I have no idea how or where I got this from but I have this question mark and a circle with a line through it like you would have in a no smoking sign lets say, in my system tray.
I clicked on it and it takes me to a “security center” message saying I have a virus and to BUY their software to clean it. It takes me to www.spyblocker.com
I don’t want to buy and I cant seem to get rid of this blinking icon in my system tray or the software associated. It had an uninstall program in my control panel which I ran, but its still there even though its no longer showing in Add Remove programs.
I’m also unable to right click the icon to see what directly or where the target is.
I ran avast on boot up, it found some infected files in recovery and deleted them. But this thing it doesn’t seem to notice or get rid of.
There is probably a run command to activate this. Something you can do quickly is, Windows Start button, Run, type msconfig and click OK. Select the Startup Tab and check what is there report any thing you are unsure of or post a screen shot of it.
If that isn’t obvious then it would be best to download this tool, hijackthis and read the first tutorial on how to set it up and run it in order to produce a log file.
It would have ben easier had you pasted the contents of the log as suggested, that way people don’t have to download and open it to see the contents.
So I will do it here:
Logfile of HijackThis v1.99.1
Scan saved at 6:21:28 PM, on 4/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Do you have an Intel Graphics card or chip (motherboard with integrated graphics) as this file is associated with that ?
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
Though why it is a winlogon Notify is beyond me and I feel you should have this file scanned.
Check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently 32 different scanners. Post the results here if anything is detected.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can’t do this with the file in the chest, you will need to move it out.
Did you have CounterSpy installed as this ‘missing’ file is associated with that, since the file is missing the entry should be fixed.
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
These O20 - Winlogon Notify: entries can be used by some malicious programs purporting to be legit entries often associated with these fake security warnings.
Here are the cleansing instructions for Virtumonde: http://www.bleepingcomputer.com/forums/topic18610.html a log should be produced, post the ‘contents’ here.
Below is an example of a Vundo infection, though there are many different filenames.
As David said, there’s nothing malicious obvious in your HijackThis! log, so it might be worth looking for hidden programs (rootkits) with these scanners:
(If you do find and remove any rootkits, run all your previous scans again: avast! Spybot, AVG etc., because once a rootkit is removed, the malware it was hiding will become visible to these scanners.)
I doubt you have a "virus", but something more serious. Spent some time
on a "Google Search" and it appears "Spyblocker" ( small "b") is a rogue
product using the "name" of the legitimate "SpyBlocker" ( capital "B" )
and/or a component of the legitimate "SpySweeper" program !?
The HijackThis program you have appears to be residing in a "Temporary"
Folder ; a no-no . It might be easier to uninstall the HijackThis you have,
then download it from www.thespykiller.co.uk/files/HJTsetup.exe .
At the download prompt, choose “Save”.
Navigate to the saved file and double-click the installer, HJTsetup.exe.
HijackThis will be installed on your computer at C:\Program Files\HijackThis, making an entry in the start menu and also providing a desktop shortcut.
And nowadays some Malware "hide" from detection of "Hijackthis"
and many Malware Experts recommend "renaming" "HijackThis" to
something like "hijackthat", etc .
Since this seems to be a relatively new piece of malware, perhaps it
would be best if you got the assistance of an experienced, trained,
volunteer Malware "Expert", like "MrCharlie" on the Spyware Beware
Forums at http://forums.maddoktor2.com/index.php?s=175e569a3f1f23976f85d6f0675af6fc&showforum=17 !?
I ended up cleaning out just about everything that I absolutely did not need.
Then I reinstalled and ran the program David suggested before I did the hijack thing.
WAHLAH, mysteriously, it seems to be gone. Well…the icon is gone.
My computer is still running slower than the norm.
Since I have 2 drives, one with all my data and one with programs, I’m going to format my programs hard drive and boot from the 2nd data one which also has windows running on it, then reinstall windows clean and my necessary programs.
Thank God I have a laptop I can use in the meantime.
I REALLY REALLY appreciate all the time you guys took with me and how quickly you responded. I did not panic because you all made me feel confident that it would be found and taken care of.
I think was taken care of David’s first solution AND uninstalling a bunch of crap and running it again. But I think it already had caused some damage so I’m gonna clean it all up.
Thanks again I really appreciate your help and your time, all of you.
Meanwhile, I had 2 Excel files I’ve been working on for weeks, had them saved on my desktop… they’re gone. Did a search, gone. Zippo. I think when I ran the virus check originally, I left it running over night and put the option to delete any infected files. Gone… aaahhhh.
I’m not gonna panic… I’m still searching…
But I think I’m in… denial mode.
Hi Snow :