Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Fake Windows Security Alerts in task bar - Vundo


  • This topic is locked This topic is locked
3 replies to this topic

#1 The Diver

The Diver

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:20 AM

Posted 24 April 2009 - 01:05 AM

Greetings!

My computer was fine until I tried cleaning another computer on the network that was infected with the "Spyware Protect 2009" malware trojan. I followed the directions here on BleepingComputer. MBAM detected 40 infected objects and cleaned most of them. On the secone run through with MBAM it detected 5 infected objects. It could not remove "wbbetsgq.dll" on reboot. Browser IE still redirected to 69.31.80.181.

Now this computer was okay until I was using MBAM. I then got the notice from MBAM that I was infected. I removed infected objects and upon reboot got the fake red icon with an "x" pop up in the task bar. Fake Windows Security Alerts. This was the same thing that happened on computer #1. Now computer #2 is also infected.

I ran "dss.scr" and have DDS.txt and Attach.txt files available.

Please help me get rid of this as it continues to persist. Thank you in advance,

Amy

Attached Files



BC AdBot (Login to Remove)

 


#2 The Diver

The Diver
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:20 AM

Posted 26 April 2009 - 02:38 PM

Ok, I did a test from the Symantec website to check for the Conficker virus. I used a legit program "D.exe" from Symantec. Not malicious program was found. However, I still have the balloon in the task bar everytime I start the computer. The icon in the task bar is a red shield with a white "x" in it. The popup balloon says, "Your computer might be at risk. Antivirus software might not be installed. Click this balloon to fix this problem."

When you click on the balloon it takes me to Windows Security Center ( Or one that looks like it. I think it's a fake one) I have not clicked on anything in the security center, because when I did this on another computer with the same symptoms, it installed the P Antispyware 2009 virus.

So it appears I have downloaded some malicious program, but it has yet to be excuted. How to I rid myself of this if it is not currently detectable? Thoughts and suggestions would be appreciated.

Amy

#3 The Diver

The Diver
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:03:20 AM

Posted 27 April 2009 - 12:38 AM

Ok, I have solved the computer problem with computer #2. Everything is good there.

How do I close out this topic? I need to open up a new topic for computer #1 and run dss and attach a log from the infected computer.

Thank you for your patience.

Amy

#4 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Staff Emeritus
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the "Logic Free Zone", in Md, USA
  • Local time:06:20 AM

Posted 30 April 2009 - 06:47 PM

Thread is closed.
Thanks for informing us.
Good luck with the #2.
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users