Fake Windows security center

Re: Fake Windows security center5th February 2010, 6:13 pm

Hmm, that thing doesn't wanna leave without a fight.

I notice that you never scanned with an Antivirus previously before starting this thread - because you don't even have an Antivirus installed!
This is somewhat suicidal in today's digital world. That's why I want you to install one first!!

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

It really makes no sense otherwise that we clean this up manually if an antivirus is not present which should be able to deal with most and prevent further reinfection.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Registry keys to delete:
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\_VOIDd.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

Under "Input script here:", paste in the script from the quote box above.
Leave the ticked box "Scan for rootkit" ticked.
Then tick "Disable any rootkits found"
Now click on the Execute to begin execution of the script.
Answer "Yes" twice when prompted.

The Avenger will automatically do the following:
It will Restart your computer.
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

4. Please copy/paste the content of c:\avenger.txt into your reply.

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
Fake Windows security center - Page 1 DXwU4

Fake Windows security center - Page 1 DXwU4

Fake Windows security center - Page 1 VvYDg

Re: Fake Windows security center5th February 2010, 7:45 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Registry key "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\_VOIDd.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Re: Fake Windows security center5th February 2010, 7:51 pm

Goodbye malicious registry key. Roger that

Okay, lets try MBAM now.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
Fake Windows security center - Page 1 DXwU4

Re: Fake Windows security center6th February 2010, 9:12 pm

Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/6/2010 1:10:14 PM
mbam-log-2010-02-06 (13-10-14).txt

Scan type: Quick Scan
Objects scanned: 116761
Time elapsed: 11 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Looks great! It appears the problems have been solved and I am now rootkit free. Thank you!!!

Re: Fake Windows security center7th February 2010, 1:00 am

Yep, this looks good now.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

Check (tick) this box: YES, I accept the Terms of Use.
Click on the Start button next to it.
When prompted to run ActiveX. click Yes.
You will be asked to install an ActiveX. Click Install.
Once installed, the scanner will be initialized.
After the scanner is initialized, click Start.
Uncheck (untick) Remove found threats box.
Check (tick) Scan unwanted applications.
Click on Scan.
It will start scanning. Please be patient.
Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
Fake Windows security center - Page 1 DXwU4

Re: Fake Windows security center7th February 2010, 9:48 pm

I get to the step where I click on start, but after that, it waits a while, and never loads. In the bottom left corner of IE it says waiting for the url, then it loads the status bar the whole way, then says done. Eventually IE just closes itself down.

Re: Fake Windows security center7th February 2010, 11:44 pm

Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
Fake Windows security center - Page 1 DXwU4

Re: Fake Windows security center9th February 2010, 9:30 am

It says that the online scanner is unavailable, am I to download a trial of their Internet Security or Anti-Virus programs?

Re: Fake Windows security center9th February 2010, 6:45 pm

Moderated Message: Hello, your comment has been removed. Please do not post in another member's topic. If you need help, please read this over and click here to open a new topic.

Fake Windows security center

descriptionRe: Fake Windows security center5th February 2010, 6:13 pm

descriptionRe: Fake Windows security center5th February 2010, 7:45 pm

descriptionRe: Fake Windows security center5th February 2010, 7:51 pm

descriptionRe: Fake Windows security center6th February 2010, 9:12 pm

descriptionRe: Fake Windows security center7th February 2010, 1:00 am

descriptionRe: Fake Windows security center7th February 2010, 9:48 pm

descriptionRe: Fake Windows security center7th February 2010, 11:44 pm

descriptionRe: Fake Windows security center9th February 2010, 9:30 am

descriptionRe: Fake Windows security center9th February 2010, 6:45 pm

descriptionRe: Fake Windows security center

Re: Fake Windows security center5th February 2010, 6:13 pm

Re: Fake Windows security center5th February 2010, 7:45 pm

Re: Fake Windows security center5th February 2010, 7:51 pm

Re: Fake Windows security center6th February 2010, 9:12 pm

Re: Fake Windows security center7th February 2010, 1:00 am

Re: Fake Windows security center7th February 2010, 9:48 pm

Re: Fake Windows security center7th February 2010, 11:44 pm

Re: Fake Windows security center9th February 2010, 9:30 am

Re: Fake Windows security center9th February 2010, 6:45 pm

Re: Fake Windows security center