General stupidity

H

howthehellshouldiknow?

New Member
Hi Gang!

I'm not sure if this is an actual problem or if I'm just retarded. I got this message:

"Warning! Spyware threat detected! System error #1752

Your computer has several fatal errors due to spyware activity.
An unauthorized
access was gained by another computer. It is strictly recommended
to install an anti-virus software to close all security breaches.

They know you're using: Internet Explorer
Your computer is: Intel(R) Pentium(R) D CPU 2.80GHz, 2.00 GB of RAM

Risk status for further investigation: VERY HIGH RISK

To protect your computer from spyware attacks - click here
To erase the tracks of your internet activity - click here"

So this is just some crap to get me to spend more money on Spyware and Adware removal right? I already use McAfee and Ad-Aware SE Personal and I haven't had many problems so I'm not sure if this is serious or not. The annoying part is that this error message was displayed on my desktop and I couldn't get rid of it but I finally found the program through a program search and deleted it but now I can't select a desktop item anymore. No matter how many I select and apply it still shows the same boring beige screen. When I left click on the blank screen and check the properties, the same nonsense is still there!

"General - Not available
Protocol - File Protocol
Type - HTML Document
Connection - Not Encrypted
Address (URL) - file://C:\WINDOWS\warnhp.html
Size - Not Available
Created - Not Available
Modified - Not Available"

How do I get rid of this? Since I deleted the program I can't find it through a search through files and folders anymore but trust me, it's still there!!!!!

Thanks!
 
Geoff

Geoff

VIP Member
Try running your anti-virus and anti-spyware programs. You may also want to try Spybot Search and Destroy.
 
Y

Yue

Member
i would say tht this should have gone into the computer security section, they will be able to help more.
 
T

terii

New Member
This taken from another site. Sounds like what you have.

"Warnhp.html - it's everywhere! All of a sudden, your desktop has been changed to a warning screen asking you to download all kinds of spyware programs. You have been infected with the SpyJack-F trojan. Here's how to get rid of it...

The SpyJack-F trojan copies several files to your computer and changes your desktop to a web page. Luckily, it also includes an uninstaller that gets rid of most of the junk.

To uninstall it, click Start, Control Panel, then Add/Remove Programs. Find the entry for "Internet Update" and uninstall it.

After that has completed, go back to the Control Panel and choose Display (it may be under the Appearance and Themes section). Go to the Desktop tab. Click on the Customize Desktop button. Next, go to the Web tab and uncheck anything that might be checked there (it will probably be called "security"). Click OK and reboot your computer.

Your computer may now be clean. But to be sure, you should go through the steps in our Get Rid of Spyware Guide. Go through each step carefully, and your computer will be free of spyware. Good luck!"
 
T

terii

New Member
Here is what Sophos has to say about that Trojan.

Troj/Spyjack-F
Summary
Summary Description Recovery Advanced Prevalence: low high
Name Troj/Spyjack-F
Type Trojan

Affected operating systems Windows

Side effects Downloads code from the internet
Installs itself in the Registry
Leaves non-infected files on computer

Aliases Trojan.Win32.Small.ev
Druogna

Protection Download virus identity (IDE) file

Protection available since 3 November 2005 21:34:45 (GMT)
Protection history Updated - 27 January 2006 03:13:48 (GMT)
Published - 3 November 2005 21:34:45 (GMT)

Latest protection included in our products from March 2006 (4.03)
More information on IDE files What are IDE files?
How to use IDE files
Get the latest IDE files


Description
Summary Description Recovery Advanced This section helps you to understand how it behaves
Troj/Spyjack-F is a Trojan for the Windows platform.

Troj/Spyjack-F includes functionality to download, install and run new software.

Troj/Spyjack-F may display fake infection warnings.

Recovery
Summary Description Recovery Advanced This section tells you how to remove the threat.
Please follow the instructions for removing Trojans.

Advanced
Summary Description Recovery Advanced This section is for technical experts who want to know more.
Troj/Spyjack-F is a Trojan for the Windows platform.

Troj/Spyjack-F includes functionality to download, install and run new software.

When Troj/Spyjack-F is installed the following files are created:

<Windows system folder>\intell32.exe
<Windows system folder>\oleext.dll
<Windows system folder>\oleext32.dll
<Windows folder>\uninstIU.exe
<Windows folder>\warnhp.html

The HTML file may be set as the background for Windows, and contains information alleging an infection. intell32.exe is used to display spurious infection alerts from the Windows task bar.

The following registry entry is created to run intell32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
intell32.exe
<Windows system folder>\intell32.exe

Registry entries are set as follows:

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\2
Source
131A6951-7F78-11D0-A979-00C04FD705A2

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\2
SubscribedURL
131A6951-7F78-11D0-A979-00C04FD705A2

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\2
FriendlyName
Internet Explorer Channel Bar

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\2
Flags
3

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\2
CurrentState
1

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components
GeneralFlags
0

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0
CurrentState
40000002

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0
Flags
2002

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0
FriendlyName
Warning homepage

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0
Source
<Windows folder>\warnhp.html

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\1
CurrentState
40000004

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Update\

Troj/Spyjack-F provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "Internet Update".

|Get reports on the latest virus threats delivered to your computer
 
You must log in or register to reply here.
Top