Crazy Virus?

[Timothee]

I don't know if this is all part of the virus - but I started getting a message from the toolbar with a green wheelchair symbol telling me my computer was infected - i thought that was weird because none of my anti virus programs had said anything. It said to click here for suggested sypware and malwear removoal tools. All the suggested ones I had not heard of and they all looked suspicioulsy familiar + plus they all cost $40. I tried running windows protector and adaware but they found nothing - i then used a regcleaner which didn't seem to fix the problem either. I'am also getting messages saying that sites are trying to access other sites and when i launch explorer i get this page:

http://www.securitysafeguards.net/

And on it it says this at the top:

Attention! Your system is under control of remote computer with IP address 227.4.167.118. The remote computer has access to the following folders on your PC:
- \WINDOWS\System32
- \Program Files\Internet Explorer
- \My Documents
- Drive C:\ files
Click here to download official anti-spyware software


If someone could point me in a direction that can fix this i'd be very grateful - as at the moment whatever it is is dodging every detection / removal program ive used. I'm running Avast! Virus Cleaner right now.. so.. here's hoping...

Tim

[polonus]

Hi Timothee,

Yes you have fallen victim to a rogue program or scumware, SpyTrooper, part of the smitfraud group of malware vendors.
Look for instructions here:
http://answers.google.com/answers/threadview?id=703813

Install siteadvisor as an add-on for IE or FF, or download the DrWeb hyperlink pre-scanner add-on for your browser to stay away from rogue programs and spammers.
After your comp is cleansed, install one good resident anti-virus program (Avast), scan occasionally with a good online scanner like Bitdefender, have one good software firewall like ZA for instance, install the three anti-spyware programs recommended: Spybot S&D, SpywareBlaster and Ad-Aware (all free), scan occasionally with spyaudit online scanner for ad-spyware and tracking cookies. Surf safe, stay malware free, is the wish of,

polonus

[Timothee]

Cheers for the speedy reply.
I haven't read it yet though, I thought I would first mention that using ToolBarCop it seems that the file is:

 system32\hpA410.tmp

when I delete it and refresh the list it is back again - ill now go and check out those instructions.
thanks.
Tim

[FreewheelinFrank]

The tool to use for smitfraud is smitem.exe:

http://noahdfear.geekstogo.com/

[Timothee]

Using the links you gave me, I'm now virus free.

thanks a million
Tim