[Resolved] Spyware problem - savetheinformation

Hi: I'm so new to this, I have absolutely no idea where to even start. I was reading through some other qustions and help answers, and for several of the help instructions, I have no idea what it means, so please be patient with me. Anyway,. all of a sudden I keep getting "Critical System Warning" pop ups on my screen, simply when turning on my computer. Also, whenever I log on to the internet, I get redirected to other sites than my default. One that I noticed is "savetheinformation". I also have a blinking yellow triangle at the bottom right hand corner of my screen, and a "Security Toolbar 7.1". None of these seem to want to go away. I do use McAfee, as it is provided tome through comcast. Can somebody hep me?

Hello, and welcome to the forum.

My name is Simon V., and I'll be glad to help you with your computer problems.

Step 1

Download HJTInstall.exe to your desktop.

• Doubleclick HJTInstall.exe to install HijackThis.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in Notepad. Save it to a convenient location.

Don't use the AnalyseThis button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Step 2

Please download SmitfraudFix (by S!ri).

• Double-click on SmitfraudFix.exe. A screen will pop up. Select Option 1 (Search) by typing 1 and hit Enter. A text file will appear, which will list the infected files. Save it to a convenient location.
• The log will also be saved here: C:\rapport.txt

Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Step 3

Please download and install CCleaner.

• Open CCleaner. In the Left Pane, click Tools.
• Verify that Uninstall is highlighted in color, or click on it.
• In the lower right, click Save to Text File.
• Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
• You can leave the filename as install.txt.
• Click Save.
• Exit Ccleaner by clicking on the X button in the upper right of the CCleaner window.

Step 4

In your next reply, please post:

• the HijackThis log
• the SmitfraudFix log (C:\rapport.txt)
• the CCleaner Uninstall List

Simon: Thank you so much for attempting to help me - I truly appreciate your time. I was being a little antsy and kept searching for answers. I stumbled upon Geeks To Go, and there was a help topic for my problem. It instructed me to download something called Vundo. I fllowed all the instructions, and as of right now, I do not have any symptoms. However, if they occur again, I will come back and do all the things you instructed. I am so grateful that people like you are out there, to help people like me. I read through your instructions, and I think I will be able to follow them, should I need to. Omce again - thanks! Eva

Hi, I'm glad to hear your problems are resolved It can very well be there are still some things (files, registry entries) left on your computer. Absence of symptoms doesn't always mean your computer is fully clean. Should you feel it's necessary to clean those up, I will be more than happy to help you. If you are happy with the way your computer is currently working, this topic will be locked, and you should create a new topic if/when the symptoms reappear.

Simon: Yes, I'm done with this for now (read: sick and tired of it…) so go ahead and lock the topic. I have printed your instructions, so if I need to come back, I will run all the logs first so I can post them right away. Thank you

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.