SpyQuake

[ChrisHarris]

I got hit today. It was my own fault though.

I've been upgrading my hard drives, and I'm installing XP Pro on all of them, along with Norton Antivirus and Norton Internet Security. It works good, if you keep it updated. Well, these are old versions of the Symantec software (2004). I usually load it up and then go straight to Live Update and get it all current and up to date.

I didn't do that today, after adding another HDD. STUPID STUPID STUPID

I loaded all the software on the drive and went surfing. I clicked a link that took me somehwere I DID NOT want to go, and I was instanly bombarded. I jumped up and yanked the power cord out of my DSL modem, but it was too late. I got some kind of horse **** called SpyQuake.

It installed a couple programs on my 'puter that kept hassling me about spyware. How ironic is that? This thing attacked me, drilled itself in, installed itself, and then told me that I was at risk for spyware and I should purchase their software.

It totally corrupted my Internet Explorer program. It changed my home page to w-w-w DOT bestsecurity DOT com I could NOT alter my home page settings either. I tried several times, but every time I opened IE after that--it went straight to that site and would not let me navigate anywhere else.

I got mad. Downloaded Seek and Destroy. Ran it. Found 7 bad files. Was able to delete all of them except spyquake dot exe. MFers!!!!!

I went into regedit and went to local user. Got down in there and deleted a couple files related to this virus/spyware--whatever--cr@p. Still couldn't get rid of it.

Tried to update Norton products, but was getting dumped off the server--suspect it was the spyquake.

I ended up reformatting my drive--total format. Reload the whole OS, all my other drivers and software. Went straight to Symantec and updated everything. Then downloaded Malicious Software Remover from Microsoft. Downloaded Windows Defender.

Clean now--but what a waste of 6 hours.

Thats was a valuable lesson. Stupid way to learn it--but valuable.

 

[mrgeorgedude]

makes u just want to strangle the people who created the virus doesnt it?

 

[ChrisHarris]

Strangle?

I've got a sawed-off 12ga tactical shotgun with an 8 shot extended tube mag and a side saddle that holds 6 rounds too. Pistol grip and a strap.

Similar to this--but add a shoulder strap and a side saddle:
http://www.thearmedcitizen.com/gunpages/mossberg.htm

I'd love to take off 1 limb at a time, untill I got to their balls, then use a rusty butter knife to castrate them before I put 1 final 12ga slug in their head to end it.

Strangle--no. Thats too personal.

MFers!!

 

[mrgeorgedude]

Strangle?

I've got a sawed-off 12ga tactical shotgun with an 8 shot extended tube mag and a side saddle that holds 6 rounds too. Pistol grip and a strap.

Similar to this--but add a shoulder strap and a side saddle:
http://www.thearmedcitizen.com/gunpages/mossberg.htm

I'd love to take off 1 limb at a time, untill I got to their balls, then use a rusty butter knife to castrate them before I put 1 final 12ga slug in their head to end it.

Strangle--no. Thats too personal.

MFers!!

lol...wouldnt wanna mess wit u now...especialy the rusty butter knife part *shrudders*

 

[Motoxrdude]

Yuep, i have gotten plenty of that crap before, lol, it sucks.

 

[Buzz1927]

I don't think Norton would have helped you. If you'd come here when you first got it, you'd have been clean in about an hour.

 

[ChrisHarris]

I don't think Norton would have helped you. If you'd come here when you first got it, you'd have been clean in about an hour.

I think Norton does a darn good job under normal conditions. My problem here was that I hadn't updated it and I was using virus definitions that were 2yrs old.

I normally keep it updated daily, and I've never had a problem before. I run Windows Defender and Malicious Software Remover all the time and they never find anything. But, thats before I added the new drive. And, thats with everything updated.

My Norton alarm goes off all the time. It's constantly hamering on torjan horses and worms. I have it set up to tell me anytime there is an attmept on my system. It goes off at least 3 times a day. So, I know that it's catching stuff and blocking it before it gets in. I run the Windows Defender software and it never finds anything.

I know a lot of people slam symantec. I think thats only because it costs money. You can download free stuff if you want. I really know that it works right, if I just keep it updated.

 

[Buzz1927]

I wasn't slagging off Norton as such, whatever AV you had, it wouldn't have helped for this particular infection, it changes so often that the AV companies can't keep up.

 

[Sweetness]

Buzz Help!!! lol

I don't think Norton would have helped you. If you'd come here when you first got it, you'd have been clean in about an hour.

Hey Buzz,

I noticed you told Chris that if he had come here before he did all the things he did to fix the spyquake problem you could have helped him get it done in an hour....well....help!!!!!!!! lol My friend has that damn thing on her puter and we have tried a couple things and they didn't work...tried going to Trendmicro to run a scan and it wouldnt work...tried doing an XP system restore...nope! wouldn't work and the poor thing even went and downloaded a supposid FREE program to get rid of the spyquake and of course once it ran and found all kinds of crap it told her..."now if you want to get rid of all this? you gotta pay!" I KNEW that would happen!

I was away last night and couldn't help her with new ideas on how to get rid of this thing so she bought the program that said it would take care of this problem ....eehmm....NOPE! it didnt!!

Could you explain to me how to help her out in getting rid of this thing??? I would rather not have to get her to format her drive and reinstall everything...we are doing this all over the phone and its tough to help someone who doesn't know much about computers and the helper is NOT a pro really either LOL

Thanks in advance for any help!

 

[Mr.Cool]

I got the same thing last night and I stayed up till four AM working on it there was a program that got rid of it, but I don't remember what it was called. If I remember I'll tell you. Mabey someone knows of it, the icon is a stop light and I belive it had an x and a 1 in the name. anyone?

 

[Platinum]

Buzz is unavailable as he is very busy IRL. If you need help, please psot your concerns in the Security forum along with a HijackThis log.

It would be much appreciated if you could please download HiJackThis and post a logfile. To do that, please follow these steps:

1. Download HiJackThis.zip
2. Unzip it to a permanent directory. This will keep HJT and its backups in a common place. A very good place to put it is C:\HJT
3. Open HiJackThis.exe and select the option to "Do a system scan and save a logfile"
4. A notepad window will popup with all the information I need. Please paste its contents in a reply to this thread.

Note: do not attempt to "Fix" anything, as we need to see the entire log.
Also if you have any Startup items unchecked in Msconfig, check those items, reboot, then post a fresh log. HijackThis can not "see" disabled items in Startup.