SpywareGuard2008

Norton Security | Norton Internet Security
1

Hello I have discovered today that this fake anti spyware system was on my computer. I went to this link http://www.symantec.com/security_response/writeup.jsp?docid=2008-100114-4845-99&tabid=3 and I followed the instructions performing a full system scan under safe mode. Trojan.Adware and SpywareGuard2008 was apparently removed. However in the fourth step I couldnt find the files it tells me to delete. The SpywareGuard2008 itself seems to be gone in the sense that the actual program doesnt pop up anymore, but Ads still pop up and its still listed in my start menu Also windows Security Center keeps on telling me that Spyware Guard 2008 is inactive. I dont know what to do at this point im thinking about doig what this link tells me to do http://www.malwarebytes.org/forums/index.php?showtopic=7314 but im not sure if I should.

Can anyone help?

Message Edited by Komalt on 12-27-2008 08:55 PM

2

sending the pm

Message Edited by Komalt on 12-27-2008 09:12 PM
3

Hi

 

Start Hijackthis again and tick these entries only,

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)

O15 - Trusted Zone: *.gomyhit.com (HKLM)

O20 - AppInit_DLLs: agllco.dll
O21 - SSODL: ieModule - {6482FCF1-4A0E-4CE2-94DE-A8C01C044ABF} - C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll               (SpywareGuard2008)

O21 - SSODL: InternetConnection - {F5CD2C81-55B8-4C7A-B127-56B9AE61D448} - C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\quhejpykpd.dll     (SpywareGuard2008)

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

 

Then click "Fix Checked"

 

After that, use SAS (SuperAntispyware) or MalwareBytes fully updated and run a full scan, see if that gets rid of the file.

 

Take note of the location of the SpywareGuard2008 files

 

" C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\"

 

Quads 

 

 

4

Well it seems like everythings working fine now, thanks a lot I really appreciate it!

5

No Problem

 

Quads 

6

Hello I have discovered today that this fake anti spyware system was on my computer. I went to this link http://www.symantec.com/security_response/writeup.jsp?docid=2008-100114-4845-99&tabid=3 and I followed the instructions performing a full system scan under safe mode. Trojan.Adware and SpywareGuard2008 was apparently removed. However in the fourth step I couldnt find the files it tells me to delete. The SpywareGuard2008 itself seems to be gone in the sense that the actual program doesnt pop up anymore, but Ads still pop up and its still listed in my start menu Also windows Security Center keeps on telling me that Spyware Guard 2008 is inactive. I dont know what to do at this point im thinking about doig what this link tells me to do http://www.malwarebytes.org/forums/index.php?showtopic=7314 but im not sure if I should.

Can anyone help?

Message Edited by Komalt on 12-27-2008 08:55 PM