Trojan/ Spyware nightmare!



Billybob
07-09-2005, 11:40 PM
They seem to have come from the coolwebsearch thing. I've used AVG, Spybot
and CWShredder on normal and safe mode numerous times. I make sure to update
them too.
Stuff keeps coming back though.

Trojan downloaders keep retuning from the AVG searches.

In the Spybot searches: people on page, a better internet, AproposMedia,
Callinghome.biz, effective band toolbar, hotsearch bar, IBIS toolbar, n-care.

On my start-up screen I have this message permenantly there:

"A fatal error in IE has occured in at 0028:C0011E36 in VXD VMM(01) +
00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c"

Any advice? Is it possible that my computer is beyond being able to fix this?

BTW- I am using Windows ME.

thanks

What's in a Name?
07-09-2005, 11:40 PM
Billybob wrote:
> They seem to have come from the coolwebsearch thing. I've used AVG,
> Spybot and CWShredder on normal and safe mode numerous times. I make
> sure to update them too.
> Stuff keeps coming back though.
>
> Trojan downloaders keep retuning from the AVG searches.
>
> In the Spybot searches: people on page, a better internet,
> AproposMedia, Callinghome.biz, effective band toolbar, hotsearch bar,
> IBIS toolbar, n-care.
>
> On my start-up screen I have this message permenantly there:
>
> "A fatal error in IE has occured in at 0028:C0011E36 in VXD VMM(01) +
> 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c"
>
> Any advice? Is it possible that my computer is beyond being able to
> fix this?
>
> BTW- I am using Windows ME.
>
> thanks

Start here-
Virus Removal Instructions: http://home.neo.rr.com/manna4u/
-max
--
You can find my e-mail address on my pages.
This message is virus free as far as I can tell.

Frank Saunders, MS-MVP, IE/OE
07-09-2005, 11:40 PM
Try booting to Safe Mode and doing the scans there.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/


"Billybob" <Billybob@discussions.microsoft.com> wrote in message
news:CB5C2D77-E2A1-4C34-9019-B4109098BD7F@microsoft.com...
> They seem to have come from the coolwebsearch thing. I've used AVG, Spybot
> and CWShredder on normal and safe mode numerous times. I make sure to
> update
> them too.
> Stuff keeps coming back though.
>
> Trojan downloaders keep retuning from the AVG searches.
>
> In the Spybot searches: people on page, a better internet, AproposMedia,
> Callinghome.biz, effective band toolbar, hotsearch bar, IBIS toolbar,
> n-care.
>
> On my start-up screen I have this message permenantly there:
>
> "A fatal error in IE has occured in at 0028:C0011E36 in VXD VMM(01) +
> 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c"
>
> Any advice? Is it possible that my computer is beyond being able to fix
> this?
>
> BTW- I am using Windows ME.
>
> thanks
>
>
>

Tim.T
07-09-2005, 11:40 PM
Get Ad-Aware SE, and the new Microsoft Antispyware program - run them both
on deep scan (scan everything). Both are free, btw.
http://www.microsoft.com/athome/security/spyware/software/default.mspx
www.lavasoft.com

It pays to use multiple anti-spyware progs, as they often find things others
miss. And judging by your error message, I strongly suggest switching from
IE to Firefox. Also, something that can filter webpages before they get to
you can be useful too. Try Proximotron 4.5
http://www.proxomitron.info/files/index.html. It is no longer supported by
the original site, but you can still download it from other sites like this
one.

Firefox www.mozilla.org

Tim


"Billybob" <Billybob@discussions.microsoft.com> wrote in message
news:CB5C2D77-E2A1-4C34-9019-B4109098BD7F@microsoft.com...
> They seem to have come from the coolwebsearch thing. I've used AVG, Spybot
> and CWShredder on normal and safe mode numerous times. I make sure to
update
> them too.
> Stuff keeps coming back though.
>
> Trojan downloaders keep retuning from the AVG searches.
>
> In the Spybot searches: people on page, a better internet, AproposMedia,
> Callinghome.biz, effective band toolbar, hotsearch bar, IBIS toolbar,
n-care.
>
> On my start-up screen I have this message permenantly there:
>
> "A fatal error in IE has occured in at 0028:C0011E36 in VXD VMM(01) +
> 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c"
>
> Any advice? Is it possible that my computer is beyond being able to fix
this?
>
> BTW- I am using Windows ME.
>
> thanks
>
>
>

uggabugga
07-09-2005, 11:41 PM
Everything seems to have a problem with People on Page. You may have to go
into the registry and delete references to AutoUpdater and delete the
AutoUpdater folder in C:\Program Files. I'm not exactly sure now if that's
the folder but do a Spybot scan and where it shows People on Page in the
list, leave it unchecked and click on the + sign. It will show you the entry.
--
That's just like my opinion, Man........


"Billybob" wrote:

> They seem to have come from the coolwebsearch thing. I've used AVG, Spybot
> and CWShredder on normal and safe mode numerous times. I make sure to update
> them too.
> Stuff keeps coming back though.
>
> Trojan downloaders keep retuning from the AVG searches.
>
> In the Spybot searches: people on page, a better internet, AproposMedia,
> Callinghome.biz, effective band toolbar, hotsearch bar, IBIS toolbar, n-care.
>
> On my start-up screen I have this message permenantly there:
>
> "A fatal error in IE has occured in at 0028:C0011E36 in VXD VMM(01) +
> 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c"
>
> Any advice? Is it possible that my computer is beyond being able to fix this?
>
> BTW- I am using Windows ME.
>
> thanks
>
>
>

uggabugga
07-09-2005, 11:41 PM
I have been using Spybot and Microsoft AntiSpyware for some time now. Here is
the download for MSAS:

http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en&Hash=KRBLG87

It is a beta that expires in about two months but it usually gets out
stubborn spyware. It will run in Safe Mode but has to be installed in Normal
mode.

Click on Help in the program to learn how to use it properly.

The last thing I try if that doesn't work is Webroot's Spysweeper.

http://www.webroot.com/shoppingcart/tryme.php?bjpc=64002&vcode=DT02

It seems to be good at cleaning up traces of spyware afterward.

You can also use Adawae but I find that it finds false threats.
--
That's just like my opinion, Man........


"Billybob" wrote:

> They seem to have come from the coolwebsearch thing. I've used AVG, Spybot
> and CWShredder on normal and safe mode numerous times. I make sure to update
> them too.
> Stuff keeps coming back though.
>
> Trojan downloaders keep retuning from the AVG searches.
>
> In the Spybot searches: people on page, a better internet, AproposMedia,
> Callinghome.biz, effective band toolbar, hotsearch bar, IBIS toolbar, n-care.
>
> On my start-up screen I have this message permenantly there:
>
> "A fatal error in IE has occured in at 0028:C0011E36 in VXD VMM(01) +
> 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c"
>
> Any advice? Is it possible that my computer is beyond being able to fix this?
>
> BTW- I am using Windows ME.
>
> thanks
>
>
>

Al Smith
07-09-2005, 11:41 PM
> Try booting to Safe Mode and doing the scans there.

Remember to purge your restore points, also.

Billybob
07-09-2005, 11:41 PM
Thanks everyone- this is really helpfull and I'm slowly ploughing through it
all with my fingers crossed.

I cannot get Microsoft AntiSpyware unfortunately because I have Windows ME.

One more question- What is IE and how can I get rid of it if I switch to
Firefox?

Thanks


Trojan/ Spyware nightmare!