Virus / Trojan Help! Sorry Long question! Computer's Buggered!

[Mike-bham]

Somehow yesterday a trojan called spyware quake or something of that likeness managed to completely bypass me and norton antivirus and install itself on my computer. It installed a program called spyware quake, which said it is an anti virus etc program and i have all these differant virus' and spyware things etc on my computer, and i need to pay them 29 dollars etc for the full program to get rid of it. well then it decided to start opening 55 internet explorers at a time and send the computer mad. So I pulled the modem out of the wall to try and stop anything else happening. Then it took control of my dial up controller with its screen and started trying to connect to my broadband, But as the modem wasn plugged in it couldnt.I had to switch the computer off at the wall to get any response out of it then start it up again. Now the program kept coming up with allsorts on my screen and norton started to recognise the trojan, but not the program.

I looked in the contol panel for 'add or remove programs' and saw it was in there and so uninstalled it.But bits of it kept flashing on the screen.Norton kept saying a file called dcomcfg.exe was trying to connect and change my homepage. I found it next to the real windows file called dcomfng.exe or something like that in c: windows / system32. So i tried to delete it as i could see it was made when the virus first started. It couldnt as it said it was running.

I scanned it with norton and came up with nothing, and looked it up on symatec website, and nothing. typed it in on google, and it cam,e up with all these so called anti virus prorams to remove it for a fee. So i started the pc up in safe mode then deleted it and then started back up in normal mode. The file appeared to be gone, but now when i start up internet explorer goes straight to this so called anti virus site (see pic) and then when running keeps advertising differant so called pay virus removers. you can see some of the sites it has taken me to on the history bar on the screenshot.

Ive tried blocking these using the internet explorer, and norton, but to no avail. and im worried that it probably knows my passwords being as it managed to dial itself and go straight to its own site. Now i cant seem to do anything to get rid of it, norton seems useless and doesnt know anythings wrong, but keeps letting things through, and now that file has re appeared and the real windows one has gone.

System restore wont work either!Sorry fo the long essay, but im completely stuck!And help would be brilliant,

Thanks

Mike

Ps the first screen shot is the site it goes straight to, and if you press home it goes to, the second is the random messages i get ,and the third is the file trying to change my homepage all the time

 

[FiDoDiDo]

Have you tried this site?

http://www.spywarequake.org/

 

[Mike-bham]

Thanks mate, going through it in the moment, quite long winded! would you reccomend it go through their walkthrough one or just do the download one, ie the xsoftspy one?

 

[ollie]

tried ad aware?
also, might be worth trying different anti-virus, i use nod32 and its the best i have come accross, updates every hour, and uses next to nothin on system resources.

Also, using FireFox is a must imo, Internet Explorer lets to much crap be downloaded to your machine without you knowing, unless set up properly.

 

[FiDoDiDo]

Thanks mate, going through it in the moment, quite long winded! would you reccomend it go through their walkthrough one or just do the download one, ie the xsoftspy one?

Properly better to use there's because you can't miss a stage out by mistake or do it wrong. It'd say try getting it into safe mode and trying it as this seems to work better most times.

 

[Mike-bham]

Well ive used that one, but did the same as all the others, just did a scan then said i had to pay 30 dollars to have them removed, trying the programs off their forums now! hope it works!

problem is im no IT expert and dont really know what i'm doing

 

[unofficialPete]

My dad had something similar, this did the job..
http://www.microsoft.com/athome/security/spyware/software/default.mspx

 

[Tim(e)]

Download AVAST antivirus software.....you have a TROJAN virus on your machine. Norton does not remove it or repair it it just quarantines. Norton is a pile fo crap. AVAST is a free corporate antivirusoftware that actualy removes and repairs viruses.

AVAST will do a deep scan on your system before the machi9ne boots up. I had it and AVAST removed it about 6 times. Now its gone. Also download LAVASOFT AD-AWARE spyware remover. This gets rid of the annoying adverts and spyware that pop up everywhere.

 

[Mike-bham]

Well ive tried just about all of these now, but to no avail. the adaware looked like it might do it, but then didn't. Anyone an IT Expert on here fancy having a look lol?

 

[Mike-bham]

Download AVAST antivirus software.....you have a TROJAN virus on your machine. Norton does not remove it or repair it it just quarantines. Norton is a pile fo crap. AVAST is a free corporate antivirusoftware that actualy removes and repairs viruses.

AVAST will do a deep scan on your system before the machi9ne boots up. I had it and AVAST removed it about 6 times. Now its gone. Also download LAVASOFT AD-AWARE spyware remover. This gets rid of the annoying adverts and spyware that pop up everywhere.

Have you got a direct link for a download of AVAST mate? Is It free as well?

 

[Steve]

I got PC DOCTOR when my PC f##ked up, found over 100+ trojans adware etc no wonder it was running slow & not doing as told..................

 

[FiDoDiDo]

Well ive tried just about all of these now, but to no avail. the adaware looked like it might do it, but then didn't. Anyone an IT Expert on here fancy having a look lol?

Where you based mate?

 

[Mike-bham]

South Birmingham, Hollwood to be exact.

I think Essex would be a bit far mate lol

Gonna try some stuff again in safe mode again. using stuff off here...

http://www.bleepingcomputer.com/forums/topic47826.html

 

[FiDoDiDo]

Just done some looking up on this and it's from SpyAxe.

Here's a site that tells you have to remove it (site is from probably the best spyware remover program IMO): http://forums.spybot.info/showthread.php?t=4015

 

[Mike-bham]

I'll have a look through them too now lol, still having no luck. It would appear that the trojan's program is no longer there as such, maybe be i'm looking for the wrong thing then, but it still comes up with the pop ups and goes straight to the screen like in my first screen shot every time i connect to the internet.

 

[Mike-bham]

seems to have got rid of everything now, apart from wont go to home page, just straight to that first screen shot page...

 

[FiDoDiDo]

How have you tried changing it back?

 

[Mark5290]

Is Spyware quake the same virus as spyaxe etc, a bubble pops up on your taskbar to tell you your pc is infected and you need to download a scanner that you have to pay for, that is all part of the con, do not pay the money.

I found that avast 4, adaware and spybot will not remove all of the infection, you think it is all gone then it pops up again, do a google search for Spyware quake and how to remove instructions, you may find someone has written a small program to completely remove this virus, like i found with Spyaxe.

 

[FiDoDiDo]

^^^
As said above it is SpyAxe.

 

[Mike-bham]

Yup, well ive been at it all day with various differant forums and tutorials, and i think I might have done it!
Thanks for the help, the links etc were very helpful.
I dont completely trust the computer right now, but i'll see how it goes!
Any idea how i'll know if the computer is completely 'safe' so to speak?
It is the same as spyaxe, apparently thats an older version.
I used someones program they made off a computer virus forum to find it, and another to completly clean all my directorys and registories.

Ill see how it goes and hope nothing else strange happens!
Thanks again,. Mike

 

[Mark5290]

Yup, well ive been at it all day with various differant forums and tutorials, and i think I might have done it!
Thanks for the help, the links etc were very helpful.
I dont completely trust the computer right now, but i'll see how it goes!
Any idea how i'll know if the computer is completely 'safe' so to speak?
It is the same as spyaxe, apparently thats an older version.
I used someones program they made off a computer virus forum to find it, and another to completly clean all my directorys and registories.

Ill see how it goes and hope nothing else strange happens!
Thanks again,. Mike

When my dad had it on his pc it took me ages to get rid of it as it hides in lots of different locations, a combination of deleting files, editing registry, using scanners, booting into safe mode etc finally gets rid of it.

Just check in task manager to see what programs and applications are running, you can cross reference the running tasks in google to find out what they are.

Fortunately this particular virus/worm works by popping up a box and trying to fool you into signing up for a virus scan that will cost you money, so if it does not pop up any more and you think you have removed all of the virus/worm components you should be safe.

 

[Mike-bham]

I'll look all them up too then!