Spyware, viruses, & security forum: Windows Security Center - Fake Pop-ups

Dear
Marianna Schmudlach

THANK YOU SOOOO MUCH, I never sign up to fourms really but these instructions were that great i just want to thank you.

I thought i was doomed and going to have to restore my pc and lose everything but all is fine so i just want to say thank you as i could not even use the internet as it keeped locking up and the spaming of all the ads was horrible so thank you soo much

Best Regards

My In-laws have seemingly dozens of infections. They have McAfee running and I added Malaware Anti-Malware and Spy Hunter and PC Tools but they still keep getting these damn things. (I don't know what they do...) The latest is a window that looks like Windows Security Center. I tried the above steps, but it tries to stop the scan by giving me a warnign that a "buggy program" is running. When I click that away it runs for a short time longer, then re-boots. The scans never finish. I was able to go into regedit and re-enable task manager, but none of the listed processes are running. I also used msconfig to terminate most of the programs that run on startup. Any more suggestions? Thanks!

I did dl HJT and ran scan. I can't get the txt file from their computer to mine to upload it. I read the posts explaining how to use combofix, but can not find where to download it. I get messages saying it was withdrawn due to a security problem.

I did get to a certain point- I tried using task manager to end processes to see which one eliminated the security center icon from the task bar. At one point I got a box saying the system would be shut down due to a security violation, authority: NT Adminstrater.

The scans I run get a message: System unstable: "Windows has been shut down buggy program to prevent.." Real good English. Then I get the same System shutdown box above. It all happens too fast to get a good read on it.

I'll try to get the HJT Log file posted soon. Thanks for any suggestions.

How to start Windows in Safe Mode

1. Download SmitfraudFix (by S!Ri) to your Desktop (Win2k/WinXP only!).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

How to extract (decompress) zipped or compressed files
www.lvsonline.com/compresstut/index.shtml

Note : process.exe is part of the SmitFraudFix tool and is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky, Panda, AVG) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

2. Reboot into Safe Mode
You can usually do this by restarting your computer and continually tapping F8 until a menu appears. Highlight Safe Mode and hit enter.

3. Once in Safe mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.

Does that work?

I was able to do it that way! I also ran the Malwarebytes you said to run in the first post... it's done and it cleaned it all out. Everytime I start my computer though, three error messages come up. All of them are the same except they are for different programs:

The following error occurred and had to shut down....
Fax Man Server
Persistent Module
Device Monitor

Is that due to this as well? Is there any way to fix that problem?

Also, I was able to access the internet through work and hook my laptop up to the DSL, but at home I can't get it to work with my cable connection? It doesn't detect it or something... I don't really know what to do about that.

Thank you for the help with Smitfraud and Malware bytes... the 3 icons are gone and it no longer redirects me to any other sites. I can't tell you how much you have helped me... My summer semester with school starts on Monday so you have been a life saver!!

Dear Marianna,

You, my amiga, are not only absolutely brilliant...but are also a very professional, polished and eloquent sweetheart of an individual for having invested so much time/effort into the respective QUALITY post.

You've helped me tremendously and I'm beyond grateful; wishing there was a way to reciprocate! People like you are rare, precious souls indeed ^_^

All the best,

Brady