________
Bikes i've owned Aprilla Rs125, Vfr400 Nc24, Triumph TT600, Currently riding '02 R1 (now a streetfighter after losing the front on a roundabout)

[Lawnie]