annoying pop up message

G

Guest

i keep getting a pop up message saying ' urgent system message:virus!' tells
me my pc is infected with trojan iworm_attk_v122.02a
used my anti virus software,spybot search destroy and ad aware se but
nothing is detected and its still there after running anti spyware
programs,also occassionally getting pop up ads.got firefox to block pop ups
but doesnt work
also followed advice on web to do this 1. Type about:config into the
Firefox location bar.
2. Right-click on the page and select New and then Integer.
3. Name it privacy.popups.disable_from_plugins
4. Set the value to 2.
did all that and still its flashing away in system tray.
can someone help me get rid of this annoying pop up please?
 
J

Johnathan

gakbar said:
i keep getting a pop up message saying ' urgent system
message:virus!' tells me my pc is infected with trojan
iworm_attk_v122.02a
used my anti virus software,spybot search destroy and ad aware se but
nothing is detected and its still there after running anti spyware
programs,also occassionally getting pop up ads.got firefox to block
pop ups but doesnt work
also followed advice on web to do this 1. Type about:config into
the Firefox location bar.
2. Right-click on the page and select New and then Integer.
3. Name it privacy.popups.disable_from_plugins
4. Set the value to 2.
did all that and still its flashing away in system tray.
can someone help me get rid of this annoying pop up please?
Click to expand...

try here

http://tinyurl.com/lycuz
 
M

Malke

gakbar said:
i keep getting a pop up message saying ' urgent system message:virus!'
tells
me my pc is infected with trojan iworm_attk_v122.02a
used my anti virus software,spybot search destroy and ad aware se but
nothing is detected and its still there after running anti spyware
programs,also occassionally getting pop up ads.got firefox to block
pop ups but doesnt work
also followed advice on web to do this 1. Type about:config into
the Firefox location bar.
2. Right-click on the page and select New and then Integer.
3. Name it privacy.popups.disable_from_plugins
4. Set the value to 2.
did all that and still its flashing away in system tray.
can someone help me get rid of this annoying pop up please?
Click to expand...

You've got one of the Smitfraud variants - or possibly Winfixer. Do all
the preparatory steps here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Then do one of the Smitfraud removal procedures here:
http://www.elephantboycomputers.com/page2.html#Smitfraud_Trojan

If you know for sure that you are getting ads for Winfixer,
Winantivirus, or Win[insert-name-here] then do the Winfixer procedures:
http://www.elephantboycomputers.com/page2.html#Winfixer

Do all the rest of the general malware cleanup steps after you've done
the more specific procedures.

If the work looks daunting - and there is no shame in admitting this -
take your machine to a professional computer repair shop (not your
local version of BigStoreUSA) and have them do it for you.

Malke
 
D

David H. Lipman

From: "gakbar" <[email protected]>

| i keep getting a pop up message saying ' urgent system message:virus!' tells
| me my pc is infected with trojan iworm_attk_v122.02a
| used my anti virus software,spybot search destroy and ad aware se but
| nothing is detected and its still there after running anti spyware
| programs,also occassionally getting pop up ads.got firefox to block pop ups
| but doesnt work
| also followed advice on web to do this 1. Type about:config into the
| Firefox location bar.
| 2. Right-click on the page and select New and then Integer.
| 3. Name it privacy.popups.disable_from_plugins
| 4. Set the value to 2.
| did all that and still its flashing away in system tray.
| can someone help me get rid of this annoying pop up please?



Two part reply..

Perform Part 1 then perform Part 2.

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp



Part 1
-----------

Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic43659.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:

Part 1
-----------

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Part 2
-----------

S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix.zip


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *
 
G

Guest

thanks for the help.carried out part 1 and 2 then also alternate 1 and 2

can only see the results for the normal scan in mcafee no safe scan results
though,strange?here is the normal scan as requeasted

Virus Scan Report File

--------------------------------------------------------------------------------
Virus Scan Information
--------------------------------------------------------------------------------

McAfee VirusScan for Win32 v4.40.0
Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights
reserved.
(408) 988-3832 LICENSED COPY - Sep 23 2004

Scan engine v4.4.00 for Win32.
Virus data file v4751 created Apr 28 2006
Scanning for 187976 viruses, trojans and variants.


--------------------------------------------------------------------------------
Virus Scan Results
--------------------------------------------------------------------------------




04/30/2006 11:00:39


Options:
/ADL /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL
/PROGRAM /EXCLUDE C:\MCAFEE\EXCLIST.TXT /HTML C:\MCAFEE\NORMAL_SCANREPORT.HTML

Scanning C: []
Scanning C:\*.*

Summary report on C:\*.*
File(s)
Total files: ........... 104052
Clean: ................. 103962
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 2
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning D: [Audio]
Scanning D:\*.*

Summary report on D:\*.*
File(s)
Total files: ........... 9
Clean: ................. 9
Possibly Infected: ..... 0
Cleaned: ............... 0
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning F: [Data & Apps]
Scanning F:\*.*

Summary report on F:\*.*
File(s)
Total files: ........... 3485
Clean: ................. 3485
Possibly Infected: ..... 0
Cleaned: ............... 0
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0


Time: 00:38.40
 
D

David H. Lipman

From: "gakbar" <[email protected]>

| thanks for the help.carried out part 1 and 2 then also alternate 1 and 2
|
| can only see the results for the normal scan in mcafee no safe scan results
| though,strange?here is the normal scan as requeasted
|
| Virus Scan Report File
| --------------------------------------------------------------------------------
| Virus Scan Information--------------------------------------------------------------------
|
| McAfee VirusScan for Win32 v4.40.0
| Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights
| reserved.
| (408) 988-3832 LICENSED COPY - Sep 23 2004
|
| Scan engine v4.4.00 for Win32.
| Virus data file v4751 created Apr 28 2006
| Scanning for 187976 viruses, trojans and variants.
|

< snip >

A very clean report. Are you still getting those Pop-Ups ?
 
G

Guest

yes,afraid so,first its usually an actual window popping up ad for casino or
adult friend finder,soon after i usually get the yellow exclamation mark
warning of a virus,worm or telling me my connection speed is low etc.
when scan was running sure i saw it find and delete puper trojan?
hope you can help thanks.
 
D

David H. Lipman

From: "gakbar" <[email protected]>

| yes,afraid so,first its usually an actual window popping up ad for casino or
| adult friend finder,soon after i usually get the yellow exclamation mark
| warning of a virus,worm or telling me my connection speed is low etc.
| when scan was running sure i saw it find and delete puper trojan?
| hope you can help thanks.
|




Two phase answer...

Perform Part 1 then perform Part 2

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:
--------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *
 
G

Guest

still the same,can only get report for normal scan,no safe scan seems to get
produced after i scan in safe mode.
here is the normal scan results again,thanks again for trying to help.

Virus Scan Report File

--------------------------------------------------------------------------------
Virus Scan Information
--------------------------------------------------------------------------------

McAfee VirusScan for Win32 v4.40.0
Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights
reserved.
(408) 988-3832 LICENSED COPY - Sep 23 2004

Scan engine v4.4.00 for Win32.
Virus data file v4751 created Apr 28 2006
Scanning for 187976 viruses, trojans and variants.


--------------------------------------------------------------------------------
Virus Scan Results
--------------------------------------------------------------------------------



04/30/2006 17:25:57


Options:
/ADL /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL
/PROGRAM /EXCLUDE C:\MCAFEE\EXCLIST.TXT /HTML C:\MCAFEE\NORMAL_SCANREPORT.HTML

Scanning C: []
Scanning C:\*.*

Summary report on C:\*.*
File(s)
Total files: ........... 90783
Clean: ................. 90688
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 2
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning D: [Audio]
Scanning D:\*.*

Summary report on D:\*.*
File(s)
Total files: ........... 9
Clean: ................. 9
Possibly Infected: ..... 0
Cleaned: ............... 0
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning F: [Data & Apps]
Scanning F:\*.*

Summary report on F:\*.*
File(s)
Total files: ........... 3487
Clean: ................. 3487
Possibly Infected: ..... 0
Cleaned: ............... 0
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0


Time: 00:26.52
 
D

David H. Lipman

From: "gakbar" <[email protected]>

| still the same,can only get report for normal scan,no safe scan seems to get
| produced after i scan in safe mode.
| here is the normal scan results again,thanks again for trying to help.
|


OK. Another clean Mcafee report (that was expected) however, this was scripted differently
to remove a specific family of malware.

If you still have Pop-Ups...



Download and execute HiJack This! (HJT)
http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Create a HJT log file and post it in one of the below locations...

Forums where you can get expert advice for HiJack This! (HJT) logs.
NOTE: Registration is REQUIRED before posting a log
NOTE: Web sites NOT listed in any particular order

http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/security
http://castlecops.com/forum67.html
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
 
G

Guest

thanks for your time.
actually since i last rebooted havent seen anymore pop ups,seems to have
worked,i hope,thanks again.
 
D

David H. Lipman

From: "gakbar" <[email protected]>

| thanks for your time.
| actually since i last rebooted havent seen anymore pop ups,seems to have
| worked,i hope,thanks again.


OK -- C O O L !

Then is was a Vundo Trojan/Virtumundo adware type infection which the WinFixerFix utility
targets.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Annoying pop up 4
pop up adds 3
Disappearing pop-up messages 9
Spyware pop up. 9
Pop up problems 3
Annoying pop-up in Internet Explorer 2
Message in Start up 4
Pop Up Error Messages 5

Top