Pop up doesn't go away

[jyeh74]

I keep getting this "Windows Security Alert" indicating there is some trojan. My only option is to "Enable Protection". I'm not even sure if it is legit, because when I click it, it takes me to a screen prompting me to buy some sw. Funny thing is I ran both Adaware and Spybot (full system scans) but it still pops up. Any ideas?

[wtsinnc]

Hello.

Only a guess but it sounds like malware to me. Download/install/scan with this; it's a free application.

http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

[SCDVD]

That's a good one and about the only application that will get rid of it.

[jyeh74]

ok thank you. Adaware and Spybot cant get rid of this? There's just so many programs out there......
btw, I think the free Spybot is better than the free Adaware. The free Adaware doesnt really do anything.

[TBoneit]

That is a fake windows security alert. Yes you have a trojan. The Trojan downloaded the software that is producing the fake alert. Malwarebytes Anti Malware shoul get you started one the cleanup. Then run Spybot Search & Destroy 1.60 and your Antivirus program.

What you have is software that after getting instaled trys to get money from you. You may have visited a website that said you needed to install a codec to view the content whcih is one way that the Trojan is distributed or you may have gotten it from P2P or a E-mail attachment those being popular ways to distribute this Malware Trojan.

You will need to reset your IE security, And yu should make sure that show extensions for known files is on. You will also find that it may have disabled your firewall or the ability to change your wallpaper or other things.

Good Luck

Also try running Super AntiSpyware after Spybot S&D

[Nelson37]

Well, you RAN adaware and Spybot, and it's still there, so that answers that question, now doesn't it?

There are many, many types of malwares that cause this type of behavior, but if it says something like "Windows Antivirus XP Pro 2008 (or 2009), then virtually nothing on the market will touch it. The Malwarebytes prog removes it, has cured about 10 customers so far.

[lacywest]

Spy Emergency 2008 works good ... but I uninstalled it already ... my time ran out ... worked great before my trial period ended but try using it during the time it is working ... came in handy for alot of stuff.

Spyware Doctor 5.0.0.174 FINAL ... works good too

-----------------------------------------------------------------------------------------------

Spyware Doctor 5.0.0.174 FINAL

Best Spyware Protection. Used by Millions World Wide.

Spyware Doctor has been downloaded over 50 Million times; with
a million more downloads every week. Millions of people worldwide
use Spyware Doctor to protect their identity and PC security.

Spyware Doctor has consistently been awarded Editors' Choice,
by leading PC magazines and testing laboratories around the
world, including United States, United Kingdom, Sweden, Germany
and Australia. All current versions of Spyware Doctor have won
Editors' Choice awards from PC Magazine in United States. In
addition, after leading the market in 2005, Spyware Doctor was
awarded the prestigious Best of the Year at the end of 2005.

Spyware Doctor continues to be awarded the highest honors by
many of the worlds leading PC publications such as PC Pro, PC
Plus, PC Authority, PC Utilities, PC Advisor, PC Choice,
Microdatorn, PC Answers Magazine plus number of reputable
5-star ratings including CNET's Download.com and Tucows.

Note : If you are choosing Anti-Spyware make sure you choose
one that is proven and has genuine awards from one or more world
leading research labs such a PC Magazine, PC World, CNET, PC
Pro Magazine, PC Authority, PC Answers and other trusted labs.
More importantly do not use ratings from unknown review
websites, as often these are designed to mislead you into
purchase of affiliated, inferior or rogue product.

Spyware Doctor provides three-way spyware protection for your PC through real-time threat blocking, advanced system scanning and immunization against known browser infections. This is one of the many reasons why the award-winning Spyware Doctor has been chosen by millions of users to protect their PCs against spyware, adware, trojans, keyloggers, spybots and other tracking threats.

Spyware Doctor Tools:
- Spyware & Adware Scanner Keylogger
- Guard Popup
- Blocker Phishing
- Protector Real Time
- Protection Browser
- Guard Spyware Cookie
- Guard Malware
- Immunizer

Spyware Doctor Features:
* Detects and removes malware infections including spyware, adware, browser hijackers, Trojans, keyloggers, dialers and tracking cookies
* Frequent Smart Updates to detect and guard against new infections as well as adding enhancements to Spyware Doctor
* A wide range of sophisticated scanning tools including:
- A Hosts Scanner, which scans the Windows Hosts file for any mappings that may have been altered as a result of malware activities.
- A Browser Defaults, Favorites and ZoneMap Scanner, which determines if malware has altered your browser home page, favorites or has added any malicious sites to your Trusted Sites list.
- A Startup Scanner, which removes references to malicious programs that run at startup in the registry and Windows startup files, as well as malicious files in Windows startup locations.
- State-of-the-art scanning engines, including file scan, memory scan, registry scan, browser helper objects scan, cookie scan and much more.
* The OnGuard feature, designed for continual protection against malware infections and associated activities on your computer
- A patent pending Keylogger Guard tool, which uses behavioral detection as opposed to signature-dependent methods to detect and block keylogger activities on your computer.
- An effective Browser Guard, which scans and removes unwanted Browser Extensions in addition to Browser Helper Objects.
- A powerful Immunizer tool to keep your browsing safe.
- An easy-to-use Popup Blocker.
- A Scheduler, to allow scheduling of a Quick Scan, Full Scan or Smart Update at specified times and intervals.
- A Site Guard tool (Anti-Phishing).
- A Process Guard tool, which prevents known malicious processes from running on your computer.
- A Startup Guard tool, which checks for and removes malicious files that attempt to run automatically on your system when Windows starts up.
* Ability to quarantine and restore items that have been detected

Spyware Doctor allows you to remove malware infections from your system that have been detected in a scan, or quarantine them into a contained area. The majority of infections that have been quarantined can be restored at a later time for example. You can customize Spyware Doctor to either remove or quarantine malware items fixed in a scan.

Spyware Doctor 5.0 designed for Windows Vista™, XP and 2000

[Nelson37]

Since you put the whole ad in, I will respond to that.

I have had at least three customers with Spyware Doctor wherein a problem with an update resulted in an almost completely unresponsive PC. No other issues found, removal of Spyware Doctor completely cured the problem. I will under no circumstances recommend this software and strongly suggest its immediate removal whenever I find it on a system.

[SLK001]

Sounds like you are getting something using Windows Messenger Service (this exploit was really common 5 to 6 years ago). The best way to get rid of this is to disable the service (most people don't either use or need it).

I don't believe that it is either a trojan or a virus - just an annoying ad.

CONTROL PANEL > ADMINISTRATIVE TOOLS > SERVICES - double click on "MESSENGER" and disable it.

[TBoneit]

Sounds like you are getting something using Windows Messenger Service (this exploit was really common 5 to 6 years ago). The best way to get rid of this is to disable the service (most people don't either use or need it).

I don't believe that it is either a trojan or a virus - just an annoying ad.

CONTROL PANEL > ADMINISTRATIVE TOOLS > SERVICES - double click on "MESSENGER" and disable it.

If it is the one I've seen here it is installed by a Trojan. Some of these things change the wallpaper and disable your ability to change it back. I've seen them where they disable just about anyway you can think of to cure the computer. When you click start there will be no programs, no My computer, no Run box etc. The Windows Messenger Service thing was fixed in one of the service packs so unless the computer hasn't been updated that shouldn't be it.

The newer crop of Malware has shifted to trying to make money directly rather than just making it from advertising.

[SCDVD]

You are getting a whole bunch of BAD advice. You have a VERY nasty Trojan. Spyware Doctor will NOT get rid of it. It removes part of it but the next time you reboot it WILL be back. Don't go farting around with your Windows Messenger Service either it won't fix anything! Just run MalwareBytes from the above link and it will completely get rid of your Trojan.

[jyeh74]

Hello.

Only a guess but it sounds like malware to me. Download/install/scan with this; it's a free application.

http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

wtsinnc, this requires me to purchase it.

[jyeh74]

Sounds like you are getting something using Windows Messenger Service (this exploit was really common 5 to 6 years ago). The best way to get rid of this is to disable the service (most people don't either use or need it).

I don't believe that it is either a trojan or a virus - just an annoying ad.

CONTROL PANEL > ADMINISTRATIVE TOOLS > SERVICES - double click on "MESSENGER" and disable it.

I just went here and "start up type" under MESSENGER is already disabled. I just changed "log on" to disable too.

[TBoneit]

Download and install the MalwareBytes Anti Malware it does run in free mode. Install it, let it update then do a Full scan, don't mess around trying to save time by doing the Quick Scan.

The latest version is 1.28. I have used this program to clean up exactly what you have it should do it. Just to be sure Also run the Super AntiSpyware after Spybot S&D. Spybot S&D can undo changes made to some important settings if needed. I suspect that you will find that each program finds a few things the others missed. Don't forget to Also do a Full Antivirus scan too.

[TBoneit]

You are getting a whole bunch of BAD advice. You have a VERY nasty Trojan. Spyware Doctor will NOT get rid of it. It removes part of it but the next time you reboot it WILL be back. Don't go farting around with your Windows Messenger Service either it won't fix anything! Just run MalwareBytes from the above link and it will completely get rid of your Trojan.

I'm afraid I wasn't clear in one of my posts. You are correct that the MalwareBytes is the best way.Where I messed it up was not saying explicitly to run other programs after running MalwareBytes.

to the OP whatever you do avoid giving those morally defunct cretins that created this nasty your credit card number or any money in any way shape or form.

Cheers

[SCDVD]

to the OP whatever you do avoid giving those morally defunct cretins that created this nasty your credit card number or any money in any way shape or form.

Cheers

Amen to that. These lowlifes are doing kidnapping and extortion. You really don't want to give a criminal your credit card number! And if you do - Surprise, you will still have the virus!

[redwudz]

My brother-in-law had a similar trojan about six months ago. The computer shop just wiped the HDD and reinstalled Vista. A bit severe.

He was surprised Vista by itself didn't block it. I now have him set up with a bit better security suite. I use Comodo, Avast, Spyware Blaster and Spybot, besides the router firewall. I have used MalwareBytes and I highly recommend it. It found malware that the others had missed.

Probably one good lesson from this thread is not to panic when you get a problem like this. Evaluate and seek advice before you make any changes. I also use Acronis to back up my OS, so if the worst happens, I can still recover with the least amount of effort.

[train82499]

I had this and tried everything and nothing worked. It is a real pain, and I ended up in the shop which for $90 got rid of it. I had Norton Corporate Edition by the way which failed to stop this. I was recommended to use and now have Kaspersky which hopefully will keep this out. This trojan screws up so many things and the more you try to fix it the worse your PC gets. Take it in is my advice - I spent about 7 hours on it following advice from everywhere including the free downloads to absolutely no avail. It removed the restore point function. It is a devil. Good luck.!

[joytimeday]

That's really bad, hope I won't in that kind of trouble.

[MJA]

train82499 .what did u downloaded to get this kind of Trojan? stuff like this doesn't come from no where.you have to download/visit a shitty site to get infected .


jyeh74.I know you are sick of all the advices if MalwareBytes doesn't work. uninstall you antivirus ,and disable system restore and install a free 30 day trial of NOD32.

[wtsinnc]

jyeh74;

The links at www.majorgeeks.com will allow you to download the latest free version of Malwarebytes. If you choose to upgrade to the paid version you may do so from the free version GUI and add real-time scanning, automatic updates, and scheduled scanning. Personally, I stay with the free version as I'm typically very conscientious about regularly scanning for malware.

Another good application you might want to investigate is A-Squared Free which can be downloaded from any number of locations; I recommend Major Geeks or www.filehippo.com as their downloads always execute perfectly for me. Finally, two free antivirus applications with real-time scanning and rootkit detection and removal are Avast and Avira. I use both (I switch among a number of hard drives) and like them equally.