spyfalcon popup?

[æArchOAngelæ]

ok well im on my friends pc and he keeps getting this pop up saying his pc is infected and uses a windows update symbol with a ! mark on it and it wont go away u cant right click it and when you do it opens a website up saying you have to purchase it. i found the directory and deleted it after uninstalling it then i empty the recycling bin. then i restart
when it boots back up it will appear again and install it again. then i ran disk clean up and delted all the crap (temp folders...) and then i reboot it came up again. and the pop up thing at the system tray will not go away no matter what. ive ran virus scans and all. ive ran ms config couldnt find it. so i am going to post a pic of his pc peformance task manager showing system apps running. please help us. if anyone has had this problem help please!!!

he doesnt know when it appeared or anything or hwo he got it.

his system specs.

some chaintech mobo skt 939 amd athlon 3200 6600gt pny 40 gig C drive and a 120 gig Slave windows xp SP 2

 

[KSoD]

Are you sure its SP2? That sounds like one of those pop ups that come from a non-sp2 system. Anyway you can get a screenshot?

Other than that best thing is to try Windows Defender.

 

[æArchOAngelæ]

yeah gimme a min yeah im pretty sure is SP 2. its really gay it wont go away ill post pic in this reply when i get it

 

[Osiris]

Follow these instructions carefully

Download ALL 4 programs and update them as soon as they are installed, this is very important, except for Hijackthis!.

Ad Aware SE Personal Free

Spybot Search and Destroy Free

Microsoft Antispy

HijackThis Free

Ewido

Follow these steps

Delete the prefetch folder C:\WINDOWS\Prefetch, this folder will come back on next reboot.

Delete all cookies and temporary internet files in the control panel.

Go to Start, run, type msconfig, go to startup, disable everything except your antivirus, click apply, dont reboot yet.

Download Msconfig Cleanup below

Msconfig Cleanup Free

Run Msconfig Cleanup after you unchecked the items you were told to uncheck and recheck, click "Select All", then click "Clean up Selected", then click "Quit".

Now run each spyware program 1 by 1. Running all 3 at the same time will slow most systems down.

When each program has finished scanning, remove everything.

For Microsoft Antispy, after it has finished scanning, some items will/might be on ignore, you will need to select remove unless the program is valid such as VNC Viewer, etc.

Now go to the recycle bin and delete everything that is in it.

When finished with the scans, reboot, and go into Safe Mode and run these scans again, remove everything they find, and then reboot back into Windows in normal mode. You dont need to run Hijackthis! yet.

Then run HiJackthis!

Save the log, copy and paste the log on www.techist.com
Do not attach the log, copy and paste always. This will make things go much faster.

 

[æArchOAngelæ]

this is taskmanager open

 

[Osiris]

did you try what i posted?

 

[æArchOAngelæ]

yeah but i found the program, i knwo which one it is but it wont delete it so im going to try in safemode ill reply when its done

 

[Osiris]

maybe ewido can remove it

 

[æArchOAngelæ]

yeah it worked ewido on safemode did it. thanks guys specially warez monster

 

[Osiris]

you might want to post a hijackthis log just incase.......