Microbillsys.com

[Guest]

After searching a number of sites for a suitable ecard, I find that all sorts
of adverts appear on my desktop.
I downloaded Ad-Adware 2007 and this has removed most of the problems but I
am still left with microbillsys.com, which I have read about but cannot find
a solution to remove it. It appears every so often on the desktop and is
difficult to remove. It then reappears.
Running Windows XP media centre and MS IE 6.

Any help much appreciated. Thanks.

Ray

 

[PA Bear]

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Guest]

PA Bear,

Thank you for the time you took to advise me.

Before I tried your suggestions I performed system restore. I had read that
this does not work with microbill.sys but decided to try anyway before I saw
your response today.

So far, I have not seen microbill.sys since the sytem restore: I'm sorry - I
should probably have tried that first!!

Also, I used Adware-Aware initially and it showed 39 infections. Using it
after system restore shows only 13 infections - I don't know if I can assume
that my trips to the ecard sites picked up 26 infections?

I plan to wait a bit longer to see if microbill.sys has definitely gone. If
not, I will try your advice and get back to you.

Thanks again and apologies for not using some common sense with system
restore(hopefully!).


Ray

 

[PA Bear]

YW. I'd very much doubt System Restore or Ad-Aware took care of the
problem, Ray. If one or both of the following files are found, you've still
got the problem:

c:\windows\system32\mbsrm32.exe
c:\windows\system32\mbssm32.exe

cf. http://aumha.net/viewtopic.php?t=26981

And if you've still got the problem, chances are the machine has other
issues that need to be addressed.

 

[Guest]

PA Bear,

Of course, you are right!

Although I have not seen microbill.sys again nor could I find either of the
2 files you detailed, I used one of the scanning tools from internet and
found MBS under a different name! I also found Bazookabar, Spyware Netvizor,
Trojan Linkmedia x 2, clickbank, and Instant Access Dialer which the program
tells me are all severe or dangerous.

So now to start on your recommendations. Could be a long few nights!

Thanks once more for your help.

I'll let you know the outcome if ever I surface again!!

Ray

 

[PA Bear]

If you post your HijackThis log in AumHa Forums (aumha.net), give me a link
to your thread, please.

 

[PA Bear]

Got it: http://aumha.net/viewtopic.php?t=29639

If you post your HijackThis log in AumHa Forums (aumha.net), give me a
link
to your thread, please.

 

[Guest]

PA Bear,

It was easier than I expected.

My thread is microbill.sys and other parasites and has just been sent. I
hope this is what you want.

Thanks.

Ray

 

[PA Bear]

Beat you by 2 minutes! I've replied to your thread:
http://aumha.net/viewtopic.php?p=167421#167421

Please post any/all follow-up to the thread in AumHa Forums from now one.
THX