Home » Unwanted Programs » Spyware.Cyberlog-x

Spyware.Cyberlog-x

16 October 2006

Spyware.Cyberlog-x is a detected threat for a fake anti-spyware product that is normally bundled with different trojans embedded on Media Codecs as a way of installation.

Risk Level: Medium

File Size: Varies

Affected System: Windows

Common Symptoms:

1. An alert on taskbar about a detected threat on computer.

System Alert: Trojan-Spy.Win32@mx. Type: Spyware/Trojan.
Critical System Error! System Detected virus activities. They may cause critical system failure…

86 Comments »

1 }

Seta said:

Sometime the reason why some spyware remover can’t read it is because the virus sneeks in and it will act like a backdoor trojan. The best program to get to detect it is symantec. My friend gave it to me and I ran it and it scanned and found it. After the symantec found it, I downloaded systemdoctor, and it got rid of it under 10 min. This will work for DSL modem and cable.

22 March 2007 at 4:38 pm

2 }

webmaster (author) said:

Hi Robert,

Have you tried the Smitfraud Removal by Siri?
http://www.precisesecurity.com/blogs/2007/06/20/smitfraud-removal-by-siri/

6 July 2007 at 3:21 am

3 }

Connie said:

Yea, the SmitfraudFix worked. THANK YOU, THANK YOU. I bought Norton for $91 last night that didn’t work – their online consultant wanted another $99 to go onto my computer and fix my registry. I decided to do an internet search for help and found this. It’s gone. Hopefully it will stay gone.

23 September 2007 at 12:14 am

4 }

Reefer Man said:

Another thing to try is:

1 – disconnect your computer from the internet.
2 – start up in Windows Safe Mode and run your anti adaware programs.

16 October 2007 at 3:01 pm

5 }

anTrax said:

Hey! The best solution for removing the CyberLog X vyrus is to format your computer. :D Just Kidding :P try the Noadaware. It’s free and i have managed to remove the virus. Have Fun!

17 October 2007 at 6:29 am

6 }

black_interceptor said:

you can use superantispyware professional to remove this spyware. its free for 15 days. ITS WORKING GOOD!!

27 October 2007 at 3:01 am

7 }

Rich said:

My computer has this virus. Lots of pop-up balloons and it even adds two shorts cuts to the desktop (one for Online Security Guard and one for Live Security Center)

I have tried AVG, Symantec, AdAware, Spy-Bot and Smitfraud, and nothing has worked.

10 November 2007 at 4:11 am

8 }

FU84R said:

I have used TWEAKNOW POWERPACK 2006, after trying system mechanic, spyware doctor, adawareSE, of which only tweaknow worked, i ran the registry cleaner an walah, GONE!!! maybe another reg cleaner will work. :s not sure :s

13 November 2007 at 12:20 am

9 }

Ozzie said:

I just Removed this Virus
If Someone Really Wants to Remove this Use Super Anti Spyware Full Scan & Restart

13 November 2007 at 6:20 pm

10 }

bl00k said:

Does anyone know how this gets onto a machine? I avoid questionable websites as much as possible, don’t surf pr0n, haven’t been downloading warez or anything. I got this on my Work laptop, which I try to keep as clean as possible. AdAware did not work to remove it. I’m trying the Super Anti Spyware now, but just want to know how to avoid this bugger in the future.

16 November 2007 at 7:42 pm

11 }

Justin said:

Well Super Anti Spyware full works for me !

18 November 2007 at 5:18 pm

12 }

Mike said:

Hey everyone…

much like everyone else, I came here to get rid of this dumb ass spyware shit… The best program out there for anti spam / Antivirus is called ESET.
http://www.eset.com
but my version got screwed up by windows defender(which blows) I am currently working to rid my computer of this spyware.. If i come up with anything I will re-post…

I am trying some spyware removal sofware that Eset offers for FREE on their site…

22 November 2007 at 11:26 pm

13 }

Van said:

i think i fix mine , i dont think i have anyspyware on it

but i fix my Dads laptop

First get this programs
*Spybot serch and destroy
*Ad aware Se
then use them ,once you finish
turn off your computer, and turn it back on
then at the begin go to Safe mode
go to Safe mode by pushing f8 around 6 or 9 times then its gone a take you to a black screen go to safe mode
and at the begin its gone a ask you that going to safe mode will stop using some programs ,, click yes and continue

then use the programs again
Spybot serch and destroy
ad aware se
and if you can use Windows defender

then clean everything ,
now go to programs file, and youll see a folder that cyberlog-x made its call videos ad-on
erase it and erase it from the trash can
(sorry for my bad English,im mexican and my computer its on spanish )
once you finish
shut down your computer by using the start button ,anytime you’ll come back it should be ok

this is other sintom of ciberlog-x

an add on the internet explorer bar
a pop windows
pop up critical dammage windows
and the yellow balloon down right

26 November 2007 at 4:43 am

14 }

Val said:

Super Anti Spyware worked for my computer as well!!

30 November 2007 at 9:23 am

15 }

Martin W said:

Yes – Video Add-on is the problem. I had this but thanks to Van it’s gone. This is how I got around the problem.
1. Located Video Add-on directory.
2. Open the directory and make a note of the files (in my case there were about 5 or 6)
3. At this stage you can not just delete the directory, so open Windows Task Manager.
4. Using list from step 2 End Process on those process. In my case I had several entries of icmntr.exe and icthis.exe.
5. You might have to use End Process Tree (right click on process) to kill of the threads.

Once I completed the problem was no more.

3 December 2007 at 11:01 pm

16 }

Satya Karri said:

I used smitfraudfix to remove the virus and now the system works much better.

6 December 2007 at 4:09 am

17 }

Bekah said:

Ad-Aware 2007 & McAfee didn’t catch or remove this. I took Martin W’s information for the file names (thanks!). Because the programs were running, I couldn’t remove them.

I started my computer in “safe mode” which didn’t allow the programs to start, found the “icthis.exe” and “icmntr.exe” files in the program directories, and successfully deleted them both.

The “warning” triangle is gone and, 24 hours later, I haven’t had one graphic pop-up displayed.

12 December 2007 at 3:25 am

18 }

Kimbell Brown said:

Glad I found this site, I also have the virus. I’m trying all the recommendations here. One thing for the folks who say they can’t access the web. Have yo tried using a different browser? I get the AVG pop up about the threat only when I run MS Internet Explorer. Forefox gives me no problem what-so-ever.

16 December 2007 at 8:56 am

19 }

Syfer said:

Being an IT person helps at a time like this. Trust me the steps i have written below have been tested out in 5 PC’s and none has given any sign of problems. This can be removed WITHOUT any extra programs installed on you machines. The method i use is as follows:

1. Disable the confimation from the recycle bin of your computer (right click – properties – uncheck “Display delete confirmation dialog” and then press “ok”)

2. Go and open “C drive – programme files – right click and choose “arrange icon by – Modified”"

3. Look for a folder created recently which will have a name similar to “video plug-in” and open that folder. It should be some where near the bottom right files. (the files are sorted according to the date they were last made changes to)

4. Next right click you task bar to get you task manager or press “ALT + CTRL + DEL” or “ALT + CTRL + DEL” and choose task manager (either one of these will bring up your task manager) and click on “Processers” Tab

5. Place the windows side by side (resize the program files folder to fit the screen with task manager)

6. Look at the folder you had opened for some files (programs) that are similar to the ones running in the task manager. (sorting by name helps)

7. Right click the file name that is similar to the one in the plug-in folder you have opened and click “End process tree” and then very quickly click on the file in the plug-in folder and press delete. REMEMBER to delte the file from the program file quickly or the process will start again in the task manager.

The file should go away without asking you with a yes or no alert box.

8. Do the same with the other two processes. then delete the folder from the program files and delete it from your recycle bin also.

Finished … now when its gone … you can enjoy the web browsing again. Good luck. contact me at gmail if you need anything regarding my method.

Syfer.Darknight

19 December 2007 at 10:47 am

20 }

Rahul said:

Thanks Van,Martin and Syfer!
I had this fake trojan on my laptop. I tried ur method and looks like it’s gone. But I still have pop up coming in taskbar. Other problems seems to have gone.

26 December 2007 at 8:26 pm

21 }

Dave said:

Thanks all. I used SmitFraudFix. Worked perfect. Everything gone. Followed the SmitFraud instructions to the letter and it worked.

8 January 2008 at 7:25 pm

22 }

KidRock said:

Thanks, I read your postings above and put together a total delete for free/do-it-yourself:

1) Start computer in “safe mode” which doesn’t allow the programs to start, find the “icthis.exe” and “icmntr.exe” files in the program directories, and delete them both.
2) Do an Advanced Search on “C drive” – use date created of today (if installed today) include system files, etc. Arrange search results by Date modified. Identify all files that were created by the installation (should all be within one minute (I deleted all files created at 5:57 p.m., for example). Highlight them all, don’t worry about prefetch files they can be deleted also, and delete all these files.
3) The only file that won’t delete is ictmdl.dll in c:\program files (the add on in internet explorer, hmm maybe it would if I didn’t have internet explorer open at the time) but skip this one for now
4) Run regedit (i.e. open Registry Editor) and delete the Video Add-on folder under Computer/../Software
5) Restart computer in “safe mode” which didn’t allow the programs to start, find the ictmdl.dll in c:\program files and delete it.

Done. This works. All removed for free/do-it-yourself.

9 January 2008 at 12:42 am

23 }

Wes said:

I downloaded the smitfraud program it appears to have worked!! thanks!

21 January 2008 at 3:47 am

24 }

Ggmzg said:

Thank goodness I have gotten rid of this virus
I started in safe mode and deleted the folder video-add on(C:programfiles) and now I can open IE and no pop-ups this far. I also deleted it out of the recycle bin before restarting my computer. No ballons either thanks everyone that help me with this problem. I hope that everyone can be successful, also.

24 January 2008 at 7:19 am

25 }

Lady DI said:

How did I get it and what happened next? I clicked on a link (using Fire Fox as my browser) in a Blog that was supposed to take me to a Daily Motion video. I thought the video needed the required software pop-up to view said video and whallah… I had over 12 pops and a flashing warning icon to remove A spyware. It prompted me with several more pop-ups and the warning sign continued to flash annoyingly so. I tried all the soulutions in here and most of them are spyware identifiers NOT REMOVERS. In order to remove it, the program wants you to register WHICH means $$.

Inter net Exlorer kept launching and there was a Spyware 7.1 Toolbar which had two green boxes to click. I never touched any of them. I just kept closing everything down.

MicroTrends free scan – did remove 1 adware thing and some cookies, no final soltution

V-Com’s Fix-It – removed cookies and some trojans, no sure fire fix

SpyHunter – listed them but required a registration fee in order to completely REMOVE anything

Smitfraud – same as above

Didn’t try anything else software wise. I followed some of Kid Rock’s post and some of my own. If you do not know how to go to ’safe mode’, use your windows help menu.

Solution: While in ’safe mode’, use KidRock’s advice except when in Safe Mode add this to the steps. DO NOT HAVE ANY NET APPLICATIONS OPEN:

Search for files names icmntr, icthis, ictmdll. icrtun, icun, isfmdl, isfmntr, isfmm, isfun and delete every instance. Also find and delete video add on folder. I also searched all of these instances using ‘run’ -> ‘regedit’ as well.

Empty the recycle bin each and every time you find one of the instances named above. If for some reason you save files not ready to be deleted in your Recycle bin, then you need to make a choice right then to save or to remove.

Restart PC and then load Internet Explorer and everything SHOULD be free. If this does not work, seek professional services is all I can offer. If it does work then, thank me on here!!

Hope I’ve helped as I have 10+ years of net knowledge and web design. Last time I had something like this wsa over 6 years ago.

30 January 2008 at 5:07 am

26 }

KidRock said:

p.s. don’t forget cyberlog-x probably came bundled with other trojans. I also did a full system scan with my McAfee software which eliminated a couple of trojans. And I deleted all my caches (i.e. webpages, cookies, etc.) in Internet Explorer/Tools/Internet Option/. Yes, thanks Lady DI, Solution: While in ’safe mode’, use KidRock’s advice except when in Safe Mode add this to the steps. DO NOT HAVE ANY NET APPLICATIONS OPEN, so you won’t have to do steps 3 and 5 in my previous posting above.

30 January 2008 at 9:10 am

27 }

Lady DI said:

Good point KidRock as I use FireFox mainly and I have it set to delete history, temp files and cookies as well as downloads when I come offline. I thank you for the reminder to do so MANUALLY in I.E. because it was launching ever chance it got when that virus/trojan was on. Otherwise I went into my registry and did a nice clean up with every term I have listed and also removed those virus scanners that I had used as well. I was surpised at just how much more I had found. I let V-Com know I was pretty pissed.

Have you seen troj_clicker.bu? Fix It just launched that I had a “potentioal threat” of that name. I did a virus clean and it found nothing. I also did a net search and it’s not relevant anymore so it seems. No removal tool but a lil bit of info. Grrrr…..

30 January 2008 at 6:56 pm

28 }

Lady DI said:

Diamond – Personally, I think you should try to remove the stuff of the system instead.

3 February 2008 at 10:21 pm

29 }

Lady DI said:

Scroll to the top of the page and read until the beginning of this area Valanbose.

8 February 2008 at 9:35 pm

30 }

les said:

downloaded smitfraudfix, followed the instructions and hey presto cyberlog is no more. many thanks for the help

11 February 2008 at 8:20 am

31 }

MARK said:

adware away got rid of cyberlog-x in 2 easy steps,and if it cant get rid of a virus you just have to swnd your global scan log to them and they will develop a program to rid your system of the pest or any pest. best $29.95 i have spent.

12 February 2008 at 5:22 pm

32 }

swapnalekha said:

Syfer,it really helped out
thanks a lot,
since 3 days Iam fighting with it
atlast with out installing any other software,got succeded in that filthy popup-system alert with your suggestion and step by step process.
thanks a lot……..
really I mean it
Thanks again from the bottom of my heart……..
really it annoyed me like anything-NIGHTMARE
AGAIN THANK YOU SYFER

14 February 2008 at 1:07 pm

33 }

Karen Clarke said:

Super Anti Spyware worked for me after about 3 frustrating days of searching for a solution.

Thank you all – great site,
Karen

17 February 2008 at 8:28 pm

34 }

reinyaR said:

Hey all this is one pest, but there is a solution all those who posted the advise about using Super Anti spyware thanx it did the trick. Also there is a saite that u can use to download lots of ur favourite anti viruses and anti spyware try it out and it safe “www.filehippo.com”. Thanx again for all ur advice

17 February 2008 at 11:48 pm

35 }

cosmin said:

THANKS SYFER, YOU ARE RIGHT !!!!!!!!!

24 February 2008 at 5:35 pm

36 }

Jello said:

SmitFraudfix works like a gem, i wanted to try Syfer’s recommendation but i couldn’t find that “video plug-in” file…one love n God Bless Thnx a ppl.

18 April 2008 at 12:47 am

37 }

Vishesh said:

i couldn’t find “video plug-in” file folder.
now what to do
please help……

23 April 2008 at 9:01 am

38 }

White – Neger said:

and i can’t end all three processes. i ended only two processes because i didn’t find the last one

24 April 2008 at 3:38 pm

39 }

Kevin said:

The file video plug in is called NetProject on my comp

25 April 2008 at 3:49 am

40 }

m142dionysis said:

SmitFraudFix worked perfect for me. Really quick and simple. No pop ups and no warning baloons on my toolbar. Great job, thanks a lot SiRi. If I come up with any problem I will let you know.. Good luck to everyone

27 April 2008 at 1:42 pm

41 }

Emma said:

super antispyware worked straight away for me.

5 May 2008 at 12:02 am

42 }

Heather said:

Thanks Syfer! It definitely got rid of the popup problem, though I have a weird blank spot in the taskbar now where the obnoxious fake alert used to appear.

7 May 2008 at 8:37 pm

43 }

goliath said:

I used a variant of Syfer’s procedure.

1. Open task manager. I clicked the applications tab. It showed 1037 running.
2. I searched for all 1037 occurences in c drive. I found the .pf and exe files and positioned the windows per syfer’s instruction.
3. I ended the 1037 task and quickly deleted the files.
4. go into registry and search for 1037. it was found in the ieupdate. Delete it.
5. rebooted and it was gone.

25 May 2008 at 5:18 pm

44 }

goliath said:

UDDATED PROCEDURE. I FORGOT THE RIGHT CLICK PART
1. Open task manager. I clicked the applications tab. It showed 1037 running. Right click and select go to process
2. I searched for all 1037 occurences in c drive. I found the .pf and exe files and positioned the windows per syfer’s instruction.
3. I ended the 1037 task and quickly deleted the files.
4. go into registry and search for 1037. it was found in the ieupdate. Delete it.
5. rebooted and it was gone.

25 May 2008 at 5:20 pm

45 }

auraborus said:

I am having same nightmare for 3 days now..Have tried all to some degree of success. At first I was not able to get to task manager at all “priviledge denied by administrator” yeah right!

EVENTUALLY AFTER RUNNING SUPERANTISPYWARE

26 May 2008 at 5:36 pm

46 }

auraborus said:

OOOPs super would only run in SAFE mode.. i get BSOD in normal mode?? anyway I also ran spybot S&D but always would get the Cyberlog-x pop up.. Found in my case the exe was 000080s.exe was a hidden file in C:\windows\system32

I was able to end process and delete it .. found 4 or 5 entries in registry and deleted them too…

BUT although the pop ups stopped I still get ie home page change attemts and whenever i try to go to any web site like grisoft or lavasoft or even bleepingcomputers etc i get a “page cannot be displayed” same thing when trying to update AVG or Super Anti spyware etc?? Still must be something whacky going on.. I hate this crap.. my whole Memorialday weekend has been shot to shit. I want to blame my kids of course but it’s probably no bodies fault but mine…

26 May 2008 at 5:43 pm

47 }

Bablo said:

HELP PLEASE

Getting this message:

Critical System Warning!
—————————
Your system is probably infected with latest version of Spyware.CyberLog-X.
Type: Spyware
Infection Length: 266,129 bytes
Risk: High
Systems Affected: Windows 95, 98, 2000, NT, 2003 Server,
Windows XP, Windows Vista
Behavior: Spyware.CyberLog-X is a spyware program that
monitors user activity, logs keystrokes, and tracks
Web sites visited.
Symptoms: Low Internet connection speed
Low system perfomance
Security center alerts
Strange pop up windows
Protection: Click OK to donwload antispyware software.
—————————
OK Cancel
—————————

Already tried “SmitFraudFix” in safe mode but its not working for me, I am working on removing this >Spyware.CyberLog-X< for last 4 days.

Still havnt try “Super Antispyware” Can someone please give me a site to download Super Antispyware. Please Help

26 May 2008 at 9:18 pm

48 }

Bablo said:

Help Please:

Sorry, continue to previous post. Can someone please help me how to disable System Restore? and why do we need to disable System restore? for?

Most Places they’re telling me to Follow this

1. On the Desktop, Right Click on My Computer
2. Select the System Restore Tab
3. Mark the “Turn Off System Restore” to disable and UnMark to Enable
4. Click Apply on the Bottom of the Dialog Box to save the settings.
5. A message “This deletes all existing restore points” will appear, click Yes to disable.
6. Click OK.

But I cant find System Restore Tab when I click right on My Computer???

26 May 2008 at 9:26 pm

49 }

Jason said:

I tried SmitFraudFix in safe mode and it didn’t work either. Damn tricky motherf*****. I ended up RENAMING the SmitFraudFix.exe file to just Fix.exe and it would finally launch!

Jeez, the f-ing program was blocking SmitFraudFix.

Also, I can’t goddamn kill any process via task manager because it f—ing disabled it.

I went into regedit and gpedit.msc to regain task manager, but it keeps popping right back, even in SAFE mode. Christ. I’m trying SmitFraudFix and Super Anti Spyware next.

27 May 2008 at 1:07 am

50 }

vince said:

I too am having very similar problems as jason, ala. greyed out task manager , cyberlog-x warning balloons, deleted restore points, blue spyware desktop, smitfraud did not work for me after renaming it ??? any sugg?

28 May 2008 at 9:01 pm

51 }

kriss said:

I’m having problems with this thing too…
I tried going to the task manager and the program files but I can’t find any of those files like icthis.exe and all that.
I have spyware doctor and I ran it and it cleaned my computer pretty nicely, everything worked fine until I’d turn off the computer and go back on the next day, the pop ups for spyware cyberlog-X :critical system warning: would start again. and it blocks me from going to websites like google
Any help?

30 May 2008 at 12:09 am

52 }

vikas said:

i can not pull up the taskmanager as it is disabled..and i can not find any video folders created in the Program Files…pls help..
there are some files created in system32 folder, but can’t delete it..

1 June 2008 at 7:52 pm

53 }

vikas said:

if SmitFraudFix is not running in Safe mode, try renaming the exe and then run it….it worked for me…

1 June 2008 at 9:02 pm

54 }

daniel said:

I cannot go onto the internet or into safemode. Any suggestions?

2 June 2008 at 1:43 am

55 }

Isaiah said:

will webroot work?

2 June 2008 at 8:24 am

56 }

vince said:

Does anyone else get these same stupid pop ups in safe mode? If so, am I wasting my time running these programs in safe mode? I currently have tried, avg, spy doctor, adware se, smit rem, smit fix, rouge remover, avast.. nothing has worked yet. symptoms- grey out task manager, deleted system restore points, pop ups in safe mode, hijacked ie that redirects whenever I go to an antivirus site such as microsoft or grisoft…IM LOST..help

2 June 2008 at 7:21 pm

57 }

Greg said:

I don’t find a “Video-Add On” or a “Yellow alert button/icon”. I just get the same SPYWARE.CYBERLOG-X alert window and I can’t access the internet and NOW, I can’t access my Anti-Virus, it just won’t open. 2 days since attack.
I DO however see a “Spyware” icon in System 32, but it won’t let me delete it. Spyware Doctor Says not to run in safe mode, is it o.k. to run in safe mode? will i mess anything up?

3 June 2008 at 3:20 pm

58 }

Mark said:

Is it unsafe to run Virus Programs in Safe Mode? My Spyware Doctor told me this.

3 June 2008 at 3:27 pm

59 }

andrew said:

I was finally able to remove the spyware.cyberlog-x after 4 days. I tried of the above recommendations – smit, rogue remover, avg, superantivirus, spybot s&d, vundofix, adwareaway, combofix. I did not have any of the ic* files or the files running in task manager. Each time I thought I cleaned the pop-ups re-appeared.

In truth – I think it was really a combination – not sure which really worked. I did have several other malware like vitrumond, smit-c. Each of the tools helped clean them.

However using the above each of aboves in tools safe mode – I got to a point where I could install malwarebytes anti-malware. I ran this program and it seemed to have fix the problem.

I then rebooted in safe mode with networking support. I was then able to get updates to superantivirus, symantec and avg free. I then ran a full scan (in safe mode) two virusus were picked up. After cleaning out the 2 virus my laptop is back to normal.

3 June 2008 at 3:31 pm

60 }

Mark said:

So it is safe to run Anti-Spyware & Anti-Virus programs in Safe Mode?

3 June 2008 at 4:01 pm

61 }

Mark said:

P.S. Reason I ask is because my Anti-Spyware caught a bunch of spyware & deleted it initially, but I heard running virus programs in Safe Mode is better?

3 June 2008 at 4:03 pm

62 }

andrew said:

I only ran them in safe mode – because I tried to clean them and they were only partially cleaned. It wasn’t until I booted in safe mode that I was able to fully delete and remove from quarantine (symantec).

3 June 2008 at 4:26 pm

63 }

Mark said:

I ran Spyware Doctor & Spy Spweeper both in SAFE MODE and they both detected NOTHING. But my browser setting are still screwed up, Can’t get on the internet, it doesn’t even take me to a malicious website, it just doesn’t display a page. All sorts of programs are now being disabled, i wonder if things are spreading the more and more that I reboot.

4 June 2008 at 3:27 pm

64 }

stevie said:

I couldn’t find the program files that kid rock mentioned or the video add on folder but I did everything else that he mentioned and also deleted two antiviral programs that I later found in my all programs menu. So far my computer is working great. Thanks to Kid Rock, Lady Di, and all of you for your help. Stevie

6 June 2008 at 7:53 pm

65 }

Turk said:

Done and done! Smit worked like a charm and removed the cyberlog-x spyware. It’s ok to run in safe mode.

27 June 2008 at 7:48 pm

66 }

Ivy said:

I got clobbered by this last night.

Guess what fixed it?

System restore.

Fortunately, I got hit on a junk computer that is semi-fried already and for which I use solely to download torrents of foreign TV shows.

I was in such bad shape that I had to use my real laptop to find this thread. I couldn’t even get onto the internet on the afflicted laptop — Firefox wouldn’t load, and Internet Explorer redirected to spammy websites. I think this was happening even in safe mode with networking enabled.

So I couldn’t download the spyware killers above. I tried searching for the ic* iterations listed above and the Video Add-on folders, but nothing showed up in my search results. Finally, fearing that I’d have to reformat the harddrive, I figured “couldn’t hurt to try system restore.”

I got hit late on a Friday. There’d be a restore point earlier that day for software distribution, which I presume was the thing getting onto the computer. There was also a software distribution on Thursday, which was probably McAfee. I chose the system checkpoint from Wednesday, and voila! everything seems to be fine, as of this writing on the Saturday after the hit.

My question: when it initially came out of system restore, Windows said that it had renamed some files and had a link to see what they were. I skipped that as I didn’t know whether system restore had fixed things yet.

I presume those files were the offenders.

How do I track them down now to delete them?

28 June 2008 at 8:53 pm

67 }

nell said:

i just tried smit fix and superantivirus and it didnt work.they both detected problems, fixed them, but i still have pop ups.i don have a video folder.

30 June 2008 at 3:12 pm

68 }

chiko said:

HOW THE HELL DO I GET RID OF THIS ANNOYING THING?!

30 June 2008 at 9:44 pm

69 }

nell said:

i cant update none of my virus programs bcuz of this stupid spyware.itz been 2 days and im really frustrated.

1 July 2008 at 2:45 am

70 }

Bryco said:

Finally, after 2 days, I am free from spyware.cyberlog-x, and its related viruses/spyware smitfraud and win32/nuwar.gen!Ids. Here is what I did.

1. I tried the smitfraudfix.exe from the link above. It did not remove the virus, but it did stop it from functioning. Then, at restart, the virus would try to reinstall itself, but SPYBOT SEARCH AND DESTROY would stop it from installing, changing registry, etc.

2. I downloaded MICROSOFT LIVE ONECARE free 60-day trial. Worked great; started scanning and removing junk even before it fully installed. Warning message said that ONECARE could not remove win32/nuwar.

3. Updated SPYBOT SEARCH AND DESTROY, then had it scan the computer. It found tons of spyware, recognized win32/nuwar, and messaged that it would have to remove that file upon restart. At restart, SPYBOT, while pausing the restart, scanned the computer and removed the win32/nuwar file. Finally virus free.

3. Had to remove one DLL line from the registry, but other than that, completely fixed computer by using MICROSOFT LIVE ONECARE and SPYBOT search and destroy.

4. I’m not too sure how much smitfraudfix.exe helped, but it did stop the virus from functioning. Big downside is that you have to turn off the system restore and you lose all restore points. I would try restoring to a recent restore point, starting in safemode, then downloading ONECARE and SPYBOT and scanning in safemode if possible. I still can believe I am free of this nasty virus; I was ready to take the computer to Geeksquad for reinstall of Vista. Hope this posting helps somebody.

1 July 2008 at 3:23 am

71 }

nell said:

i just got rid of it!! I used my cell phone to go online to the malwarebytes anti malware website,downloaded the new database(because the virus wouldn’t let me update) and voila! it found the trojans and removed them.Malwarebytes anti-malware ftw baby.

2 July 2008 at 3:12 am

72 }

Ivy said:

On the restore point issue, I swear I’m telling the truth about restoring to two days earlier stopped the thing cold.

BTW: I ran Spybot afterwards and it ID’d a smitfraud.exe file in red, which I removed. Dunno what that was.

My system’s still running fine, but I remain suspicious that the bad files are still onboard. Does anyone know where they would be and what registry key to delete?

5 July 2008 at 12:35 am

73 }

Promo Codes For Jc Whitney said:

lykd zcpfyl ubyt

16 July 2008 at 8:21 pm

74 }

Syfer said:

The problem with the taskmanager (vikas) i feel you might have a virus called Rontokbro. REMEMBER I M NOT CERTAIN. If you have rontokbro them there must be a file on your C Drive that reads “rontokbro” DO NOT OPEN THE FILE its an “exe” file. The only solution i saw sometime back was to format the machine after backup. If the new virus defs can pick it up then its cool. do check that file out.

1 November 2008 at 8:51 am

75 }

virusman said:

or you can just be good with pc’s

18 November 2008 at 4:57 pm

76 }

trex said:

1. Used AVG Free to initially clear up the easy stuff…hint — don’t close any of the pop up windows it throws at you…just work around them…..seems to get more vicious when you close them….
2. To get rid of the rest I followed Syfer’s instructions and they worked perfectly, but the corrupt folder was named “WebMediaViewer” instead of “video add-on” and .exe files within the WebMediaViewer folder were named hpmom.exe, and qttask.exe

24 November 2008 at 11:48 pm

77 }

milliman said:

Add me to the list of infected users – just received the virus by clicking on a video link from facebook. apparently my “friend” opened a file and it then sent this to all friends. there are alot of suggestions above and I am a bit confused where to start. i suppose I will try the manual methods first, especially since I cannot connect to the internet (from the affected laptop). I assume if I choose to use smit, super, adaware, etc I will need to download using another laptop and then load onto the affected using flash drive or something. hope i can get rid of this thing. otherwise, geek squad, here I come. just thankful for many of you sharing your experiences. hopefully i can write about my fix soon.

3 December 2008 at 3:43 am

78 }

purvi said:

I got the same facebook virus! My internet doesn’t work so i can’t download anything. I tried starting in safe mode and deleting programs but the virus is still there. please help!!!

4 December 2008 at 12:57 am

79 }

Nick said:

Erh, yeah this is just alittle hint.. AKA BEBO/FACEBOOK/ DON’T USE THIS THEY HAVE OR STILL ARE CONTAINING MANY DIFFERENT TYPES OF MAL/SPY WARE> AKA like the recent facebook thing> where ur given a vid> 2 watch blah blah but wait u need 2 D-load somthing> BOOM! yay virus on ur computer you’ve been warned>

4 December 2008 at 11:38 pm

80 }

Palmer said:

Got the same CyberlogX from Facebook crap. Computer functions but Mozilla and IE won’t show up. They show up in the task manager in the processes tab and not the applications tab. Have run Spy-Bot, McAfee, and deleted what had to be deleted. Can’t run The Spyware Doctor because it needs the net to update the files to scan. No Video-ad folder, pop-ups, or flashing warning messages any more but still can’t get on the net…f@$k

9 December 2008 at 12:55 am

81 }

Palmer said:

Oh yeah, ran SmitFraudFix too…

9 December 2008 at 12:56 am

82 }

Amy said:

I used Syfer’s solution (the 19th post) and it seems to have solved the problem. The steps were very easy to follow. THANK YOU!!!!

11 December 2008 at 7:14 pm

83 }

sidda said:

I got rid of the spyware.cyberlog-x virus using smitfraudfix. I am sooo not a computer person but the directions were user friendly. It took less than 10 minutes. Thanks Everyone!

16 December 2008 at 2:50 pm

84 }

Sarma said:

I tried to run the Malware Antimalware, safety scanner from Microsoft but did not worked out. At last ran the Smitfraudfix and removed the infections.

2 January 2009 at 10:53 pm

85 }

Rodriguez said:

Syfer you are the best i believe my virus is gone

thanks

9 January 2009 at 6:04 pm

86 }

JOE said:

Yeah. im here too. caught this ,,, SYSTEM SECURITY,, Which keeps popping up telling me i have 38 viruses, trojans etc ,my scans say i have nothing,,, this thing cover the whole screen about every minute, Ihave the BEST norton symantec there is and spy dr. and another virus catcher, maleware byte, but NOTHING is doing any good. Im not very computer savy,so if u have any suggestions, you may have to baby sit me thru this thing,, thanks

18 February 2009 at 11:58 am

Leave your response!

More in Unwanted Programs

» AV Defender 2011 Pro and AV Defender 2011 Platinum - September 2nd, 2010
» SaveDefense - August 27th, 2009
» Trojan.Agent/Gen-AlcFakeAlert - May 1st, 2009
» Malware Catcher and Malware Catcher 2009 - April 30th, 2009
» CoreGuard Antivirus 2009 - April 29th, 2009

Spyware.Cyberlog-x

Related posts:

86 Comments »

Leave your response!

More in Unwanted Programs

Subcategory

Recent Posts

Recent Comments