Spyware/Virus assistance please

[iradney]

Ok.
I somehow have spyware/virus. I have a small idea of where it came from, and have blacklisted that site in my mental bookmark list.

I have tried:
F-Secure (Company anti-virus) - Simply will NOT run a scan
Ad-Aware - Scans, removes some stuff, reboot, same shit
TrendMicro Housecall - Doesn't seem to find anything
Hijack this - refuses to run
Spybot - refuses to run

I've rebooted numerous times, and keep getting the following speech bubble:
(Error2.jpg is the bubble). If I miss the red X to close it, I get a DOS window with the next error (Error.jpg).

I'm running a Compaq nx6110 Laptop with MS XP Pro, 2002, SP 2.

Standard apps include IE Explorer, Mozilla, MS Office, MSN Messenger, Pandion (In house chat app), Adobe, F-Secure, Intervideo, Sony Ericsson PC Studio, Record NOW! CD & DVD Recording, Sonic.

I am getting a new work laptop in a couple weeks, but this is getting highly annoying, and even though I've been bugging the IT guy to fix it, he's never gotten around to it, and I leave tonight.

No-one's reported getting weird emails from me with removed attachments, and my PC's performance (shoddy as it is) doesn't seem to be affected, but the bloody bubble is getting on my nerves, and I'm kind of wondering if it's not some sort of time bomb.

[LostMyMind]

You got a pretty nasty one. It's a fake pop-up scam virus. It's trying to get you to buy a fake anti-virus that does nothing.

It's preventing many things from working. have you tried renaming hijackthis.exe to a weird name. like yousuck.bat (bat instead of exe). And see if that will let it run. Once you get it to run, you should see it pretty quickly (hopefully). Tell hijack this to fix it and then try to get the virus scans to run.

[Pedersen]

Yuck. You've got a nasty little bugger. It's name is WinReanimator. Here's a page that details how to remove it:

http://removal-tool.com/winreanimator/

Note that none of the normal tools seem capable of doing so (and I just spent about 15 minutes looking for removal instructions). I don't know the programs they recommend, so would do it manually.

Of course, due to the detail involved, I would recommend getting your local IT guy to carry out the steps they list. This one looks like a real bitch to get rid of. Good luck.

[Eben56]

Major Suck.

A little late, but I use AVG and that looks very much like the intrusion it stopped for me last week. Probably not the same thing but my recollection of the info behind the virus was very similar.

Good luck

Gawd, wurnt I helpful?

[Crazeyal]

Anyone catch the PERVENT data loss :lol:

[MrWags]

That is a nasty bugger.

http://www.broadbandreports.com
This site is a very good resouce on cleaning up and securing your pc, with some top flight pros there.

[LostMyMind]

Probably so they wouldn't get hit with false advertising. You know, those weasels :lol:

[MadMike]

Have you tried running any of these in Safe Mode? That worked for me when I had something that was blocking the utilities I'd normally run.

[sld72382]

The best thing to do in a case like this is to run these specialized tools:

Smitfraudfix: http://siri.geekstogo.com/SmitfraudFix.php

SDfix: http://downloads.andymanchesta.com/RemovalTools/SDFix_ReadMe.htm

Antipuper: www.precisesecurity.com/adware-spy/spyaxe-antipuper.htm

Vundofix: http://vundofix.atribune.org/

Run them all in safe mode and see how your system performs then.

[Geek King]

I have a lot of luck with the mentioned SmitfraudFix, then running Malwarebytes.org Anti-Malware (latest version). The two in combination usually clean those bastids out fairly well.