[RESOLVED] false windows update?!

Printable View

February 28th, 2006, 04:19 PM
judge john

2 Attachment(s)

[RESOLVED] false windows update?!

hi,
when i booted up my computer this morning i got the usual message saying that windows updates where available. so i clicked install as usual only to suddenly get a message saying i have spyware. then without asking me a program called 'spy falcon' was installed. this program would not remove and spyware as you had to pay for it. i tried to un-install it only for it to re-install again. and since then i keep getting 'balloon' messages from 'windows update' saying i have spyware and to download 'spy falcon' again. now i'm certain that some form of trojan spyware etc is pretending it's windows update and keeps installing things without my approval. also when i open up IE i get a new homepage 'http://www.necessaryupdates.com/'. and again this keeps trying to trick me into dl more stuff.
so i have ran Ewido and M$ anti-spyware. they keep picking up problems but after i remove them they seem to re-appear again. also i have ran the computer in safe mode, and the 'balloon' pop-up still appears telling me to dl stuff. i have also removed everything that shouldn't be there buy using HJT. but still no luck. any more ideas?

and hers a few screen shots to show you the problems.
February 28th, 2006, 05:17 PM
fink

Post the hijackthis log so we can see too. Sometimes things can be disguised to look like other, legit programs.

All of those warnings and popups (incl systray) are not generated by any real Microsoft/Windows security program or update... they're all part of some worm/spyware that you've apparently been infected with.

I'd also suggest having a look through this thread..

http://discussions.virtualdr.com/sho...d.php?t=167915

and doing anything that it suggests that you havent' already done.
February 28th, 2006, 05:24 PM
Triple7's

See link below:

How to remove SpyFalcon and dxmpp.dll
February 28th, 2006, 06:29 PM
judge john

1 Attachment(s)

oh, genius there Triple7's.
followed the link and all is now good. well that’s certainly been a bit of an eye opener today. i have had spyware, tojans etc before but that one was really difficult to get rid off. no matter how many different scans i did or files i removed it just wouldn't go.
just one strange problem left. for some reason my desktop has changed to a kind of 'classic mode'. not the menu's but the way the programs look. I’ll post a pic to show you. even if i apply the same theme as before it just changes the colour of the 'box's but then they become 2d again.
February 28th, 2006, 06:57 PM
fink

you could use system restore but be sure you restore it to a point *before* you got infected.
February 28th, 2006, 07:06 PM
judge john

well it seems i can get the normal windows themes to work fine. it's just the custom one i was using keeps re-setting windows to 'classic mode'. so i think it may be something to do with that rather than windows. I’ll look into it further. anyway cheers for the advise.
March 1st, 2006, 08:09 AM
Triple7's

Quote:

just one strange problem left. for some reason my desktop has changed to a kind of 'classic mode'. not the menu's but the way the programs look.

When you went to the download link for the smitRem tool, under "usage instructions", it does say that will happen.
Have you tried just simply saving your custom theme (save as) with a different name?
Might be all it takes.
March 1st, 2006, 08:58 PM
judge john

unfortunately that doesn’t seem to work. the themes are just acting strange. when ever i re-start my computer the menu bar and quick launch icons are just a bit bigger. and even when i change them to normal it all re-sets once i re-start. what confuses me is why what i did caused this?