Help - Search - Members - Calendar
Full Version: getting attacked by false video codec
Lavasoft Support Forums > Archived Topics > Archives: Resolved/Inactive Topics > Resolved/Inactive General Support Issues
patman
I was surfing and stupidly downloaded a video codec. It was called VideoCompressionCodec 10.0. It installed a bunch of junk on my system. Now I am getting continuous pop-ups from my sys tray and my browser is hijacked alot. It keeps saying I have this or that trojan and I need to download a fix. It is running a ton of processes. I used to have like fewer than 10 processes that were my user name , now it is at least 30. Names such as pmmon.exe, isamonitor.exe, isamini.exe, pmsngr.exe, etc.

I ran adaware and spybot. Neither got rid of it.

When I try to remove the programs it says I have to reboot. I have not rebooted yet since this has happened.

I also tried ending the processes in the Task manager and it just reappears.

I tried to download the latest adaware as suggested on another post and it blocked the page.

I saw that some other people had a similiar problem. But I am at a loss for what to do.

If I wipe my hard drive and reload windows will this issue go away?

My Hard drive is partitioned into 3 partitions. A C drive for System,D for apps, E for data. Can I just wipe and redo C and get rid of this?

Please help me.

I am willing to wipe if it will go away, but I would not like to wipe my d or e drive.

Thanks
patman
Also I was able to download the XoftSpy 4.22 program, I did not pay for it but it told me I had emcodec and virusburst.

I could pay the 30 bucks for it but I do not think it will help, not to mention I am scared to type any creditcard numbers or passwords of anything.
Tristian
Hello patman, I am now monitoring this topic so I can respond to you a lot quicker. Are you still having trouble?

1) Please download and install the latest version of Ad-aware SE Build 106r1 if you have not already done so.

Then use WebUpDate to get the latest Definition file (SE1R128 18.10.2006)

To do this Open Ad-aware and click the WebUpDate button at the top right hand side of the Ad-aware screen (The world globe).

- Click "Connect". Ad-aware will then download the latest Definition file for you. To make sure it is updated, look at the main Ad-aware screen, and look under "Initialization Status". It should say the Latest Definition file.

- Then scan doing a "Full Scan", and then post your logfile here by using the Add-Reply button.

Logs are stored in : C:\Documents and Settings\USERNAME\Application Data\Lavasoft\Ad-aware\Logs\
An easy way to get there is to click Start, click run, And type in '%appdata%' (without the quotes) followed by the enter key. Then click Lavasoft, then Ad-Aware, and then Logs. Scroll down to find the latest one that you have (by date & time) and open it. Right Click, Select All, Copy and then Paste the contents of it here.

2) Download 'Hijack This!'
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Do a system scan and save a logfile".

When the Notepad window opens, do Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
uconnfan
Hello,

I'm having a similar problem and thought I'd reply to this topic. I also was surfing the net and downloaded a video codec I shouldn't have. Since that happened (yesterday) there has been a notification icon in the bottom portion of the screen where the clock is that keeps telling me I have a critical system error on my computer and to address it. Clicking on the box brings me to a website selling the Virus Bust software. This is obviously spyware on my computer trying to get me to buy this stupid software and I'm trying to delete it. I also have similar process running like those described above (51 total). I've tried deleting some programs from the Add/Remove Programs command under the Control Panel, but nothing has worked yet.

Norton Anti-Virus says I'm clean. I followed the link above to download the latest version of Ad-Aware and did so, updated the definitions and started a scan. However the scan froze while searching the folder C://WINDOWS/SYSTEM32/NtmsData, object scanned number 163047. I'm not sure what to do now.

I also downloaded the HijackThis software from the link above and can run a scan and post the report if that will be of help.

Thank you so much to anyone who can help with this problem!
Tristian
Hello uconnfan,

Please start a New Topic in this forum by clicking on the 'New Topic' icon at the top of this page. Please post your HijackThis log there.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2010 Invision Power Services, Inc.