Re: malware affecting IE7 on XP

Yes, I still don't have MRT and I will get the appropriate measures into
place. Thank you.


"Richard Urban" <richardurbanREMOVETHIS@xxxxxxxxxxx> wrote in message
news:O2kwyyKfJHA.1252@xxxxxxxxxxxxxxxxxxxxxxx
I heartedly suggest that you allow the updates to be installed
automatically, at whatever time you choose. Otherwise you may not be at the
computer to see the prompt telling you to install them NOW! You obviously
did not have an up to date system and were vulnerable - as you have found
out.


--


Richard Urban
Microsoft MVP
Windows Desktop Experience


"John" <noreply@xxxxxxxxxxx> wrote in message
news:uZeURHVeJHA.5420@xxxxxxxxxxxxxxxxxxxxxxx
Actually, MBAM worked. However, to get it to work I had to...

Go to Start > Control Panel > Folder Options and set it to show hidden
file types, and not to hide extensions or system files

rename the installer

install it in safe mode

reboot in normal mode

right-click the desktop icon and find the path to the MBAM target
executable

browse to and rename the target executable and double-click on it

After that all I had to do was reboot after it was finished and then
connect to the update server and I did get some updates, which means I
should probably run it again.

Thanks everyone. Your help is priceless and you provide an amazing
resource.


"Richard Urban" <richardurbanREMOVETHIS@xxxxxxxxxxx> wrote in message
news:e0PAtLUeJHA.5288@xxxxxxxxxxxxxxxxxxxxxxx
Here is the download link I forgot to post.
http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

--

Richard Urban
Microsoft MVP
Windows Desktop Experience


"John" <noreply@xxxxxxxxxxx> wrote in message
news:#XdA7sTeJHA.6012@xxxxxxxxxxxxxxxxxxxxxxx
Hmmm...

Well I set Automatic Update to run at 2am and I guess I'm not supposed
to be prompted but I still don't have a file called mrt.exe. I also
can't browse to the Windows Update site.

"Richard Urban" <richardurbanREMOVETHIS@xxxxxxxxxxx> wrote in message
news:Okhl3SQeJHA.1272@xxxxxxxxxxxxxxxxxxxxxxx
This sounds surprisingly like the worm (called "Downadup" or
"Conficker") that has infected 9 million computers to date.
http://www.msnbc.msn.com/id/28708241/

If so, shame for not installing your Window updates in a timely
fashion. There was a patch issued to prevent this in October.

The latest version of the Microsoft Malicious Removal Tool, issued on
the 2nd Tuesday of this month, will clean this out. You DID get
January updates right? If so, search for mrt.exe and run the program
from your computer. It will remove this and you should be golden.


--

Richard Urban
Microsoft MVP
Windows Desktop Experience


"John" <noreply@xxxxxxxxxxx> wrote in message
news:uzd5YbNeJHA.5344@xxxxxxxxxxxxxxxxxxxxxxx
I seem to have some kind of malware affecting IE7 & Firefox on my PC
w/ XP. Does anyone recopgnize this? I have Avira AntiVir, been
updating it every day and scans don't detect anything.

I am not able to browse to certain sites like avira.com, avg.com, and
other anti-virus sites. With IE7 I get redirected to a Google page
and w/ Firefox a "page load error" screen saying that the browser
"failed to connect".

If I type www.avira.com into IE7 I am redirected to a Google search
page at this URL (I don't advise clicking it):

http://www.google.com/search?q=www.avira.com&rls=com.microsoft:en-us&ie=UTF-8&oe=UTF-8&startIndex=&startPage=1

If I click the link to avira.com from that page, it takes me to this
URL (again, I don't advise clicking it):

http://go.google.com/?u=00a3f63266b79fba1460d70932ff%3Dc%3Fphp.kcilc%2F84.822.19.77&bid=0.027225&aid=61&said=v300&mppc=234

Then a page saying that I have security problems pops up, and prompts
me to download security updates, and IE puts up a messsage bar saying
that it has blocked the site from downloading files, as you can see
in the screen capture here (feel free to click this one):

http://productivitymuse.com/screenshot_090117.jpg

The URL of the page in the screen capture is (don't click it):

http://scan.antispyware-pro-scanner.com/243/3/

Does anyone know what could be causing my browser to redirect like
this and how to correct it?

An adjunctive problem is that Spybot S&D won't start. When I click
it, I get an hourglass for a few seconds and then nothing happens.
When I go into Task Manager it does not show Spybot running.

All of this started happening late Wenesday night (possibly after
midnight) after the Windows Security Center popped up and told me
that I had the zafi.b worm. A scan w/ AntiVir made detected and
deleted some files and the zafi.b warnings went away, but obviously I
still have something. I installed AVG as well, and it didn't find
anything and wouldn't connect to the update server.

Thanks for any advice.

Here's some info on the registrant of the site that is trying to
download files to my computer. Notice that the domain was just
published on 1/15/09. The site is also self-hosted, which means that
Mr. Mott from Detroit Michigan 48204 (not Mississippi) can have
anything he wants on his server...

Registration Service Provided By: ALVO BUSINESS SOLUTIONS, CORP.
Contact: +1.8662097142

Domain Name: ANTISPYWARE-PRO-SCANNER.COM

Registrant:
N/A
Deron Mott (deronmott@xxxxxxxxx)
Fremont St. 91 21
DETROIT
Mississippi,48204
US
Tel. +131.433437

Creation Date: 15-Jan-2009
Expiration Date: 15-Jan-2010

Domain servers in listed order:
ns4.alvobs.com
ns3.alvobs.com
ns2.alvobs.com
ns1.alvobs.com













.

Relevant Pages

  • Re: Updater wont tell me updates are available
    ... MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 ... I did a repair install as the system seemed to be getting a bit 'clunky', ... When I installed Sp3 it was via the custom button on updater. ... In security centre windows firewall is on, ...
    (microsoft.public.windowsupdate)
  • Re: Updater wont tell me updates are available
    ... MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 ... I did a repair install as the system seemed to be getting a bit 'clunky', ... When I installed Sp3 it was via the custom button on updater. ... In security centre windows firewall is on, ...
    (microsoft.public.windowsupdate)
  • Re: malware affecting IE7 on XP
    ... rename the installer ... Windows Desktop Experience ... Then a page saying that I have security problems pops up, ... that it has blocked the site from downloading files, ...
    (microsoft.public.security.virus)
  • Re: Trouble with automatic updates
    ... of your questions, pa bear, i had to manually install the vista sp1 update. ... MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 ...
    (microsoft.public.windowsupdate)
  • Re: Need Service Packs
    ... MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 ... AumHa VSOP & Admin http://aumha.net ... If I only download SP3 will that also install the others as well? ...
    (microsoft.public.windowsupdate)
Loading