topic Re: Virus posing as security software - can't kill in Operating System - Microsoft

Virus posing as security software - can't kill

king144 — Fri, 26 Jan 2007 01:08:05 GMT

Have had this guy stuck on my MSEI browser for several weeks now. Can't get it to go away. Reported it to McGaffy & US Gov dept of Security - no reponse. HP & MGaffy scans don't find anything wrong...!

Every time I click home key on browser it takes me back to the below listed un-welcome security advertising page. My browser shows Goggle as my assigned home page, but still "defaults" to 'asecureboard' screen page anyway.

Any clues as to how to kill this thing? Seems to come from Rumania...?

This is culprit:

http://asecureboard.com

Regards,

Richard Anderson

Re: Virus posing as security software - can't kill

Yogeeraj_1 — Fri, 26 Jan 2007 04:26:30 GMT

hi Richard,

can you try to verify your registry?

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com/"

kind regards
yogeeraj

Re: Virus posing as security software - can't kill

Peter Godron — Fri, 26 Jan 2007 04:53:57 GMT

Hi,
and welcome to the forums !

McAffee has the solution:
http://forums.mcafeehelp.com/viewtopic.php?t=101014

And many others returned by web search.

Please also read:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33 on how to reward any useful answers given to your questions.

Re: Virus posing as security software - can't kill

Ron Kinner — Fri, 26 Jan 2007 10:57:57 GMT

Smitfraudfix will probably fix the problem but it is NOT a McAfee program. It's from a guy in France who goes by S!R1. I use it all of the time over on the DELL Hijackthis forum.

Bleepingcomputer has a nice writeup on how to use it (as part of a tutorial on how to kill a similar infection).

http://www.bleepingcomputer.com/forums/topic70074.html

It usually creates a log file at C:\rapport.txt. Would not hurt to check it to see if complains of any files it can't fix.

When you finish with SmitFraudFix get Hijackthis.exe from

http://tomcoyote.org/hjt/hjt199//HijackThis.exe

(above is the direct download link. If you want to see the site you are getting it from:

http://tomcoyote.org/hjt
)

Save it to your desktop with a new name like Richard.exe then run it. Select the top option (Scan and Save Log) then when notepad comes up with the log, copy the text and paste it in your next Reply. Let me check it to make sure you got it all. Lately a lot of the smitfraud style infections are combined with a vundo infection which likes to give you popups and I expect can also invite its friends in. It also hides if it sees a program named Hijackthis running.

Ron

Re: Virus posing as security software - can't kill

king144 — Sat, 27 Jan 2007 00:28:44 GMT

Holy Bat Goop! It's gone!!!

Thanks fellers!

Only residual damage was Desktop background had to be reset. Downloaded suggested scan tool - found nothing I recognize as suspicious, so left things alone...

-Richard
Washougal, WA