insecure internet browsing AND windows security messages? PLEASE HELP

Viruses and worms
1

Hi! I’m new so please bear with me…

Every time pull up mozilla internet, I get this message:

Insecure Internet activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes.
Also insecure Internet activity can result in revealing your personal information.
To get full advanced real-time protection for PC and Internet activity, register your antivirus software.
We recommend you to protect your PC now and continue safe Internet browsing.
Click here to get full advanced real-time protection and continue browsing.
Continue to this website unprotected (not recommended).

OK… so when I go to download it, AVAST gives me a warning that it is malware and move to chest immediately. It also tells me to abort connection immediately.

I read on this forum that the message is a scam? How do I get rid of the message though?

ALSO… I am getting this message from Windows Security Center about a threat…

To help protect your computer, windows firewall has blocked some features of this program.
Do you want to block this suspicious software?
Name: Win32.Zafi.B
Risk Level: High
Description: Zafi.B is a worm trojan program that records keystrokes and takes screen shots of the computer, stealing personal financial information.

Keep Blocking (n/a) Unblock (n/a) Enable Protection (only button you can press)

Windows Firewall has detected unauthorized activity, but unfortunately it cannot help you to remove viruses, keyloggers and other spyware threats that steal your personal information from your computer. Click to download and activate protection.

If I click to download and activate protection, it brings me to the same damn page to download this software which in turn fires up Avast to immediately abort and move to chest.

My questions:
1.) Is the scam activating my security center to try to get me to download this? (In other words, is Zafi.B a FAKE trojan warning?)
2.) Am I really at risk or is it all just fake messages?
3.) If so, how do I get rid of all these warnings?

Thank you for any help! I don’t know where to begin!

2

Hi ecorroa0611,

I think the first message is fake. The second may be real, I’m not sure. The best thing to do is run some scans.

First try a boot time scan with avast! Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested. (Or open the tab at the top left of the scanner screen and select the boot time option from there.)

Then try these free virus scanners:

DrWeb CureIT!
Kaspersky Virus removal Tool

Try these free adware/spyware scanners. Download, install and update.

SUPERAntiSpyware Free
Malwarebytes’ Anti-Malware

When you have finished, check for out-of-date and insecure software and update- this will reduce the risk of similar infections.

Secunia Online Software Inspector (OSI)
Secunia Personal Software Inspector (PSI)

EDIT: Typo

3

Thanks so much for the reply! I have taken your advice and ran the virus scanner and the Malwarebytes. It found infected files when I ran the Malwarebytes which I rebooted.

This is my log:

Malwarebytes’ Anti-Malware 1.33
Database version: 1738
Windows 5.1.2600 Service Pack 3

2/7/2009 11:40:54 PM
mbam-log-2009-02-07 (23-40-54).txt

Scan type: Full Scan (C:|D:|E:|)
Objects scanned: 116805
Time elapsed: 36 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 10
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 3
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) → Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt&Search\ (Adware.Hotbar) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) → Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) → Bad: (1) Good: (0) → Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\Admin\Application Data\FunWebProducts (Adware.MyWay) → Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Application Data\FunWebProducts\Data (Adware.MyWay) → Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Application Data\FunWebProducts\Data\Admin (Adware.MyWay) → Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Admin\Application Data\FunWebProducts\rasim.exe (Adware.MyWay) → Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\senekaijelonba.sys (Trojan.Agent) → Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Application Data\Google\pfysw721318.exe (Trojan.FakeAlert) → Delete on reboot.
C:\WINDOWS\system32\senekamqbrsplt.dat (Trojan.Agent) → Quarantined and deleted successfully.

Hopefully, all the pop-ups will stop appearing!