PDA

View Full Version : spyware? wtf bbq. task manager disabled by administrator! help!

teh DIRT
10-12-2008, 11:40 PM
So this all started today....

I closed my laptop and went and got a shower....came back to it and opened it. The screen was blue (not the blue screen of death though) and said windows XP in the corner. Scrolling through the screen were a ton of commands i guess..."deleting such and such"...."recovering such and such"

When it ended it said rebooting. Computer restarted and all seemed normal. Then a window popped up from the task bar "you computer is infected with spyware, windows will download a yada yada yada to protect from data loss. Click here to protect your computer from spyware!". The emblem for this little thing is a red circle with an "X" in it. But when i click its dialog box, and error occurs. SO now i am thinking....maybe this thing is the spyware.

So i try to open taskmanager and an error occurs saying taskmanager has been disabled by the administrator....wtf! thats me!

helps?!
crazyukrainian
10-12-2008, 11:54 PM
youre pretty much ****ed..... :(

get all your files off and reinstall windows. you can also try googling and might find a complicated way to remove this thing, but i'd never trust a machine after that deep level of compromise; when it screws with your taskmanager permissions you have no idea what it's done or will do, even if you think you've killed it.....
teh DIRT
10-12-2008, 11:56 PM
weak.
crazyukrainian
10-12-2008, 11:58 PM
but true.... hit me on aim if you want more help/details/questions/etc
james_ls
10-13-2008, 12:22 AM
I've got a few programs that'll help you out.
teh DIRT
10-13-2008, 12:25 AM
so i am sure i didnt fix the problem, but rolling the computer back a month sure has made things SEEM better. my email is pmaicher (at) gmail.com if you have cool programs that can save my ass.
Punkboy15
10-13-2008, 12:50 AM
Download this.
http://www.malwarebytes.org/

It's free and it does a very good job. Also superantispyware is free and works pretty well
NOPSTNS
10-13-2008, 01:21 AM
pete...how weird, my roomate JUST got the same thing....i had one lap left of watching the F1 race at fuji speedway when the damn thing restarted and is now all F'd....


what fixed urs?!!!!!!!!!!!!!!!
Honduh
10-13-2008, 01:42 AM
I've had a thing popping up for months now saying my computer may be corupted by spyware and some **** about win32. it eventually made my desktop melt down. now im on a laptop and i'm starting to get the same ****. I don't even go on porn site or anything weird like that. just forums and stuff. i'm almost starting to thing its in my cable connection somehow.
crazyukrainian
10-13-2008, 04:20 AM
I've had a thing popping up for months now saying my computer may be corupted by spyware and some **** about win32. it eventually made my desktop melt down. now im on a laptop and i'm starting to get the same ****. I don't even go on porn site or anything weird like that. just forums and stuff. i'm almost starting to thing its in my cable connection somehow.

haha nah they spread through trusted sites half the time.... its amazing how insecure the internets are (and after working in internet security, you start to look at everything differently..... :( )
teh DIRT
10-13-2008, 06:06 AM
so i did my usual thing. went through regedit and searched Google for the things in there that returned spy ware results, deleted all that ****. Then i downloaded ad-aware and spy bot......they worked overnight and cleaned up over 4000 files apparently. I then made a few more custom cleanup and modifications to the start up list and what not. Also downloaded Firefox and stopped using IE, I am told things are much safer with Firefox.


hmm, what i dont like is that with firefox, Alt-S doesn't submit the post. weak.
Jeffros Spec V
10-13-2008, 07:42 AM
Mac

/thread!

This is the exact reason I went away from windows based laptops. Mine was just over a year old and infected with so much bull **** it was insane. During the middle of the night my laptop would say "Congratulations, you've been selected to win a free iPod Nano!"
TGilb2007
10-13-2008, 09:07 AM
Mac

/thread!

This is the exact reason I went away from windows based laptops. Mine was just over a year old and infected with so much bull **** it was insane. During the middle of the night my laptop would say "Congratulations, you've been selected to win a free iPod Nano!"

Thats usually a computer virus, but having a Mac doesn't really mean that you can never get a virus on it.

http://antivirus.about.com/od/macintoshresource/Macintosh_Viruses_and_Mac_Virus_Resources.htm

so i did my usual thing. went through regedit and searched Google for the things in there that returned spy ware results, deleted all that ****. Then i downloaded ad-aware and spy bot......they worked overnight and cleaned up over 4000 files apparently. I then made a few more custom cleanup and modifications to the start up list and what not. Also downloaded Firefox and stopped using IE, I am told things are much safer with Firefox.


hmm, what i dont like is that with firefox, Alt-S doesn't submit the post. weak.

Did your desktop happen to turn blue with text afterwards? Also, just because anti-virus and spyware programs SAY the computer is clean, doesn't always mean that it is. Personally, if a virus gets onto my computer (and they have), then usually, its just a reformat time for me. Make sure everything important is backed up, and reinstall everything.

In terms of being more secure, FF3 is a lot better then IE7, since most viruses are coded for IE and its exploits over FF. As for losing a keyboard shortcut... its better then losing bank account info to some random person who wants your money.
super moose
10-13-2008, 12:07 PM
the first picture doesn't even look legit. they spelled prevent incorrectly and is missing a space after the period after data loss. next time get into safe mode and run your anti-spyware software from there. i use superantispyware.
teh DIRT
10-13-2008, 12:09 PM
yeah thats what triggered me off to thinking it was a fake. everything seems cool now, im sure i am still infected but it runs ok.
EvlEgl
10-13-2008, 12:41 PM
I use Trend Micro and It has kept my PC clean for almost a year...It runs its sweep everynight when im asleep and does a full scan like once a week. But Its also not free I paid for it.
pearl
10-13-2008, 12:45 PM
sounds like you got pwn

being infected = no good.
EvlEgl
10-13-2008, 12:47 PM
At least its not the Herp a Lerp
crazyukrainian
10-13-2008, 01:16 PM
macs have more vulnerabilities than windows these days, and apple sucks at patching in unbelievable ways.... i never have problems on a windows box; you just have to know how to secure it in the first place.
TGilb2007
10-13-2008, 02:00 PM
macs have more vulnerabilities than windows these days, and apple sucks at patching in unbelievable ways.... i never have problems on a windows box; you just have to know how to secure it in the first place.

Bingo. Just because it isn't Windows doesn't mean its totally secure.
teh DIRT
10-13-2008, 02:04 PM
new problem. I must have deleted the audio devices because my comp is stuck on mute and volume control doesn't exist anymore. help?
TROLL
10-13-2008, 02:13 PM
sounds like you should get your files off of the computer and reformat...
Vypurr
10-13-2008, 02:15 PM
^ In my professional opinion, I agree 100%! You will never fix it all. Rolling back to a previous restore point is only a temporary fix to cover up your problem. Get your files off while you still can!
crazyukrainian
10-13-2008, 02:47 PM
sounds like you should get your files off of the computer and reformat...

isn't that what i said originally? :)

btw, it might have been you that messed up the sound, or it might have been the malware; i've heard of one virus that turns sound up to max, disables mute and volume, and plays hardcore porn movies nonstop (imagine getting a call for computer help and hearing that in the background lol)
Menacing_Gc8
10-13-2008, 03:01 PM
reboot in safe mode, Run Antivirus and some sort of spyware remover and hijackthis.. Delete The File the Spyware has created ( might be Virtumonde or Zlob ) and reboot and run it all again out of safe mode.. I had something like this before, while in safe mode i deleted the Files the thing had created havent had the problem since.

And forgive me if that sounds confusing..
05GT
10-13-2008, 03:08 PM
As far as the task manager and not having permissions, a simple edit of the registry key that contains the permissions will fix that.

Your sound...well that could be from you rolling it back a month, could be because of the virus/spyware.

I can take a look at it for you if you would like to drop it off.
crazyukrainian
10-13-2008, 05:12 PM
As far as the task manager and not having permissions, a simple edit of the registry key that contains the permissions will fix that.

last time i dealt with one of these that was blocked off too.... as was EVERYTHING that you could possibly try to use to get around it, short of booting linux onto it and nuking it or reinstalling (and thus also nuking it)

hey, look at the bright side: at least it didnt encrypt your documents and tell you to pay $200 to romanian hackers to get the key to decrypt them (and no, there's no way to get around that one :()
super moose
10-14-2008, 12:54 AM
re-install audio drivers?
teh DIRT
10-14-2008, 12:57 AM
re-install audio drivers?
l

duh? sound is back. lulz.
crazyukrainian
10-14-2008, 01:43 AM
congratz
05GT
10-14-2008, 09:32 AM
last time i dealt with one of these that was blocked off too.... as was EVERYTHING that you could possibly try to use to get around it, short of booting linux onto it and nuking it or reinstalling (and thus also nuking it)

hey, look at the bright side: at least it didnt encrypt your documents and tell you to pay $200 to romanian hackers to get the key to decrypt them (and no, there's no way to get around that one :()

I've dealt with it a number of times for different clients. It is possible to remove it. It's a pain, but its possible.