[moonlite]

My PC has had some spyware for some time but I ignored it. Lately, I have been getting tons of pop ups and warning messages from Windows of possible viruses on my computer. Running a check showed tons of viruses and spyware. The situation now is so bad that I can't even get on the internet. They want to charge me $199 to clean it up. I am wondering if there is something cheaper, like a virus removal tool that I can purchase that will do a good job of removing spyware and viruses, especially Trojans. I'm running Windows XP. Thank you.

[StaticFX]

There are many FREE ones.

Download and run as many as you can

1st: download/install/run Malwarebytes.org (do a FULL scan.. it will take a while)
2nd: Spyware Fighter: SUPERAntiSpyware Home Edition (free version)
3rd: Spyware Fighter: Dr. Web CureIt

Post back after... if those don't get them all, you will need to run HIJACKTHIS and post the result so we can take a look at what's running still

[moonlite]

Thanks for the response ! As I stated, I am unable to get on the internet now so I can't get to these free programs. The message I get every time I try to connect to the internet is: "the web site you are trying to reach is probably blocked by adware or spyware. You must purchase Windefender 2008 to clean up your PC". I don't know about you, but I hate to purchase things under these circumstances. What these jerks are saying is: You must buy our software if you want your computer back. I am using my laptop, but my PC is out of commission. Please help with more ideas as to how to get around this !

[StaticFX]

aha.. OK

I assume you are at work or something? (cause you are on the net lol) print this out


1. Temporarily Disable System Restore (Windows Me/XP).
----[how to]-------------
1. On the Desktop, Right Click on My Computer
2. Select the System Restore Tab
3. Mark the "Turn Off System Restore" to disable and UnMark to Enable
4. Click Apply on the Bottom of the Dialog Box to save the settings.
5. A message "This deletes all existing restore points" will appear, click Yes to disable.
6. Click OK.

2. Update the virus definitions. (if you have virus software)

3. Reboot computer in SafeMode [how to]
---[how to]-------------
1. During BootUp process Press F8 continuously until selection appears
2. Use Arrow Up+Down to select SafeMode on the selections menu.
3. Hit Enter to proceed.


4. Run a full system scan and clean/delete all infected file(s) (Antivirus)

5. Delete/Modify any values added to the registry.
---[how to]-------------
1. Click Start > Run
2. Type regedit at the box
3. Click OK

Navigate to and delete the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\”WinDefender 2008″ = “C:\Program Files\WinDefender 2008\WDefDemo.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce\”C:\DOCUME~1
\ADMINI~1\LOCALS~1\Temp\delwdef2008.bat” = “C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\delwdef2008.ba t”

Navigate to and delete the following registry subkeys:
HKEY_CURRENT_USER\Software\WinDefender 2008
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\WinDefender 2008
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\FwHookDrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F wHookDrv

6. Exit registry editor and restart the computer.

7. In order to make sure that threat is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with Online Virus Scanner.

hopefully that at least gets you to the net where you can download and run those other apps.

[moonlite]

Of the many web sites out there that offer free advice, I find this one to be the best in everything. Yes, your tips worked perfectly. I only used Malwarebytes and it did the job. Thank you so much for saving my PC AND my pocket book. I will send you a PM so please read it.

[Gho5t]

Most likely it was the same kind of spyware used by xpantivirus/winantiviurs etc,they install a (bho) browser helper object,wich is directing the browser constantly to their website.

[StaticFX]

HATE THEM!! They should be sued. I have wasted so much of my time removing them from friends pc's... GRRR!! Glad it worked!