A very suspicious program called SpyDawn has showed up out of nowhere and my homepage is stuck to http://asafetynotice.com. What should I do to remove these? Please help, this is a brand new PC and I'm not too computer literate.
2007-02-16 18:26:03 · 5 answers · asked by Philip 1 in Computers & Internet ➔ Internet
Your computer is infected with a trojan called Zlob. Zlob hijacks your homepage to asafetynotice.com and generates warning messages to try and get you to buy fake programs such as SpyDawn, SpyHeal, Antivermins and others. Of course it is important to get rid of asafetynotice.com, but its just as important to also remove the Zlob Trojan that implanted it there. In my experience, a program called SpyNoMore is your best bet in removing the Zlob trojan. By removing this trojan, you will also get rid of asafetynotice.com. Another symptom of Zlob Trojan is that it generates fake warning messages like:
System Alert
Critical System Error
System Performance monitor warning
Security Alert: NetWorm-i.Virus@fp
W32.Myzor.FK@yf
http://www.spynomore.com/asafetynotice-com.htm
http://www.spynomore.com/spydawn.htm
http://www.spynomore.com/trojan-zlob.htm
2007-02-16 20:03:17 · answer #1 · answered by Anonymous · 0⤊ 0⤋
http://www.siteadvisor.com/sites/asafetynotice.com/summary/
how to remove:
------------
option #1
http://forum.securitycadets.com/index.php?showtopic=283
----------
option #2
http://www.2-spyware.com/remove-zlob.html
----------
option #3
download and install hijackthis
http://www.download.com/HijackThis/3000-8022_4-10379544.html?tag=lst-0-1
run hijackthis, save a copy of the log generated to your thread at
http://www.2-spyware.com/forum/forum8
(you will need to register, free)
where an analyst will help you step by step
--------------
upon removing this hijacker, you may encounter 'winsock'probelms,
visit
http://www.microsoft.com/windows/IE/community/columns/bugbusting.mspx
for details
---
---
---
This site is another player in a group of sites with the same scam. All of these sites are identical in appearance (see below) and a screen grab may be seen here:
http://sunbeltblog.blogspot.com/2006/10/new-new-security-scam-hijacker-sites.html
The site attempts to convince users that malware resides on their PC and contains prominent links to other sites that distribute well-documented rogue anti-spyware apps. If your Windows operating system does not have the most up-to-date security patches, then it is very likely that your PC will have malware after visiting this site, due to exploits used here.
If your PC has been victimized by the exploits on this site, the following site is a good place to start for information on how to repair it.
http://forum.securitycadets.com/index.php?showtopic=283
Exploit Prevention Labs' LinkScanner reports that this site and its clones (listed below) contain malicious code. All have ESTDOMAINS as their registrar and most are already rated RED by SiteAdvisor.
69.50.180.158 qnavigate.com
85.255.115.130 needupdate.com
85.255.115.130 securityfeature.com
85.255.115.130 warningmessage.com
85.255.115.131 syserrors.com
85.255.115.132 todaywarnings.com
85.255.115.132 updateyoursystem.com
85.255.115.133 perfectedsecurity.com
85.255.115.133 systemupdates.net
85.255.115.170 bestsecurityguide.com
85.255.115.170 systemsecurityindex.com
85.255.115.170 theguardservices.com
85.255.116.210 atotalsafety.com
85.255.116.210 atruesecurity.com
85.255.116.210 iesafetywarning.com
85.255.116.210 uptodateprotect.com
85.255.116.211 iesecuritytool.com
85.255.116.212 alldnserrors.com
85.255.116.212 allsecuritysite.com
85.255.116.212 awarninglist.com
85.255.116.212 idnserror.com
85.255.116.212 isecuritypage.com
85.255.116.212 iupdatepage.com
85.255.116.212 protectionwarning.com
85.255.116.212 topsecuritypage.com
85.255.116.212 youriesecure.com
85.255.116.213 asecureboard.com
85.255.116.214 aprotectedpage.com
85.255.116.214 asafetypage.com
85.255.116.214 assureprotection.com
85.255.116.214 esafetylist.com
85.255.116.214 esecuritynote.com
85.255.116.214 iprotectpage.com
85.255.116.214 isafetypage.com
85.255.116.214 protectionssoft.com
85.255.116.214 safetyhall.com
85.255.117.50 eprotectionline.com
85.255.117.50 safetyhomepage.com
85.255.117.50 securitynetpage.net
85.255.117.50 sysnetsecurity.net
85.255.117.50 sysprotectionpage.net
85.255.117.50 theuptodatesafety.com
85.255.117.51 anerrordns.com
85.255.117.51 atrueprotection.com
85.255.117.51 theuptodatesecurity.com
85.255.117.51 uptodateprotection.net
85.255.117.52 allsecuritynotes.com
85.255.117.52 asecurityissue.com
85.255.117.52 sysprotectionpage.com
85.255.117.52 theuptodatesecurity.net
85.255.117.53 safetypropage.com
85.255.117.53 safetyuptodate.net
85.255.117.53 sysnetsecurity.com
85.255.117.53 syssecuritysite.com
85.255.117.53 syssecuritysite.net
85.255.117.53 theuptodatesafety.net
85.255.117.54 alliesecurity.com
85.255.117.54 sysguardsite.net
85.255.117.54 updatestate.com
85.255.117.202 spywarequake.info
85.255.117.203 spywarequake.com
85.255.118.36 thesecuritypages.com
85.255.118.36 thesecuritypages.net
85.255.118.36 thesecuritytest.com
85.255.118.36 thesecuritytool.net
85.255.118.36 thessecuritypages.com
85.255.118.212 acegates.com
85.255.118.214 checkssecurity.com
85.255.118.214 cleansoftwares.com
85.255.118.214 entertainingzone.com
85.255.118.214 outgates.com
85.255.118.214 protectionszone.com
85.255.118.242 iehomepages.com
85.255.118.242 iesafepage.com
85.255.118.242 ieuptodate.com
85.255.118.243 esafetypage.com
85.255.118.243 eupdatepage.com
85.255.118.243 iesecurepage.com
85.255.118.243 iewarning.com
85.255.118.244 allprotections.com
85.255.118.244 ieprotections.com
85.255.118.244 safeiepage.com
85.255.118.245 protectionwarn.com
85.255.118.245 thesafetytool.com
85.255.118.245 yourieprotect.com
85.255.118.245 youriesafety.com
85.255.118.246 eprotectpage.com
85.255.118.246 esecuritypage.com
Some of these sites have thankfully since become inactive, but it is evident that the person behind them will continue to clone these sites as long as people keep falling for this scam. For more information, see:
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=43010
http://research.sunbelt-software.com/threat_library_search.aspx?s=Trojan.Win32.Puper
-----
ALL THANKS GO OUT TO 'Dean' for his knowledge and reference, I take no credit. http://user.siteadvisor.com/forums/member.php?u=758
2007-02-17 02:33:23 · answer #2 · answered by Legend 4 · 0⤊ 0⤋
Your PC is infected with a zlob virus. Use these scans to remove it.
All of these are ones that I personally use and all are free.After you install any of them,make sure you update them to get the full affect.
AVG anti virus/anti spyware remover.
AVG Removes I-Worm/Stration · BackDoor.Generic3.GBB and .GBC · Worm/Generic.FX · Exploit.WMF
http://free.grisoft.com/doc/5390/lng/us/...
Spybot - Search & Destroy detects and removes spyware, a relatively new kind of threat not yet covered by common anti-virus applications. Spyware silently tracks your surfing behaviour to create a marketing profile for you that is transmitted without your knowledge to the compilers and sold to advertising companies. If you see new toolbars in your Internet Explorer that you haven't intentionally installed, if your browser crashes inexplicably, or if your home page has been "hijacked" (or changed without your knowledge), your computer is most probably infected with spyware. Even if you don't see the symptoms, your computer may be infected, because more and more spyware is emerging. Spybot-S&D is free, so there's no harm giving it a try to see if something has invaded your computer.
http://www.spybot.info/
http://superantispyware.com/
SUPERAntiSpyware is the most thorough scanner on the market. Our Multi-Dimensional Scanning and Process Interrogation Technology will detect spyware that other products miss! SUPERAntiSpyware will remove ALL the Spyware, NOT just the easy ones!
Easily remove over 100,000 pests such as SmitFraud, Vundo, WinFixer, SpyAxe, SpyFalcon, WinAntiVirus, AntiVermins and thousands more!
2007-02-17 02:30:16 · answer #3 · answered by G 7 · 0⤊ 0⤋
The below link has the best information and easiest removal instructions for spydawn:
http://www.bleepingcomputer.com/forums/topic81275.html
The above guide uses SmitFraudFix which was designed to remove these types of infections.
About SpyDawn:
SpyDawn is a new rogue antispyware program that is installed when you install fake video or music codecs that are in reality Trojans. This infection creates fake security alerts in your taskbar as well. There is no need to spend any money on software to remove this infection.
2007-02-17 07:31:37 · answer #4 · answered by grinler 4 · 0⤊ 0⤋
Try spybotsearchanddestroy as well as adaware. Then, use AVG Antivirus. CONSISTANTLY!
2007-02-17 02:35:36 · answer #5 · answered by ? 2 · 0⤊ 0⤋