I'm being attacked

[JerseygirlCT]

anyone around to help talk me through this?

The cable people want to sell me their services at 150 to clean my computer.

I'm thinking there's got to be another way.

Spyware dr. found some "elevated" and "high" stuff, but seemed to delete it. Norton hasn't found anything really serious - until I did a total scan, and now it's got some trackware.enhancer that it can't delete with the freebie version I've got.

I started getting a lot of pop=ups - looking like Windows things. A red shield on the taskbar, that looked a lot like Windows warnings and updates stuff. Then cascades of warnings about needing to update this or turn on automatic updates... (I hadn't turned that off that I'm aware of).

I'm having trouble distinquishing from legit MS and fake stuff designed to get me to click through.

Right now, Norton come on at boot up, and it's running, but windows hasn't even fully loaded. (I'm writing from the work laptop).

How do I figure this one out, and what can I do?

Help!

[JerseygirlCT]

1. New pop-=up

says Windows Security Center and "possible spyware infection detected"

It directs me to a high risk "trojandownloader.xs" and asks me to click here in order to remove detected threat. It's also got a box on the left side telling me "how to remove trojandownloader.xs" under the heading of Resource.

It sure looks like MS windows, but I'm always nervous about these things.

[salvorhardin]

2. It sounds like you've got a variant of the Vundo family of trojans

Without knowing a lot more it sounds like you've got one of the many variants of the Vundo family of trojans. They're particularly nasty pieces of work but fairly easy to remove. Try this webpage for assistance: http://www.bleepingcomputer.com/forums/topic18610.html

[JerseygirlCT]

3. Thanks

So those are safe to use? The Vundo fix, etc? Right now I'll admit to feeling gunshy about all of it.

Norton is still running, and windows still hasn't fully booted up. I'm hoping it's Norton that's holding that up.

Once I get to windows I will try that.

Do you think the dialogue boxes (probably fakes) telling me "trojandownloader.xs" and "Coolwebsearch" are for real in that those are also problems?

Norton just found Adware.ISMonitor but says it can't remove with the free scanner. The level on that one is High.

[salvorhardin]

4. No, they're likely not real

They're designed to get you to click on them to infect you with more viruses, but like I said, it's impossible to know based on so little information.

VundoFix is safe, but a small percentage of PCs running VundoBeGone will never recover.

Try VundoFix, then try rolling back your Windows with System Restore to a point before you had the problems. Here's a helpful page on how to use System Restore.
http://lifehacker.com/software/windows/geek-to-live--roll-back-windows-with-system-restore-193546.php

Although honestly, if you're not comfortable doing this stuff yourself you're much better off hiring someone who is competent. I'm not trying to be mean, or unhelpful, but I can't overstate how detailed removing some of these trojans, especially the ones that install rootkits, is today.

[JerseygirlCT]

5. No offense taken

these things manage to make any sensible thoughts I usually have fly right out. So I certainly see your point.

I was wondering about trying the system restore... If I used it and picked yesterday, would I just get rid of this stuff, or would it stay lurking somewhere?

Oh, and thank you so much for your help. I'm sorry if I forgot to say that in my near-panic. Check that, panic.

[salvorhardin]

6. That's OK.

I got infected with a variant of Vundo a few months ago after a run of four or five years with no viruses. It's positively maddening. I don't run antivirus software or even a software firewall because my computer is behind a hardware router with all but the ports I need walled off. Theoretically I should be pretty safe this way and I'm pretty savvy about security. But a webpage link I clicked on to watch a video (and no, it wasn't porn!) caused a pop-up that said I needed a video codec I didn't have to watch the video and I foolishly allowed it to install. I feel like an idiot but no matter how security conscious we are, or how computer literate, we all succumb to this kind of trickery every now and then.

If you successfully remove the virus, then restore your Windows to a point before you became infected, you will be fine. However, if you restore it to just a previous stage of the infection the pain will start all over again. BTW: If I didn't say it, boot Windows into Safe Mode with NO networking before running VundoFix. You may also wish to install and run Spybot S&D (http://www.safer-networking.org) after that, then do the System Restore. Spybot S&D also offers some very informative forums on malware removal. http://forums.spybot.info

[JerseygirlCT]

7. I can't seem to get IE to open. Except to go to the site

it's hijacked instead of my home page.

I turned it off, and will try to restart it.

Crap.

[JerseygirlCT]

9. Windows defender box

Application failed to initialize: 0x800106ba. A problem caused this program's service to stop. To start the service, restart your computer...

[salvorhardin]

10. That's the virus again

It was doing the same thing on my box and I don't have Windows Defender installed.

[JPettus]

11. Can you get to a shareware site like www.filehippo.com?

If your antivirus software isn't running the latest updates, update that first and then run a full scan.

Download and install Spybot Search & Destroy (it's free!) and run that first. Then download and install AdAware (also free!) and run that. Those two will remove most of the stuff you find.

If you are still having problems, you can then download and install Hijack This, get a log of what you are seeing and send that log to one of the places online where they do analysis and they can then tell you what is left to remove and how to do so.

I've had good luck at geekstogo.com but ymmv.

[canetoad]

8. Same here

and used a variety of means to eventually eradicate it. Big note***The Norton Vundo removal tool did not remove it. F-vmonde.exe (I think from F-prot) did the job as well as manually removing traces.

[JerseygirlCT]

12. Thanks all

It got so bad that I couldn't even get to the internet - or any programs, for that matter. I had to give in and call the tech people and get them to come out. (Couldn't do it manually, since no internet). They said it looked pretty bad.

Wow. How does it go that bad that fast? Even in safe mode, we couldn't get to anything. Hours beforehand, all was fine.

I appreciate all the help and hand-holding though. I was a wreck last night. There's something about computer problems that really upsets me.