Antivirus 2009 pop-ups and spyware detections that keep coming back, a main one being microsoft.windows.securitycentre.firewallbypass

Hi,

I have recently managed to get a virus/spyware/malware (im afraid my computer knowledge is really useless, I will try my best to be technical) which I first recognised because when I started internet explorer a bunch of pop-ups came up saying I had to download 'Anti-Virus 2009'. It looked similar to a Microsoft notice but it was slightly different in colour and not very detailed so I knew it was a fake, and each time I start Internet Explorer the pop-ups come up again.

At the time I had a SpyBot installed and Semantic anti-virus, the Semantic anti-virus found nothing, the SpyBot found a lot of things (probably not all related to the main issue) all of which I deleted because I didn't know what else to do . But the pop-ups came back the next time I started internet explorer So I ran SpyBot a few more times, each time it found a few more things which I deleted, but kept coming back. The main thing that SpyBot kept finding again was microsoft.windows.securitycentre.firewallbypass and when I gave up with SpyBot the last search also showed a Virtumonde.prx and virtumonde.dll

Running in a panic to my mum she told me I should get the anti virus and spyware that she has, which we get free through our BT Broadband called BT NetProtect Plus, which when I phoned the company they installed for me, and it comes up on my computer as McAfee, although I don't know if it is a complete version of McAfee because it is through BT?

After running this scan it found a few things, which were not the same as the things SpyBot found, which it quarentined for me (although it doesn't give me the option to delete them) but again this didn't stop the pop ups and after running the scan a few more times in normal and in safe mode it still found nothing. Also, my computer has slowed right down. It now takes about 5 hours to run a scan.

I am really useless when it comes to computers, and I found a few sites which mentioned how to get rid of 'Antivirus 2009' or microsoft.windows.securitycentre.firewallbypass but the instructions given were aimed at the more knowledgable computer owner and I just didn't know how to follow them. I found a link to a converstation on your forum which seemed more descriptive so I hope you can help me. I have Windows XP on a desktop computer. I hope I have provided you with enough information?

Many thanks for any of you time and guidance,

Charlie

Hi and welcome.
We need to know a couple of things.. Are you running XP?
Do you now have both Symantec and McCaffee running as you can only have one. They will cause conflicts with each other.
Now for the time being Disable or turn off Spybot for this scan..

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.