next »

[Centurion]

How the feck do I get rid of Spyware guard 2008 it's doing my sweed in.........

[keasy]

http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe


Download it, run it.


Now download this...

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

Run it.

When it's installed (very quick)  'Do a system scan and save log file'.

It will scan and a list of various pieces of info will appear and then an open notepad shall appear.

In the notepad select - edit - select all.
Everything shall highlight in blue.
Select edit again - copy.

Then go here...

http://www.hijackthis.de/

Right click in the box and hit paste.
Then hit the analyze button.

It will give a little info screen like the one you saw first when running hijack this and the one you should still have running as I haven't told you to close it



You will see green ticks and red crosses.
The red crosses are obviously the bad ones.


In hijackthis click in the corresponding boxes the analyzer (sic) told you were bad and click fix checked.

You're done.


This may help if the above doesn't.

http://www.spywaregeeks.com/


http://www.javacoolsoftware.com/spywareguard.html

That's the url of the legit spywareguard. Spywareguard 2008 is a nasty piece of trickery that's duping people in the new style of malware, such as XP antivirus that everyone was getting a few month back.


---------------------


If spyware guard 2008 is being a total asshole it maybe block the urls of programs it knows will kick it's ugly arse out your system.
If that happens then disable the process by hitting ctrl - alt - delete   hit processes - winscenter.exe - hit end process.

If all else fails let me know I will pack the files up and send them to ya via email.

[Centurion]

The little shit is blocking everything I try.... I'll give this ago winscenter.exe   Thanks

[Wooster]

winscenter.exe is fake don't use it.

Malwarebytes AM should do the job...if you can get it running.
This will allow you to suspend any dodgy looking processes that might prevent it..
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx if you can't kill them with HJT

You will also have to turn off system restore or you will get reinfected every time you reboot.

[Centurion]

That link just kills my internet.......

[keasy]

As I said, anything that is going to kill the malware it will block.

Wooster give us a link that says it's a fake. a fake what, entry ?


I think maybe that link is to process explorer is just confusing things for you cent, tbh m8.

Anything I can find says it prevents the pop ups and allows the downloading of anti malware progs when disabled.
Disabling it will do no harm anyway as it will restart on a reboot. so just hit end process Cent, don't do any permanent , to see if allows you to grab the links

[keasy]

I've sent you an email

[Wooster]

http://www.precisesecurity.com/files-process/2008/12/16/winscenter/
http://www.broadbandreports.com/forum/r21560969-HJT-Log-winscenterexe-Spyware-Guard-2008

It's part of the problem Cent has..

[keasy]

It's the stopping of the process in task manager not the deleting of the file.

[Wooster]

That isn't what I was talking about.
Cent was going to use winscenter.exe, I was advising against it since it is related to the problem he has, you asked for confirmation that it is, and I supplied it.

Process explorer was included because some malware will reboot the system when they detect a threat i.e related processes being shut down, Procexp allows you to just suspend the process and avoid the reboot trigger.

[Centurion]

I've got malware downloaded but I cart run it.....

[keasy]

Hijackthis ?

[Centurion]

It will not even let me do a search for that......Just kills the Internet link dead

Is it possible to delete it at source....In registry files...

[keasy]

A google search will find it m8

Can you google ?

[Centurion]

Put it in hit search & it kills it......

This is starting to piss me off