When I turn my computer on, after I log on. A system error box opens up in the center of the page saying "Your computer was infected by unknown trojan It's dangerous for your system [critical files can be lost] click ok to download the antispyware program to clean your computer." If you click ok, A file download box opens and asks if your want to run or save the program. It says it's from 89.149.227.195 I googled the number ad it goes to www.files-secure.com If I use Internet exployer, the system error box comes up every time I change screens, but it only pops up when I turn my computer on otherwise. Can someone help me please…..
Deckard's System Scanner v20071014.68
Run by [removed] on 2008-03-21 10:08:55
Computer is in Normal Mode.
——————————————————————————–
– Last 5 Restore Point(s) –
20: 2008-03-21 02:54:55 UTC - RP217 - Removed STOPzilla. Available with Windows Installer version 1.2 and later.
19: 2008-03-21 02:54:05 UTC - RP216 - Removed STOPzilla. Available with Windows Installer version 1.2 and later.
18: 2008-03-21 02:49:01 UTC - RP215 - Removed STOPzilla. Available with Windows Installer version 1.2 and later.
17: 2008-03-21 02:01:26 UTC - RP214 - Installed STOPzilla. Available with Windows Installer version 1.2 and later.
16: 2008-03-21 00:05:33 UTC - RP213 - Windows Update
– First Restore Point –
1: 2008-03-14 01:13:36 UTC - RP198 - Scheduled Checkpoint
Backed up registry hives.
Performed disk cleanup.
Total Physical Memory: 958 MiB (1024 MiB recommended).
– HijackThis (run as lopez.exe) ———————————————–
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:47 AM, on 3/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal
Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
C:\Windows\MalwarePro
C:\xmp.bat
C:\Windows\ausctv32a.dll
C:\Program Files\MalwarePro
C:\Program Files\AntiTrojan Pro
Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O2 - BHO: Media Player Classic - {CE0487CA-8B02-431E-BA63-D38844E020B5} - C:\Windows\ausctv32a.dll
O4 - HKCU\..\Run: [MalwareProMFC] C:\Program Files\MalwarePro\MalwarePro.exe
O4 - HKCU\..\Run: [AdwareProMFC] C:\Program Files\AntiTrojan Pro\AntiTrojan Pro.exe
WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked exit HijackThis and reboot.
Now scan again and post a new HijackThis log please.
I did as you asked and of the three that you highlighted, two of them went away, but the 02-BHO; Media Player Classic showed right back up again after a reboot and the new scan. Plus, that error box came up again as so as I logged on……Here's the scan results…. First, I want you to know how much it means to me to have someone help me, thank you……..
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:45:50 PM, on 3/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal
Here is that log you asked for. As I said before, the error box would show up as soon as I logged on, but would show up with every different screen in Internet Exployer. Today as I logged on, the error box didn't show up, nor has it showed up in Internet Exployer so far today at all. Should I re-run the scans and see what comes up?????
[Custom Input]
< C:\Windows\MalwarePro >
C:\Windows\MalwarePro moved successfully.
< C:\xmp.bat >
C:\xmp.bat moved successfully.
< C:\Windows\ausctv32a.dll >
C:\Windows\ausctv32a.dll unregistered successfully.
C:\Windows\ausctv32a.dll moved successfully.
< C:\Program Files\MalwarePro >
File/Folder C:\Program Files\MalwarePro not found.
< C:\Program Files\AntiTrojan Pro >
File/Folder C:\Program Files\AntiTrojan Pro not found.
OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03222008_092546
Yes post a new HijackThis log. Did you run OTMoveIt before or after trying to fix that HijackThis entry? If you ran it after, try fixing that bad one again then reboot and post a new log.
After running hijack this again today, [or so I think], then I ran OTM again and here's the results…. What I did notice is remember when I said 2 of the 3 items you wanted me to check went away but 1 still remained, I didn't notice then, but I see it now is that now it says [no file] after it…..
I'm refering to the top one [02-BHO: Media Player Classic]
plus, when I ran hijack this: 2 issuses came up…… 1] I can't double click the hijack this icon to get it to run from my desk top, I have to right click it and run it as administator [which I am anyway] which doesn't matter to me. 2] After I ran it, I couldn't figure out how to post the part of the log that shows up in the hijack this box, so I click on "upload to trendsecure" and away it went, but I don't know where to.
The good news is that I've been on the computer for 2 or 3 hours and that error hasn't showed up once……
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:47 AM, on 3/22/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal
Hi
When it says (file missing) it means we have successfully removed that bad file, but the regkey still exists. And with Vista, you generally have to right-click our tools to run as Administrator. It's something new with Vista to boost security.
When you run HijackThis, select "Scan and save a logfile". That will open the log in Notepad.
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Post that log back here with a new HijackThis log.
I just got this reply from an E-mail I sent to the web site the error box keep sending me to, would this have removed the problem if I had used it? I think it's just another trick to suck me into thinking I need their program.
Hello,
May be you've got a spyware at the Internet, so you can get our
popups in that case please download this file: http://files-secure.com/bhocleaner.exe
Close ALL windows and run the file!
That could help. And please, keep your antivirus updated! Good luck!
If you'll have more problems just send me info you get from our
scanner. Thanks!
2008/3/20, [removed] <[removed]>:
Mr..Robert Lopez
How do I remove your warning notice that keeps showing up in every new screen of IE. I have no plans of buying anymore spyware protection than I already have, thank you.
Hi
Yes it's a rogue security program. I would avoid the site and immediatly delete any emails from them. Could you do my previous instructions and we'll get finished up.
Buy? God, no. That would make me as bad as the people we fight against. Like a lot of the anti-spyware stuff we ask you to use, there are free and paid-for versions. All Im asking is for you download the free version, scan with it and post the log. You can uninstall it afterwards, or keep it as an extra scanner, free of charge.
That's what these forums are all about, free help.
When I try to open the link to Malwarebytes' Anti-Malware , it sends me to their web site, but when I hit download, it sends me to Major geeks.com I don't know whats going on but I can't seem to download it….
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
