system
November 20, 2008, 11:22pm
1
PLease help me - I have no idea what to do.
I keep getting the above warning mentioned in the subject line
The rest of the box says
File name: hXXp://protectionlive-scan.com/2009/1/e/_freescan.php?nu=77052
Other problems I am having are:
I am getting error 1058 - service cannot be started. This is when I and try and turn my windows automatic updates back on. They say they are on but the actually aren’t
Also getting heaps of pop ups
Any advice would be appreciated!!
Thanks
DavidR
November 20, 2008, 11:32pm
2
That is because it is a rogue site that will try to infect you.
Don’t visit the site, why are you visiting the site ?
I suspect because you are getting a pop-up saying your system is infected and should visit the site ?
If so this is a scan to get you to visit the site (they succeed there) and this could then infect your system properly had avast not blocked it, or they would try to get you to pay for a clean-up or the program for a non-existent problem.
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
SUPERantispyware MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe , right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
system
November 21, 2008, 12:50am
3
Hi thanks for your reply
It took a long time but here is the log (part 1)
SUPERAntiSpyware Scan Loghttp://www.superantispyware.com
Generated 11/21/2008 at 11:41 AM
Application Version : 4.22.1014
Core Rules Database Version : 3645
Scan type : Quick Scan
Memory items scanned : 361
Trojan.Vundo-Variant/Packed-GEN
Rogue.AntiVirus 2009
Adware.Vundo/Variant-Greek
Adware.MyWebSearch
system
November 21, 2008, 12:52am
4
Part 2
Adware.Tracking Cookie
Adware.MyWebSearch/FunWebProducts
Unclassified.SpywareBot (Not A Threat)
Adware.Vundo Variant/Rel
Rogue.Component/Trace
DavidR
November 21, 2008, 1:47am
5
The Rogue.AntiVirus 2009 and Rogue.Component part is most likely what would have been trying to get you to that URL. On that subject, please modify your first post so the URL to the suspect site isn’t active to avoid accidental exposure. Change the http to hXXp that breaks the link, se example below.
hXXp://protectionlive-scan.com/2009/1/e/_freescan.php?nu=77052
Well the previously undetected vundo infection was no doubt responsible for the pop-ups, hopefully they will be history when you have SAS quarantine them.
Tracking cookies are a minor privacy issue and not a security issue, I normally disable this part of a scan in Preferences, Scanning Control tab. Periodically clear your cookies and have your browser only accept cookies from the site you are visiting and not third party cookies.
The MyWebSearch adware is a minor one but you should still get shot of it.
Once you have allowed SAS to deal with ‘all’ of those detected, reboot and scan with MalwareBytes AntiMalware and post the results.
system
November 21, 2008, 10:55am
6
Hi - thanks again.
This is the log from the malwarebytes…
alwarebytes’ Anti-Malware 1.30
Memory Processes Infected: 0
Memory Processes Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
system
November 21, 2008, 10:55am
7
Part 2
Files Infected:
DavidR
November 21, 2008, 3:22pm
8
Well this shows the benefit of using two program scans as the other may detect more or find things unhidden/revealed by the previous scan. Strange that mywebsearch is there since SAS also picked this up.
You will have to run MBAM again as the No action taken means they are still there (this report being generated after closing the scan). By default all those detected will have a check mark to the left of the entry (selected), if not select all the items and click the Remove Selected button. That puts a copy in quarantine and removes the original, see image.
Now reboot and do another scan with avast.