Attack From Winantispyware

I forgot to copy down all that the anitspy detected,
one Win32/EIKernC:_RESTORE\TEMP\A01….

It fond and removed several things

Good.

Oh,and it found a couple called Worm/Klez_HC:\RESTORE\TEMP\A01…..

Oh,and it found a couple called

Worm/Klez_HC:\RESTORE\TEMP\A01…..

As long as it's cleaning them.

While I was taking time online to write down all those coded things to check and remove, that winantispy introduced itself into my laptop and restarted making everything I type in to unwrite. And it went back to jumping me back to my homepage. Before, when I managed to change my homepage, it would keep jumping me back to whatever was there first. Now I'm back at my desktop sending this info. It's going to be dificult finding a way to access anything in that laptop, like the hijackthis list after running everything you offered. Man o man, those people who do that winantispyware should be brought to justice. If they do not pay for it in this life, they will have to stand and listen to their verdict for robbing dedicated servants of God like me, of their time. I am seriously afraid for their eternal immortal soul. I keep praying, Father forgive them, I hope they have no idea the impact of what they are actually doing by it. I dont know when I'll be back to continue work here. I thank you So much for all you have tried so far.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

I already did all that before winantispyware jumped back into action. I ran all that did all that, but that virus is extreemly malicious. It seems to root itself deep into things that can not be removed, that keep restarting them self and that notify the ones in control of winantispyware when I'm online to reinfest .

LDT, Im on my other computer replying, do you know why I got like, 9 emails about your last message? I hope this virus is not trying to infect this computer. Like I was saying, I loaded and ran all you said, but came under attack. AAAHHHHHAAAAA!!!!!!! strap ma face to da side ofa hog an Roooool me inda mud

See if you can find a restore time when the PC worked. Click the Start button. Point to Programs, point to Accessories, point to System Tools, and then click System Restore. Choose Restore my computer to an earlier time, and then click Next. Click a day on the calendar, click the restore point description, and then click Next. Make sure you have closed all your files and open programs, and then click OK to close the dialog box. Click Next. Your system will revert to its previous settings,

I tried reseting it already to the date of the origin of the computer, it didnt help I tried that before coming here.

UNplug your internet connection before doing this.

Click Start, Settings, and then click Control Panel.
Double-click the System icon. The System Properties dialog box appears.

NOTE: If the System icon is not visible, click "View all Control Panel options" to display it.

Click the Performance tab, and then click File System.
Click the Troubleshooting tab, and then check Disable System Restore.
Click OK. Click Yes, when you are prompted to restart Windows.


Now run the AVG anti-virus Full scan and clean whatever it finds.
If anything is found and put in the Virus Vault, make sure you open Virus Vault, and remove the bad items.

Plug your internet connection back in.

In my siganture below you'll see Ad-Aware and SpyBot.
Download install and run both.

Here's how to run them:

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" entries "BLACK" entries and "GREEN" entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
– Click the Gear wheel at the top of the Ad-Aware window
– Click General > Safety & Settings: Check (Green) all three.
– Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

After doing All that last night, and retrying it today, before going online; so far, it seems to have worked; at k least to seemingl remove winat i mean winantispyware. As you can see, my keboard back h.RIGHT NOW WHAT I WRITE IS GETTING REMOVED

Are you using a wireless Keyboard by chance? If so, change the battery.

not using wireless. yesterday, while typing here, my words got unwritten. i have touchpad and attached keyboard laptop.

the attack unwrites my typi9ng. the back button on this laptop keyboard is no longer working. that problem began when winantispyware began

Search for and delete these files if found.

insthelp.exe
updater.exe
stera.exe
uwasffnt.exe
was6.exe
winantispyware2006freesetup.exe
wasffnt.exe
winantispyware2006setup.exe
was6chk.dll
uwas6chk.dll
shellext.dll
asagents.dll

%DESKTOPDIRECTORY%\ winantispyware2005scanner2222.exe
%LOCAL_SETTINGS%\ temp\ NI.UWAS6_0001_N91M1508\ setup.exe
%LOCAL_SETTINGS%\ temp\ winantispyware2005setup.exe
%LOCAL_SETTINGS%\ temp\ WinAntiSpyware2006FreeInstall.exe
%local_settings%\ temp\ WinAntiSpyware2006Setup.exe
%LOCAL_SETTINGS%\ temporary internet files\ content.ie5\ g5arw9mz\ winantispyware2005scanner2222[1].exe
%program_files%\ common files\ WinAntiSpyware 2006 Free\ uwasdc.exe
%program_files%\ common files\ WinAntiSpyware 2006 Free\ uwasers.exe
%program_files%\ common files\ winantispyware 2006\ was6cw.exe
%program_files%\ winantispyware 2005\ shellext.dll
%program_files%\ winantispyware 2005\ was5.exe
%program_files%\ WinAntiSpyware 2006 Free\ AsAgents.dll
%PROGRAM_FILES%\ winantispyware 2006 free\ insthelp.exe
%program_files%\ WinAntiSpyware 2006 Free\ shellext.dll
%PROGRAM_FILES%\ winantispyware 2006 free\ uwas6chk.dll
%program_files%\ WinAntiSpyware 2006 Free\ uwas6cw.exe
%program_files%\ WinAntiSpyware 2006 Free\ uwasffNT.exe
%PROGRAM_FILES%\ winantispyware 2006 free\ was6.exe
%program_files%\ winantispyware 2006 scanner\ shellext.dll
%program_files%\ winantispyware 2006 scanner\ was6.exe
%program_files%\ winantispyware 2006\ was6.exe
%program_files%\ winantispyware 2007 free\ was7.exe
%PROGRAM_FILES%\ winantispyware 2007\ was7.exe
%system%\ drivers\ _wff.sys
%system%\ drivers\ uwasfsd.sys
%SYSTEM%\ drivers\ wff.sys
%windows%\ downloaded program files\ uwas6y_0001_n68m1303netinstaller.exe
winantispyware2006freeinstall.exe
winantispyware2007freeinstall.exe