MS Security Warning -- Trojan = infostealer.banker.s

15 years ago

I got this message, supposedly from Microsoft I have XP home edition

Spyware.IEMonster.b

zlob.PornAdertiser.xplisit

trojan.infostealer.banker.s

Recommend install XP antivirus protection for free.

What can I trust. Before this happened I had run AVG 8 free, and Superantivirus and only found cookies. I also ran Spy Sweeper but this was not up to date. I have Pro Defender 2008 but it wants me to remove any antivirus program before installing. I turned off computer until I can better understand what happened. IE had started to freeze up doing a simple search before this happened and the reason I ran the virus scans.

Sort by:Oldest

Comments (10)

bpgreen
15 years ago
I would not trust the email. I very highly doubt that it is from MS and the free software that they are offering you is almost sure to be malware of some sort.

MS is planning on offering some sort of free protection software sometime next year, but their current offering costs about $50 a year.
cynic
15 years ago
Sounds like a spam popup window to me. There's a lot of reasons why IE could freeze. I won't use IE unless I absolutely have to. I prefer Opera, Kmeleon and occasionally Firefox.

If your proven programs are working, and updated, and you keep up (reasonably) on Windows Updates, you should be fine.
Related Discussions
Recipe software - a little off topic
Q
Comments (12)
The US Government uses Norton. I was required to install that on every system that an Air Force contracted company worked with. They would also set up a local update for every week and it was fuly tested before it was released into the local servers. If one of the programs had problems with Norton, the whole company wouldn't be impacted suddenly. In any case, Fidelity Investments also had a special custom made virus scanner program (F Prot) that was updated every week and and sometimes even more often. If you use Windows XP, be sure to download the latest SP3. I don't use Internet Explorer 7, as I feel that version 6 is just fine. Here, I hate I.E. and actually use one of the older Netscape versions, which seem to hate a few web sites. Trojans are a bit less damaging today, if you keep up on Java Script, malware updates and the MS web site for the latest OS software patches. I avoid Vista like a plague! Many newer systems today can't even go back to XP due to the lack of support for older XP drivers and the like. When Vista arrived, it took about 4-6 months for some hardware companies (printers, video boards, etc.) to come out with proper drivers. Usually if you have a choice to 'save to disk' or run after download, you choose save to disk. Create a folder for these downloads and then scan that folder to see if the files that were downloaded are valid and have no traces of possible viruses. Believe it or not, the MAC was the first home computer to get viruses. PC problems came later, but have been much worse in recent years. Luckily, some ISP companies offer free antivirus software, like McAfee. Interesting to note, McAfee, for sveral years, has been owned by Symantec who also make Norton. Maybe someday things will settle down, but you always have to be careful, especially if you see an unfamiliar popup telling you that you have a virus and to 'click here' to find out more info. Thats a sure sign of a mean virus being allowed ont your system. Its always a good idea to make a full back up once each week, and to have at least two backups dating back more than 2 weeks. Today, a terabyte hard drive is less than $100, so many backups can be sent to a huge drive like that.
...See More
JS/Redir malware popup
Q
Comments (35)
AVG is a software program that cleans up viruses, similar to Norton Anti-virus and McAffee. It has a free version and a paid version. Many people, myself included, use the free version, and find it to be perfectly fine for protecting the computer from viruses. If you do not use AVG than you should not be having this issue. If you are using a different virus protection program and are getting virus alerts when you come to Gardenweb, then that's a different problem all together.
...See More
Got a problem
Q
Comments (18)
I've run MBAM. Here's the log. Also installed Avast. Haven't run it yet. Malwarebytes' Anti-Malware 1.33 Database version: 1675 Windows 5.1.2600 Service Pack 2 1/21/2009 9:34:04 PM mbam-log-2009-01-21 (21-34-04).txt Scan type: Full Scan (C:\:D:\:) Objects scanned: 87240 Time elapsed: 42 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 7 Registry Keys Infected: 42 Registry Values Infected: 5 Registry Data Items Infected: 4 Folders Infected: 6 Files Infected: 97 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\tfpborxo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\xxyxXQIX.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ebazok.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\odcoar.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\ozaklo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\vcaofw.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\gwmrlejv.dll (Trojan.Vundo.H) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(0602185b-fd6d-4528-953d-ef635a987872) (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\(0602185b-fd6d-4528-953d-ef635a987872) (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(77ab5974-55a3-4737-9fd5-b93c64307f78) (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(77ab5974-55a3-4737-9fd5-b93c64307f78) (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(bcfcadab-c1b6-49db-97bd-47aad9cfbcba) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(833fb60a-13c0-4078-b34d-7ce7a2f11ee7) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(4fb0a396-c1fe-493e-bb58-5f1443a3f881) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(4fb0a396-c1fe-493e-bb58-5f1443a3f881) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(1ba861b6-3dd0-4922-890d-21291b317fe8) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(0602185b-fd6d-4528-953d-ef635a987872) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(77ab5974-55a3-4737-9fd5-b93c64307f78) (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(9dd4258a-7138-49c4-8d34-587879a5c7a4) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(c3bcc488-1ae7-11d4-ab82-0010a4ec2338) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c) (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\(5b4c3b43-49b6-42a7-a602-f7acdca0d409) (Adware.OneStepSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(9dd4258a-7138-49c4-8d34-587879a5c7a4) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(b8c0220d-763d-49a4-95f4-61dfdec66ee6) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(c3bcc488-1ae7-11d4-ab82-0010a4ec2338) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(000000da-0786-4633-87c6-1aa7a4429ef1) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1039a4b9 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\(0e1230f8-ea50-42a9-983c-d22abc2eeb4c) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\(0656a137-b161-cadd-9777-e37a75727e78) (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11502311588515100851184273869642 (Rogue.Antivirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\xxyxxqix -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyxxqix -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Agent) -> Data: digeste.dll -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Application Data\GetModule (Trojan.Agent) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\xxyxXQIX.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\XIQXxyxx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\XIQXxyxx.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\rxgpfbhs.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\shbfpgxr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tfpborxo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\oxrobpft.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\gwmrlejv.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ebazok.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\odcoar.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\ozaklo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\vcaofw.dll (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Lee\Local Settings\Temp\TDSS8690.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Local Settings\Temporary Internet Files\Content.IE5\1QBCIGR8\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Local Settings\Temporary Internet Files\Content.IE5\1QBCIGR8\index[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Program Files\GetModule\GetModule32.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(052FFA65-6E8F-4958-9CC5-BC64FB6071A1)\RP343\A0023178.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(052FFA65-6E8F-4958-9CC5-BC64FB6071A1)\RP343\A0024214.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\oywsvrto.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSScfgb.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSnrsr.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSoeqh.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\oducixko.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wpv761229907443.cpx (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\digeste.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cfuvrkap.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\chawnvcv.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vgsdlxhp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mikwdshd.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\TDSSpaxt.sys (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSosvn.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ieupdates.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ (Fake.Dropped.Malware) -> Delete on reboot. C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Documents and Settings\Lee\Local Settings\Temp\TDSS85a6.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSfpmp.dll (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSStkdv.log (Trojan.TDSS) -> Quarantined and deleted successfully.
...See More
fake security virus got me, help please
Q
Comments (29)
@susieq07, Someone needs to put you in your place. And I'm going to do it! What you are doing is down right wrong. You have not been professionally trained in the removal of malware. If you would have jumped in earlier and told her to boot to Safe Mode and run MBAM this is what would have happened. All programs would have been gone and the malware would have won! Some malware does not even run in Safe Mode. Most of the threats now days installs a rootkit. Tell me..how do you remove a rootkit? If your are as good as you think you are then you would know the answer! If you were a professional then you would know that ASC is bad because it includes a Registry cleaner. A professional would never use that program. Oh an susieq07, Security Tool IS NOT A VIRUS!!! IT IS A ROGUE PROGRAM. Weren't you told that before? There is a really big difference between a Virus and a Rogue program! If you don't know the difference you are doing an injustice to the Seniors you think you are helping!!! See below for definitions of several different types of malware. http://in.answers.yahoo.com/question/index?qid=20110404055408AAZVTKy I'm sorry everybody, but I can not stand around and allow someone who thinks they know what malware is all about take advantage of the uneducated, especially when it involves the elderly. They are the most trusting people in the world. Someone has to protect/educate them to be aware of those who think they know what they say they do. Please accept my apologies. Here is a link that might be useful: Remove Security Tool
...See More
ravencajun Zone 8b TX
15 years ago
that is the antivirus xp infection do not touch anything on it. do NOT buy itYou will need to install and run some programs to clean the infection off of your pc. Just by having clicked on it you likely are now infected with this horrid malware.
You need to download, install, update and run these programs, have them clean what they find. You must run all of them and follow these directions.

http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25
Please download ATF Cleaner by Atribune from http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25 . Save it to your Desktop.

Run ATF Cleaner

* Double-click ATF-Cleaner.exe to run the program.
* Click Select All found at the bottom of the list.
* Click the Empty Selected button.
* Click Exit on the Main menu to close the program.
* Shutdown/restart the computer.
select it for the various browsers you are using.

Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
* Please post contents of that file in your next reply.

SUPERAntiSpyware Free Edition

do all three, let me see the log, then I can tell you what to do next.
this is a very very serious infection, the antivirus xp is not a real program what you saw pop up was not really anything that was on your pc it was just a fake picture they put up to make you think your pc is infected and they want you to fall for it and give them your credit card info.
All the programs I listed for you are free please do those now.
Terrapots
Original Author
15 years ago
Thank you for the prompt replies. I've printed raven's instructions and will try to do all of them ASAP. I did shut down my computer because I was afraid of the trojan warning, not knowing what it was capable of. Should I download these three programs on my laptop, copy to CD and just start the desktop in safemode to run the scans?
ravencajun Zone 8b TX
15 years ago
you can certainly do that, or you can go ahead and try downloading them directly onto that pc, however in many cases the infection does stop you from accessing those types of sites so that you can not get the needed program. But you can try it and if it does not work then getting them from another pc will be fine. You can run them in safe mode if you feel confident do so, they should run fine and work in regular mode unless it finds some part of the infection that it can not delete unless it is inactive which would require doing it in safe mode. So you can try it regular mode if it all goes fine ok if it says it could not delete something retry in safe mode.
Let me know how it goes.
Terrapots
Original Author
15 years ago
Ran all three programs. I already had Superantispyware free on my computer and ran that first. It didn't find anything but cookies, which it deleted. Note: I had just run Superantispyware when I started my computer yesterday.
Next downloaded and ran Malewarebytes' Anti-Malware and ran the full scan.

It paused and there was displayed over its screen this message: Content IE5\ZVLJ35OW\freescan[1].htm Virus found Fakealert

I chose "move to vault", clicked the red X and went back to scanning. At end found nothing about a vault and was advised no threats found. This is what the log looked like when it finished.

Malwarebytes' Anti-Malware 1.30
Database version: 1412
Windows 5.1.2600 Service Pack 2

11/19/2008 12:30:38 PM
mbam-log-2008-11-19 (12-30-38).txt

Scan type: Full Scan (C:\:)
Objects scanned: 138863
Time elapsed: 38 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Then downloaded and ran the ATF cleaner. Didn't get any frightening message other than it freed 491,594 Mbs.

So far the only thing that has popped up which it has been doing since I installed the Superantispyware free edition is the IE screen with TrendMicro antivirus is nolonger supported and I can buy TrendMicro antivirusplus/antispyware for X$$. This has been happening every time I turn on my computer. Very annoying but I don't think it has hurt anything. I could be wrong.

When the security warning came up yesterday, I did not click on anything, just cautiously ran away, so maybe the damage was averted. Thank you so much for your help. You have saved my bacon more than once! Will post again if this comes back.

I notice CAsalmedia screen saver ad is still with me down on the lower bar.

What should I do with Defender Pro 2008? It's supposed to very good but it tells me to "uninstall any antivirus before installing DP2008". As I understand it, these three programs above, are not running all the time?
ravencajun Zone 8b TX
15 years ago
you can safely keep the 3 I mentioned they do not run at all until you choose to run the scan (always hit update prior to scanning) so definitely keep those and run about once a week. It sounds like you got very lucky when you did not click on it YEAAA!!! for you. That is exactly what you want to do just either turn off the pc or close out the browser itself. If that is all malwarebytes found it sounds like you are ok.

for the casalmedia can you go to start, add remove programs and see if you find anything relating to that at all and if so remove it, look for anything unfamiliar, you can always google what you are not sure of to see if it is a legit program.

If you are no longer using trend micro you can also remove it from add remove and that should stop any of the pop ups.

ok I did some research on that defender pro 2008 here is one site that has several people commenting on how it messed up their systems.
Defender Pro 2008 Complaint scroll to user comments

I am actually very surprised about this because once I read that it was bitdefender I thought oh ok good product because bitdefender has always had a good reputation but the reviews of this particular version are not good. I really can not tell you what to do here at all, from what I know of bitdefender it is a legit and good program but sometimes good ones can go bad. Is this the one that you have this one that is at Amazon?
here are several customer reviews at Amazon, some good some not good.
Customer Reviews

If you choose to remove it you may need something like REVO unistaller free to help you get rid of it. Let us know what you decide. Totally up to you. there are good free alternatives like AVAST.
Important thing is to only have one antivirus program running actively at a time.
ravencajun Zone 8b TX
15 years ago
Just to make sure I made this point clear the reason the defender is telling you that about must remove other antivirus is because you need to have only one antivirus program on your pc. some will not even let you install them if it senses another antvirus and this one apparently does that, so yes you will have to remove completely all other av programs then do your install of the defender pro or which ever AV you choose to use.
Here is the link to the free REVO uninstaller should you decide you want to use it.
Revo Uninstaller
it has very good detailed instructions for each aspect on the website just click on the more info for each section to get to the user guides.
ravencajun Zone 8b TX
15 years ago
you know what I think we may have some different programs here with very similar names and some are good programs and some are scams trying to fool people. I need to know exactly what the name of that programs is and where you got it, if you can find a picture of it that would be good too. This is a rogue program with a very similar name and if this happens to be the one you have then you definitely do NOT want this thing. Lets make absolutely certain what program we are dealing with ok.
PC Defender 2008

Look at what you have and try to find it online and give me a link to it so I can see what one you actually have. I sure would not want to tell you one is ok when in fact that is not what you have.
Terrapots
Original Author
15 years ago
Thank you, Raven for looking that up. The name of the program is Defender Pro 2008. I didn't install it. I purchased it at Walmart after reading on a blog how good it was for a problem like mine. It's web site is Defender-Pro.com. I checked a few of the comments on google and decided to return it. The box says I can simply return it within 30 days for a refund. It's supposed to be antivirus, anti-spy, firewell, ID theft, PC repair. It has a pic of a shield on the box with 5-in-1, the web site is offering one that's 15-in-1. Here's a link to it.

http://defender-pro.com/?a=3691

I never had Trend Micro or even heard of it. There is no program like this in the add/remove site. I think this was connected to the download for Superantispyware. If I remember right, it's trying to sell me Superantivirus. It has also tried to come up when I open IE but the popup blocker brings it down. It always comes up after I start the PC. I slap it down and it doesn't usually come up again.

Thank you for taking all this time with my problems.

MS Security Warning -- Trojan = infostealer.banker.s

Comments (10)

bpgreen

cynic

Related Discussions

ravencajun Zone 8b TX

Terrapots
Original Author

ravencajun Zone 8b TX

Terrapots
Original Author

ravencajun Zone 8b TX

ravencajun Zone 8b TX

ravencajun Zone 8b TX

Terrapots
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

MS Security Warning -- Trojan = infostealer.banker.s

Comments (10)

bpgreen

cynic

Related Discussions

ravencajun Zone 8b TX

TerrapotsOriginal Author

ravencajun Zone 8b TX

TerrapotsOriginal Author

ravencajun Zone 8b TX

ravencajun Zone 8b TX

ravencajun Zone 8b TX

TerrapotsOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Terrapots
Original Author

Terrapots
Original Author

Terrapots
Original Author