thanks

BTW: I ran Spybot afterwards and it ID’d a smitfraud.exe file in red, which I removed. Dunno what that was.

My system’s still running fine, but I remain suspicious that the bad files are still onboard. Does anyone know where they would be and what registry key to delete?

1. I tried the smitfraudfix.exe from the link above. It did not remove the virus, but it did stop it from functioning. Then, at restart, the virus would try to reinstall itself, but SPYBOT SEARCH AND DESTROY would stop it from installing, changing registry, etc.

2. I downloaded MICROSOFT LIVE ONECARE free 60-day trial. Worked great; started scanning and removing junk even before it fully installed. Warning message said that ONECARE could not remove win32/nuwar.

3. Updated SPYBOT SEARCH AND DESTROY, then had it scan the computer. It found tons of spyware, recognized win32/nuwar, and messaged that it would have to remove that file upon restart. At restart, SPYBOT, while pausing the restart, scanned the computer and removed the win32/nuwar file. Finally virus free.

3. Had to remove one DLL line from the registry, but other than that, completely fixed computer by using MICROSOFT LIVE ONECARE and SPYBOT search and destroy.

4. I’m not too sure how much smitfraudfix.exe helped, but it did stop the virus from functioning. Big downside is that you have to turn off the system restore and you lose all restore points. I would try restoring to a recent restore point, starting in safemode, then downloading ONECARE and SPYBOT and scanning in safemode if possible. I still can believe I am free of this nasty virus; I was ready to take the computer to Geeksquad for reinstall of Vista. Hope this posting helps somebody.

Guess what fixed it?

System restore.

Fortunately, I got hit on a junk computer that is semi-fried already and for which I use solely to download torrents of foreign TV shows.

I was in such bad shape that I had to use my real laptop to find this thread. I couldn’t even get onto the internet on the afflicted laptop — Firefox wouldn’t load, and Internet Explorer redirected to spammy websites. I think this was happening even in safe mode with networking enabled.

So I couldn’t download the spyware killers above. I tried searching for the ic* iterations listed above and the Video Add-on folders, but nothing showed up in my search results. Finally, fearing that I’d have to reformat the harddrive, I figured “couldn’t hurt to try system restore.”

I got hit late on a Friday. There’d be a restore point earlier that day for software distribution, which I presume was the thing getting onto the computer. There was also a software distribution on Thursday, which was probably McAfee. I chose the system checkpoint from Wednesday, and voila! everything seems to be fine, as of this writing on the Saturday after the hit.

My question: when it initially came out of system restore, Windows said that it had renamed some files and had a link to see what they were. I skipped that as I didn’t know whether system restore had fixed things yet.

I presume those files were the offenders.

How do I track them down now to delete them?

In truth – I think it was really a combination – not sure which really worked. I did have several other malware like vitrumond, smit-c. Each of the tools helped clean them.

However using the above each of aboves in tools safe mode – I got to a point where I could install malwarebytes anti-malware. I ran this program and it seemed to have fix the problem.

I then rebooted in safe mode with networking support. I was then able to get updates to superantivirus, symantec and avg free. I then ran a full scan (in safe mode) two virusus were picked up. After cleaning out the 2 virus my laptop is back to normal.

Jeez, the f-ing program was blocking SmitFraudFix.

Also, I can’t goddamn kill any process via task manager because it f—ing disabled it.

I went into regedit and gpedit.msc to regain task manager, but it keeps popping right back, even in SAFE mode. Christ. I’m trying SmitFraudFix and Super Anti Spyware next.

Sorry, continue to previous post. Can someone please help me how to disable System Restore? and why do we need to disable System restore? for?

Most Places they’re telling me to Follow this

1. On the Desktop, Right Click on My Computer
2. Select the System Restore Tab
3. Mark the “Turn Off System Restore” to disable and UnMark to Enable
4. Click Apply on the Bottom of the Dialog Box to save the settings.
5. A message “This deletes all existing restore points” will appear, click Yes to disable.
6. Click OK.

But I cant find System Restore Tab when I click right on My Computer???

Getting this message:

Critical System Warning!
—————————
Your system is probably infected with latest version of Spyware.CyberLog-X.
Type: Spyware
Infection Length: 266,129 bytes
Risk: High
Systems Affected: Windows 95, 98, 2000, NT, 2003 Server,
Windows XP, Windows Vista
Behavior: Spyware.CyberLog-X is a spyware program that
monitors user activity, logs keystrokes, and tracks
Web sites visited.
Symptoms: Low Internet connection speed
Low system perfomance
Security center alerts
Strange pop up windows
Protection: Click OK to donwload antispyware software.
—————————
OK Cancel
—————————

Already tried “SmitFraudFix” in safe mode but its not working for me, I am working on removing this >Spyware.CyberLog-X< for last 4 days.

Still havnt try “Super Antispyware” Can someone please give me a site to download Super Antispyware. Please Help

I was able to end process and delete it .. found 4 or 5 entries in registry and deleted them too…

BUT although the pop ups stopped I still get ie home page change attemts and whenever i try to go to any web site like grisoft or lavasoft or even bleepingcomputers etc i get a “page cannot be displayed” same thing when trying to update AVG or Super Anti spyware etc?? Still must be something whacky going on.. I hate this crap.. my whole Memorialday weekend has been shot to shit. I want to blame my kids of course but it’s probably no bodies fault but mine…

EVENTUALLY AFTER RUNNING SUPERANTISPYWARE

1. Open task manager. I clicked the applications tab. It showed 1037 running.
2. I searched for all 1037 occurences in c drive. I found the .pf and exe files and positioned the windows per syfer’s instruction.
3. I ended the 1037 task and quickly deleted the files.
4. go into registry and search for 1037. it was found in the ieupdate. Delete it.
5. rebooted and it was gone.

Thank you all – great site,
Karen

Have you seen troj_clicker.bu? Fix It just launched that I had a “potentioal threat” of that name. I did a virus clean and it found nothing. I also did a net search and it’s not relevant anymore so it seems. No removal tool but a lil bit of info. Grrrr…..

Inter net Exlorer kept launching and there was a Spyware 7.1 Toolbar which had two green boxes to click. I never touched any of them. I just kept closing everything down.

MicroTrends free scan – did remove 1 adware thing and some cookies, no final soltution

V-Com’s Fix-It – removed cookies and some trojans, no sure fire fix

SpyHunter – listed them but required a registration fee in order to completely REMOVE anything

Smitfraud – same as above

Didn’t try anything else software wise. I followed some of Kid Rock’s post and some of my own. If you do not know how to go to ‘safe mode’, use your windows help menu.

Solution: While in ‘safe mode’, use KidRock’s advice except when in Safe Mode add this to the steps. DO NOT HAVE ANY NET APPLICATIONS OPEN:

Search for files names icmntr, icthis, ictmdll. icrtun, icun, isfmdl, isfmntr, isfmm, isfun and delete every instance. Also find and delete video add on folder. I also searched all of these instances using ‘run’ -> ‘regedit’ as well.

Empty the recycle bin each and every time you find one of the instances named above. If for some reason you save files not ready to be deleted in your Recycle bin, then you need to make a choice right then to save or to remove.

Restart PC and then load Internet Explorer and everything SHOULD be free. If this does not work, seek professional services is all I can offer. If it does work then, thank me on here!!

Hope I’ve helped as I have 10+ years of net knowledge and web design. Last time I had something like this wsa over 6 years ago.

1) Start computer in “safe mode” which doesn’t allow the programs to start, find the “icthis.exe” and “icmntr.exe” files in the program directories, and delete them both.
2) Do an Advanced Search on “C drive” – use date created of today (if installed today) include system files, etc. Arrange search results by Date modified. Identify all files that were created by the installation (should all be within one minute (I deleted all files created at 5:57 p.m., for example). Highlight them all, don’t worry about prefetch files they can be deleted also, and delete all these files.
3) The only file that won’t delete is ictmdl.dll in c:\program files (the add on in internet explorer, hmm maybe it would if I didn’t have internet explorer open at the time) but skip this one for now
4) Run regedit (i.e. open Registry Editor) and delete the Video Add-on folder under Computer/../Software
5) Restart computer in “safe mode” which didn’t allow the programs to start, find the ictmdl.dll in c:\program files and delete it.

Done. This works. All removed for free/do-it-yourself.

1. Disable the confimation from the recycle bin of your computer (right click – properties – uncheck “Display delete confirmation dialog” and then press “ok”)

2. Go and open “C drive – programme files – right click and choose “arrange icon by – Modified”"

3. Look for a folder created recently which will have a name similar to “video plug-in” and open that folder. It should be some where near the bottom right files. (the files are sorted according to the date they were last made changes to)

4. Next right click you task bar to get you task manager or press “ALT + CTRL + DEL” or “ALT + CTRL + DEL” and choose task manager (either one of these will bring up your task manager) and click on “Processers” Tab

5. Place the windows side by side (resize the program files folder to fit the screen with task manager)

6. Look at the folder you had opened for some files (programs) that are similar to the ones running in the task manager. (sorting by name helps)

7. Right click the file name that is similar to the one in the plug-in folder you have opened and click “End process tree” and then very quickly click on the file in the plug-in folder and press delete. REMEMBER to delte the file from the program file quickly or the process will start again in the task manager.

The file should go away without asking you with a yes or no alert box.

8. Do the same with the other two processes. then delete the folder from the program files and delete it from your recycle bin also.

Finished … now when its gone … you can enjoy the web browsing again. Good luck. contact me at gmail if you need anything regarding my method.

Syfer.Darknight

I started my computer in “safe mode” which didn’t allow the programs to start, found the “icthis.exe” and “icmntr.exe” files in the program directories, and successfully deleted them both.

The “warning” triangle is gone and, 24 hours later, I haven’t had one graphic pop-up displayed.

Once I completed the problem was no more.

but i fix my Dads laptop

First get this programs
*Spybot serch and destroy
*Ad aware Se
then use them ,once you finish
turn off your computer, and turn it back on
then at the begin go to Safe mode
go to Safe mode by pushing f8 around 6 or 9 times then its gone a take you to a black screen go to safe mode
and at the begin its gone a ask you that going to safe mode will stop using some programs ,, click yes and continue

then use the programs again
Spybot serch and destroy
ad aware se
and if you can use Windows defender

then clean everything ,
now go to programs file, and youll see a folder that cyberlog-x made its call videos ad-on
erase it and erase it from the trash can
(sorry for my bad English,im mexican and my computer its on spanish )
once you finish
shut down your computer by using the start button ,anytime you’ll come back it should be ok

this is other sintom of ciberlog-x

an add on the internet explorer bar
a pop windows
pop up critical dammage windows
and the yellow balloon down right

much like everyone else, I came here to get rid of this dumb ass spyware shit… The best program out there for anti spam / Antivirus is called ESET.
http://www.eset.com
but my version got screwed up by windows defender(which blows) I am currently working to rid my computer of this spyware.. If i come up with anything I will re-post…

I am trying some spyware removal sofware that Eset offers for FREE on their site…

I have tried AVG, Symantec, AdAware, Spy-Bot and Smitfraud, and nothing has worked.

1 – disconnect your computer from the internet.
2 – start up in Windows Safe Mode and run your anti adaware programs.

Have you tried the Smitfraud Removal by Siri?
http://www.precisesecurity.com/blogs/2007/06/20/smitfraud-removal-by-siri/