Pcprivacycleaner virus alert, no kidding

[quintinius]

ok so i booted up my windows xp home computer today and BANG i get bombarded with pop ups saying im infected with viruses and need to download this that and the next thing, yeah well close close and close then i click on the start menu and i cant get into my computer,control panel anything so i open the internet to run a search on this thing and then i get a new home page saying i need to download anti privacy things because im being tracked ok so now im like ok wtf!

basically its another of these bogus secruity things and i cant get rid of it, i have been trying to use avg and tis goin really slowly another site said use spyhunter, but you need to pay for that and im not paying for something over the internet on a computer that is loaded with viruses. if any1 has had this thing before and knows how to get rid of it please please tell me, i tried to get into safe mode but whent he option came up my keyboard was frozen this is my dad's computer so its alright the thing is called
Pcprivacycleaner (yes all1 word) and it is rly annoying me PLEASE HELP

[joz12345]

my mum had something similar, but she took it to PC world before i could take a look: it cost her £50 just to reinstall windows!!!

I would try spybot search and destroy, thats a decent free anti spyware program, and it might be able to clear it for you.

If that fails, you could try add/remove programs, searching for pcprivacycleaner, and deleting all the process files, then... ok, im gonna google it:

Just follow the steps here
LOL,

PCPrivacyCleaner is usually promoted via a Zlob Codec installer found on adult websites

If you dont feel confident enough, then reinstalling windows is always an option, just put in the windows disk, go into your bois/setup screen (normally delete or an f key) and change your boot device to a CD, then reboot, and follow the instructions.

[graystreet]

Are you able to install programs still?

If you are I'd recommend Superantispyware.

[quintinius]

ok i got rid of it with spybot, took a while but i think i did something very silly...when spybot destroyed it all i believe it allowed me to access all my documents again and i clicked deny change (because i thought it was trying to reinstall) so does anyone know how i can undo this? thanks alot guys been very helpful

[sammyc]

^
have you already tried this... from the tutorial (have not needed to reverse a change myself so can't say if this is all you'd need to do, though. )

Of course it is possible to revise each of your personal decisions. That could be necessary if you have denied some process which turns out as a good one later. You do so by right clicking on the TeaTimer symbol in the system tray - it is the blue one with the lock. (If you cannot see the symbol, it is probably hidden. Just click on the arrows in the system tray to show all hidden symbols.) A window appears where you have to click on Settings to modify your personal lists of registry changes and processes.
[from FAQ] ....How do I edit the Black & White list in resident TeaTimer? FAQ #005
Please right-click the Resident icon in the system tray Spybot S&D resident and select Settings. There you will find four lists for remembered decisions (allowed/denied processes and registry changes). In order to remove an entry, just click on the cross next to it. TeaTimer will then "forget" this decision and you will be asked again the next time.

[quintinius]

im really getting sick of this i think im just gona take it to the shop and if he has to wipe the memory its worth it, thanks for the help guys and sorry i couldnt find the tea timer thing but i think i may have dug my own grave with that i reinstalled spybot s&d after i deleted the virus becoz i thought it might ask me again so tht was a stupid move, i can now access mycomputer/mydocuments i opened up nero photosnap viewer clicked open and dragged my computer onto my desktop
thnx anyway guys you all get my thanks

[RoBe]

i had a similar problem with my dad's pc. I just used the kaspersky online scanner (http://www.kaspersky.com/virusscanner) and deleted all the reg entries/files that it picked up.

worked a treat

[sammyc]

Originally Posted by quintinius

i couldnt find the tea timer thing but i think i may have dug my own grave with that i reinstalled spybot s&d after i deleted the virus becoz i thought it might ask me again...

Sorry this is bugging you (here's how to find the tea-timer anyway...
run Spybot, go to Mode & click Advanced; then Tools, near bottom of left hand panel, then click Resident & see if both the Resident SD Helper and the Resident Tea-Timer boxes are checked. Then return to default mode & look for symbol in the system tray.)
Good luck whichever way you decide to sort it.

edit: re-reading your post; if you have re-installed SpyBot, it will not have a memory of the initial virus deletion, but this info might be useful for future ref....

[hippoman]

I'm not a massive fan of tea-timer. It's fine if you understand what it is doing, but a lot of users will tend to just allow everything, or block everything, with the obvious consequences.

If you are ever trying to get rid of nasties a very basic tip is to get a decent antivirus scanner, decent spyware scanner (spybot s&d is my usual choice but i don't install teatimer). Get them all up to date (if you can't update in normal mode you should be able to download the manual update files and update in safemode).

boot into safemode (this stops a lot of processes on startup which could interfere with file cleaning) and scan with both scanners - clean/fix all problems.

boot back into normal mode, scan again. if nothing is found there's a good chance you are clean. If anything is still detected you probably have something a bit nastier and it will take a bit more attention but at least you will know which nasty you are working against (as it will be the only one to come back).

[sammyc]

I to your superior knowledge on the teatimer.
..For my own information, are the steps I suggested correct as far as it goes (ie use of teatimer to locate/reverse an original allowed/denied SpyBot process) even if not necessarily the advice you would give?? Thanks...

[joz12345]

did the teatimer say it deleted or added values. If it deleted values, then you have stopped the anti spyware software from deleting it properly by denying the registry change, so you shoud try to reverse that. If you reinstalled spybot, you will have to scan and remove it again. If it added values, it is the spyware trying to reinstall itself, so just leave it, although i think its probably the first one considering that you still have problems

edit: i edited to stop myself looking stupid, i didnt realise he had reinstalled spybot s&d

[hippoman]

sammyc - if teatimer is running it will have systray icon. you can check to logs here and see what has been blocked etc. I'm not sure if teatimer can reverse decisions (i try not to use it) as it seems to try and get permission for changes to the registry (so they either occur or don't occur) rather than something like zonealarm (which has similar alerts) which is allowing or blocking a port and all future access of that port. I'm not certain though.

I had a machine in today which was utterly riddled with viruses (appeared to have originated from the ups email virus issue going around). I noticed teatimer on there, checked the logs and there was an allow for the initial virus process (burito.exe) on 27/7/08. By the time I got my hands on it the machine wouldn't run any .exe files and took a few hours to get clean again. My point is that although this software does exactly what is supposed to it is relient on the user making the correct decision.

[sammyc]

Originally Posted by hippoman

sammyc - if teatimer is running it will have systray icon. you can check to logs here and see what has been blocked etc. I'm not sure if teatimer can reverse decisions (i try not to use it) as it seems to try and get permission for changes to the registry (so they either occur or don't occur) rather than something like zonealarm (which has similar alerts) which is allowing or blocking a port and all future access of that port. I'm not certain though.

That's what I was sort of getting at in my first post; it should be possible to reverse a decision with the teatimer AFAIK, I wasn't sure how you would go about it if you were the OP & hadn't got teatimer running.
I take your point about teatimer & why it isn't the best way to go, I was just wondering if the advice I gave was at least technically ok...

[quintinius]

lol yh the only things that is kinda annoying me is it disabled the sound card or something :S and i cant get into my C drive ¬¬
but i rly dont think i have tea timer i cant seem to find it:/

[CrazyMonkey]

This still happening?

Sounds like a smitfraud infection. Here are some steps.

Download http://www.bleepingcomputer.com/resources/link243.html Smitfraudfix.

# Next, please reboot your computer into Safe Mode by doing the following:

1. Restart your computer

2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

3. Instead of Windows loading as normal, a menu should appear

4. Select the first option, to run Windows in Safe Mode.

5. When you are at the logon prompt, log in as the same user which you had done the previous steps.

# When your computer has started in safe mode and you see the desktop.

# Close all open Windows.

# Now, double-click on the SmitFraudfix icon that should be residing on your desktop.

# When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen.

# Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).

# The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program.


~~ This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will should continue with the next step. ~~

# When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the enter key.

# When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.

# Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer. Post the contents of this notepad file here.

[quintinius]

now seeing as its gona tell u all my web stuff im not gona post the thing here, but it did fix everything tyvm