HELP!!! Allowed Adware/Spyware Programme

Hi I have accidentally allowed a programme called ICTHIS to be loaded onto
my system and it keeps popping up and requesting that I purchase this
software and I am unable to delete it from my system. I have a yellow
flashing triangle on my screen which keeps saying System Performance Warning
- click balloon to download. I have tried to delete the folder (Video
Add-Ons) but unable to. Is there any way of deleting this programme without
formatting the hard drive.

Thank you
--
Andrew J Palmer

Have you tried a System Restore to a time prior to installing the program?

--
Richard G. Harper [MVP Shell/User]
* NEW! Catch my blog ... http://msmvps.com/blogs/rgharper/
* PLEASE post all messages and replies in the newsgroups
* The Website - http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Andrew J Palmer" <> wrote in message
news:B4870BAD-C590-4BE7-A140-...
> Hi I have accidentally allowed a programme called ICTHIS to be loaded
> onto
> my system and it keeps popping up and requesting that I purchase this
> software and I am unable to delete it from my system. I have a yellow
> flashing triangle on my screen which keeps saying System Performance
> Warning
> - click balloon to download. I have tried to delete the folder (Video
> Add-Ons) but unable to. Is there any way of deleting this programme
> without
> formatting the hard drive.
>
> Thank you
> --
> Andrew J Palmer

Andrew J Palmer wrote:
> Hi I have accidentally allowed a programme called ICTHIS to be loaded onto
> my system and it keeps popping up and requesting that I purchase this
> software and I am unable to delete it from my system. I have a yellow
> flashing triangle on my screen which keeps saying System Performance Warning
> - click balloon to download. I have tried to delete the folder (Video
> Add-Ons) but unable to. Is there any way of deleting this programme without
> formatting the hard drive.
>
> Thank you

You have installed a Zlob trojan and now you will need to clean up your
computer.

http://www.bleepingcomputer.com/star...exe-20321.html

Do the preparatory steps here:
http://www.elephantboycomputers.com/...moving_Malware

Then do the specific removal steps here:
http://www.elephantboycomputers.com/...itfraud_Trojan -
Smitfraud, Spyaxe, Spyfalcon

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the first link above (not here, please).

Not all tools used will work in Vista and you will need to run them
elevated. Since Vista is so new, it will be a while before removal
techniques and tools are developed. If you are unable to remove the
infection by following the general steps, register at one of the
HijackThis forums as suggested.

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may
be so infested that Windows will need to be clean-installed. Have all
your data backed up before you take the machine into a shop.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

"Richard G. Harper" wrote:

> Have you tried a System Restore to a time prior to installing the program?
>
> --
> Richard G. Harper [MVP Shell/User]
> * NEW! Catch my blog ... http://msmvps.com/blogs/rgharper/
> * PLEASE post all messages and replies in the newsgroups
> * The Website - http://rgharper.mvps.org/
> * HELP us help YOU ... http://www.dts-l.org/goodpost.htm
>
>
> "Andrew J Palmer" <> wrote in message
> news:B4870BAD-C590-4BE7-A140-...
> > Hi I have accidentally allowed a programme called ICTHIS to be loaded
> > onto
> > my system and it keeps popping up and requesting that I purchase this
> > software and I am unable to delete it from my system. I have a yellow
> > flashing triangle on my screen which keeps saying System Performance
> > Warning
> > - click balloon to download. I have tried to delete the folder (Video
> > Add-Ons) but unable to. Is there any way of deleting this programme
> > without
> > formatting the hard drive.
> >
> > Thank you
> > --
> > Andrew J Palmer
>
>

Hi installed a virus-VirusHeat 4.3, and it is forcing me to buy, and the
yellow popper is maddening.you talk of doing a system restore prior to the
date of infection.pliz tell me how that's done.I'm clueless! And on my
birthday of all days.
Thanx for any help, and stay safe!
Desperate.

"desperate susan" <> wrote in
message news:E7A21D4E-7474-4AAD-9B77-...
> Hi installed a virus-VirusHeat 4.3, and it is forcing me to buy, and the
> yellow popper is maddening.you talk of doing a system restore prior to the
> date of infection.pliz tell me how that's done.I'm clueless! And on my
> birthday of all days.
> Thanx for any help, and stay safe!
> Desperate.


Control Panel\Backup and Restore Center

"desperate susan" <> wrote in
message news:E7A21D4E-7474-4AAD-9B77-...
> Hi installed a virus-VirusHeat 4.3, and it is forcing me to buy, and the
> yellow popper is maddening.you talk of doing a system restore prior to the
> date of infection.pliz tell me how that's done.I'm clueless! And on my
> birthday of all days.
> Thanx for any help, and stay safe!
> Desperate.

desperate susan,

Click Start, All Programs, Accessories, System Tools, System Restore.
You can then restore your computer to a point prior to noticing the problem,
provided restore points were made.

C.B.


--
It is the responsibility and duty of everyone to help the underprivileged
and unfortunate among us.

Dear Desperate:

Have you tried starting the computer in safe mode (F8) and then uninstalling
that nasty software? Run a virus scan while you are in safe mode as well.
Be prepared for your computer to run much slower in safe mode.



"desperate susan" <> wrote in
message news:E7A21D4E-7474-4AAD-9B77-...
> Hi installed a virus-VirusHeat 4.3, and it is forcing me to buy, and the
> yellow popper is maddening.you talk of doing a system restore prior to the
> date of infection.pliz tell me how that's done.I'm clueless! And on my
> birthday of all days.
> Thanx for any help, and stay safe!
> Desperate.