Getting a warning NOTICE

[Ollakal]

Hi

I am running Windows XP, from yesterday onwards I am getting this NOTICE:
saying " You have not completed the virus secan! If your computer is
infected, you could suffer data loss, erratic PC behavior, PC freezes and
crashes.
Do you wnat to injstall AntiSpware Suite to scan your PC for malware now?
(Recommended) OK or Cancel"

Anybody know what is this, is this come kind of spayware or malware
something? is there a way I can get rid of this?

Thanks
Ollakal

 

[Carey Frisch [MVP]]

Cleaning a Compromised System
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

After reformatting your hard drive and reinstalling your operating system,
consider installing a good antivirus program, such as Windows OneCare.
You can try it absolutely FREE for 90 days.
http://onecare.live.com/standard/en-us/default.htm


--
Carey Frisch
Microsoft MVP
Windows Desktop Experience -
Windows Vista Enthusiast

---------------------------------------------------------------

:

Hi

I am running Windows XP, from yesterday onwards I am getting this NOTICE:
saying " You have not completed the virus secan! If your computer is
infected, you could suffer data loss, erratic PC behavior, PC freezes and
crashes.
Do you wnat to injstall AntiSpware Suite to scan your PC for malware now?
(Recommended) OK or Cancel"

Anybody know what is this, is this come kind of spayware or malware
something? is there a way I can get rid of this?

Thanks
Ollakal

 

[TaurArian]

| Hi
|
| I am running Windows XP, from yesterday onwards I am getting this NOTICE:
| saying " You have not completed the virus secan! If your computer is
| infected, you could suffer data loss, erratic PC behavior, PC freezes and
| crashes.
| Do you wnat to injstall AntiSpware Suite to scan your PC for malware now?
| (Recommended) OK or Cancel"
|
| Anybody know what is this, is this come kind of spayware or malware
| something? is there a way I can get rid of this?
|
| Thanks
| Ollakal
| --
| Raghu Ollakal
| System Administrator


Raghu, I've cross posted to the secuirty.virus newsgroup.

<AntiSpywareSuite is a fake spyware removal application usually downloaded and installed
by a Trojan. Once executed, AntiSpywareSuite will generate fake warning messages stating
that your computer is in serious danger. Might be difficult to remove >

Security - Viruses OE client -
news://msnews.microsoft.com/microsoft.public.security.virus
or Web client -
http://www.microsoft.com/technet/co...fault.mspx?dg=microsoft.public.security.virus

Hopefully someone there can assist you further.
--

TaurArian [MVP] 2005-2008 - Update Services
http://taurarian.mvps.org
======================================
How to ask a question: http://support.microsoft.com/kb/555375
Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco

 

[Kayman]

Hi

I am running Windows XP, from yesterday onwards I am getting this NOTICE:
saying " You have not completed the virus secan! If your computer is
infected, you could suffer data loss, erratic PC behavior, PC freezes and
crashes.
Do you wnat to injstall AntiSpware Suite to scan your PC for malware now?
(Recommended) OK or Cancel"

Anybody know what is this, is this come kind of spayware or malware
something? is there a way I can get rid of this?

1.CCleaner - Free
Cleans temporary internet files, cookies, history, recent urls, application
MRUs, etc. ...
http://www.filehippo.com/download_ccleaner/

2.SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
and
3.Ad-Aware 2007 - Free
http://www.lavasoftusa.com/products/ad_aware_free.php
http://www.download.com/3000-2144-10045910.html

After the software is updated, it is suggested scanning the system in Safe
Mode.
How do you boot to Safe Mode?
By pressing/tabbing F8 (or F5 on some keyboards) during re-boot.
Alternatively:
click onto Start==>Run, type "msconfig" (without quotation marks), click
OK. Then click onto BOOT.INI tab and 'check' /SAFEBOOT then OK and click
Restart. To go back to Normal Mode, you must access the System
Configuration utility again and click the General tab then click/check the
radio button 'Normal Startup'- load all device drivers and services'.
A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/default.aspx?scid=315222

4.Download David H. Lipman's MULTI_AV.EXE from the URL:
http://www.pctipp.ch/ds/28400/28470/Multi_AV.exe
http://www.pctipp.ch/downloads/dl/35905.asp
English:
http://www.raymond.cc/blog/archives/2008/01/09/scan-your-computer-with-multiple-anti-virus-for-free/

To use this utility, perform the following...
Execute; Multi_AV.exe {Note: You must use the default folder C:\AV-CLS}
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{or Double-click on 'Start Menu' in C:\AV-CLS}

NOTE: You may have to disable your software FireWall or allow WGET.EXE to
go through your FireWall to allow it to download the needed AV vendor
related files.

C:\AV-CLS\StartMenu.BAT -- {or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in
Normal Mode.
This way all the components can be downloaded from each AV vendor's web
site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
Reboot the PC.

You can choose to go to each menu item and just download the needed files
or you can download the files and perform a scan in Normal Mode. Once you
have downloaded the files needed for each scanner you want to use, you
should reboot the PC into Safe Mode [F8 key during boot] and re-run the
menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help file.

Additional Instructions:
http://pcdid.com/Multi_AV.htm

Follw up with a HJT scan:
Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Please do not submit HJT logs to this n/group.
Fora where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is required in any of the below before posting a log

http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29
http://www.thespykiller.co.uk/index.php?board=3.0
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://forums.tomcoyote.org/index.php?showforum=27
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.spywarewarrior.com/viewforum.php?f=5

 

[Malke]

| Hi
|
| I am running Windows XP, from yesterday onwards I am getting this
| NOTICE: saying " You have not completed the virus secan! If your
| computer is infected, you could suffer data loss, erratic PC behavior,
| PC freezes and crashes.
| Do you wnat to injstall AntiSpware Suite to scan your PC for malware
| now?
| (Recommended) OK or Cancel"
|
| Anybody know what is this, is this come kind of spayware or malware
| something? is there a way I can get rid of this?
|
| Thanks
| Ollakal
| --
| Raghu Ollakal
| System Administrator


Raghu, I've cross posted to the secuirty.virus newsgroup.

<AntiSpywareSuite is a fake spyware removal application usually downloaded
and installed by a Trojan. Once executed, AntiSpywareSuite will generate
fake warning messages stating that your computer is in serious danger.
Might be difficult to remove >

Security - Viruses OE client -
news://msnews.microsoft.com/microsoft.public.security.virus
or Web client -
http://www.microsoft.com/technet/co...fault.mspx?dg=microsoft.public.security.virus

Hopefully someone there can assist you further.

Great crosspost from TaurArian. Mr. Ollakal - As TaurArian said, your
computer is infected by a rogue antispyware program; a program that
purports to be a Good Guy but is really a Bad Guy. Since these types of
malware commonly download/install more malware, you can't assume that the
main program is the only infection.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. You will
generally be asked to:

1. Download and execute HiJack This! (HJT) -
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

2. Disable Notepad's word wrap - In Notepad.exe; Format --> uncheck; "Word
wrap"

3. Download/run Deckard's System Scanner -
http://www.techsupportforum.com/sectools/Deckard/dss.exe

4. Save the scan results (Main.txt and Extra.txt)

5. And then post the contents of Main.txt and Extra.txt in your post at the
forum you chose. DO NOT POST LOGS IN THE MS NEWSGROUPS.

Standard disclaimer: I can't see and test your computer myself, so these are
just suggestions based on many years of being a professional computer tech;
suggestions based on what you've written. You should not take my
suggestions as a definitive diagnosis. If you can't do the work yourself
(and there is no shame in admitting this isn't your cup of tea), take the
machine to a professional computer repair shop (not your local equivalent
of BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may be
so infested that Windows will need to be clean-installed. If possible, have
all your data backed up before you take the machine into a shop.

Malke

 

[jamesph]

Yes its a scam...you could try www.ca.com and get a free malware/spyware
scan...i used this for a very difficult trojan and it worked....
--
jph

Hi

I am running Windows XP, from yesterday onwards I am getting this NOTICE:
saying " You have not completed the virus secan! If your computer is
infected, you could suffer data loss, erratic PC behavior, PC freezes and
crashes.
Do you wnat to injstall AntiSpware Suite to scan your PC for malware now?
(Recommended) OK or Cancel"

Anybody know what is this, is this come kind of spayware or malware
something? is there a way I can get rid of this?

1.CCleaner - Free
Cleans temporary internet files, cookies, history, recent urls, application
MRUs, etc. ...
http://www.filehippo.com/download_ccleaner/

2.SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
and
3.Ad-Aware 2007 - Free
http://www.lavasoftusa.com/products/ad_aware_free.php
http://www.download.com/3000-2144-10045910.html

After the software is updated, it is suggested scanning the system in Safe
Mode.
How do you boot to Safe Mode?
By pressing/tabbing F8 (or F5 on some keyboards) during re-boot.
Alternatively:
click onto Start==>Run, type "msconfig" (without quotation marks), click
OK. Then click onto BOOT.INI tab and 'check' /SAFEBOOT then OK and click
Restart. To go back to Normal Mode, you must access the System
Configuration utility again and click the General tab then click/check the
radio button 'Normal Startup'- load all device drivers and services'.
A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/default.aspx?scid=315222

4.Download David H. Lipman's MULTI_AV.EXE from the URL:
http://www.pctipp.ch/ds/28400/28470/Multi_AV.exe
http://www.pctipp.ch/downloads/dl/35905.asp
English:
http://www.raymond.cc/blog/archives/2008/01/09/scan-your-computer-with-multiple-anti-virus-for-free/

To use this utility, perform the following...
Execute; Multi_AV.exe {Note: You must use the default folder C:\AV-CLS}
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{or Double-click on 'Start Menu' in C:\AV-CLS}

NOTE: You may have to disable your software FireWall or allow WGET.EXE to
go through your FireWall to allow it to download the needed AV vendor
related files.

C:\AV-CLS\StartMenu.BAT -- {or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in
Normal Mode.
This way all the components can be downloaded from each AV vendor's web
site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
Reboot the PC.

You can choose to go to each menu item and just download the needed files
or you can download the files and perform a scan in Normal Mode. Once you
have downloaded the files needed for each scanner you want to use, you
should reboot the PC into Safe Mode [F8 key during boot] and re-run the
menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help file.

Additional Instructions:
http://pcdid.com/Multi_AV.htm

Follw up with a HJT scan:
Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Please do not submit HJT logs to this n/group.
Fora where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is required in any of the below before posting a log

http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29
http://www.thespykiller.co.uk/index.php?board=3.0
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://forums.tomcoyote.org/index.php?showforum=27
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.spywarewarrior.com/viewforum.php?f=5

 

[PA Bear [MS MVP]]

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Ollakal]

Hi

I follow Kayman's instruction, and get rid off thos warnings, I am good to
go .

Thanks for your help


Raghu Ollakal
System Administrator