Yeah, I know Norton is worthless but it came free. I'm looking for some free stuff to tide me over till it expires and I can get something worthwhile. But in the mean time a little help.

So I was browsing Vgchartz the yesterday and then all of the sudden my browser closes, my computer reboots and when it comes back I have a message from windows saying it blocked unathorized activity from a program called "Win32.netsky.q" but unless I buy their program it can't take any further action. Norton obviously sees nothing wrong. Every time I start up my profile (using XP) it tells me the same thing. If I try to log onto my firefox it says "don't do that, it's not secure" and if I try to go anywhere (even google to find something) firefox crashes. I'm on my wife's profile right now to try and find something. It's not giving me the warning or the crashes on her profile. I downloaded Avira for free and I'm scanning with that now, but I don't know if it will find it on my wife's profile, I might have to get back on mine for it to work, I dunno.

Apparently win32.netsky.q is a keystroke logger, takes pics of my screen and can possibly alow backdoor access to my PC. No idea how I got it because I was just browsing VGchartz and IGN, and wasn't downloading anything and I'm always careful about what I DL. But it's screwed up my profile on my PC, and I would like to get it off. So a few questions

1. Using XP, does it only affect my profile? I haven't gotten any warnings or problems on my wife's profile, but is it just not detecting it or does it just not affect a different profile?

2. Will I need to scan both profiles to find it?

3. How do I get rid of it if this Avira doesn't find it?

anybody? Any takers?

OFC!

Here, try SmitfraudFix from S!ri

http://siri.urz.free.fr/Fix/SmitfraudFix.zip

1. Put in on your desktop, let it scan and save the log.

2. Reboot in Safe Mode by doing the following:

-Restart your PC

-after hearing the first beep, press F8 (or F5) several times

-instead of windows loading as normal, a menu should appear now

-select the first option, to run Windows in Safe Mode

-when you are at the logon propmpt, log in as the same user which you had done the previous steps with

3. close all windows and double click on the smitfraudfix icon that should be residing on your desktop

4. when it first starts, you should see a credit screen. Press any key to get to the next screen

5. now oyu'll see a menu, press 2 and then press enter to choose the option Clean (Safe mode recommended)

6. The Programm will start cleaning your computer and go though several cleanup processes. Could take a while. When it's done, it will automatically start the Disk Cleanup Programm.

7. it'll also ask you if you want to clean the registry? (y/n) . Press y and enter.

8. After all this, close all applications and reboot. You should get a notepad screen containing a log of all the files that have been removed from your computer. Examine it and hope for the best :3

Edit: oh yeah. Don't load anything or click on any links it suggests you to solve the problem.That's a trap. Your trojan belongs to the smitfraud group and will just continue to load more crap on your pc until the universe explodes.

^ and if that doesn't work, blow it up

eh, that file you recomended me EBB had viruses according to both Norton and Avira every scan I just did on it.

ok, so reading up on smitfraud, the virus I have isn't a keylogger/backdoor creating thing, rather it's something that pops up to tell me that's what I have so that I go to a linked "official windows" site in order to purchase or download software to "remove" it, but that is the trap in itself.

Actually, it might have been something called a "Zlob". My norton actually just caught something called Zlob, and looking at it's wiki page it does the same thing. It tells me that I have a virus, then it redirects me to a very official looking windows page and tells me to Download it to get rid of it. I hope that's it, because my antivirus caught that, but I'm scanning with some other stuff too to see if anything else comes up.

Does anybody know about Zlob? Does that sound plausible? if I had it, should I be worried about anything else?

The Smitfraud / Generic Zlob are basically the same thing. At least they do the same.

Smitfraudfix should fix them both. The file I gave you shouldn't contain any evil stuff, actually :o

I went through eight different virus programs, and the only thing that caught this terrible bug I had was Kaspersky. Its the best on the market, and it does have a free trial if you don't need it permanently.