Malware: XP Home Security 2012 on my desktop

[billethkid]

this morning. After doing some research I find it is the newest strain out and that rebooting to the safe mode and downloading a removal program will not work. This infection works as well in the safe mode as in regular boot. I called a couple of tech supports and they advised this new strain cannot be removed via any anti malware or anti virus programs and has to be removed by a technician. Best Buy up to $300..internet supporters anywhere from $129 to $300.
Has anybody had this? If yes how did you get it removed?

If it has to be a technician or somebody hands on, do you have a recommendation?

My desk top is pretty much not functional and I am using my laptop. I am not sure I want to put up to $300 in the desk top as I have everything backed on on a remote hard drive as well as on my laptop.

Thanx for responses to come...I hope.

btk

[memason]

this morning. After doing some research I find it is the newest strain out and that rebooting to the safe mode and downloading a removal program will not work. This infection works as well in the safe mode as in regular boot. I called a couple of tech supports and they advised this new strain cannot be removed via any anti malware or anti virus programs and has to be removed by a technician. Best Buy up to $300..internet supporters anywhere from $129 to $300.
Has anybody had this? If yes how did you get it removed?

If it has to be a technician or somebody hands on, do you have a recommendation?

My desk top is pretty much not functional and I am using my laptop. I am not sure I want to put up to $300 in the desk top as I have everything backed on on a remote hard drive as well as on my laptop.

Thanx for responses to come...I hope.

btk

Not sure if this is an option for you, but I have used the restore option to restore the system to a known safe day...maybe 2 or 3 days ago. I've had viruses I was not able to eradicate without doing this.

Good Luck!

[CaptJohn]

this morning. After doing some research I find it is the newest strain out and that rebooting to the safe mode and downloading a removal program will not work.

I would try Malwarebytes anyway. It can't hurt and might just work.
See another thread where we had discussions about viruses.

[coralway]

As noted above, I also would first try Restore to whatever date in the past my computer would allow.

Failing that, you will have to take your desktop to a technician and get the hard drive swiped clean and then reinstall Windows. Last time I had to have that done, it cost $150 but that was in NY.

Wonder if the Geek Squad at a local BB would do it???

[Blackie]

Try this article for removal.

http://www.bleepingcomputer.com/virus-removal/remove-xp-home-security-2012

[VillagesFlorida]

YOU can always uninstall Windows and do a clean install yourself. I just did that for a friend. This might be the option I would choose, especially where you have the backup. It isn't that difficult to do this yourself unless you are timid and afraid!!

[red tail]

this morning. After doing some research I find it is the newest strain out and that rebooting to the safe mode and downloading a removal program will not work. This infection works as well in the safe mode as in regular boot. I called a couple of tech supports and they advised this new strain cannot be removed via any anti malware or anti virus programs and has to be removed by a technician. Best Buy up to $300..internet supporters anywhere from $129 to $300.
Has anybody had this? If yes how did you get it removed?

If it has to be a technician or somebody hands on, do you have a recommendation?

My desk top is pretty much not functional and I am using my laptop. I am not sure I want to put up to $300 in the desk top as I have everything backed on on a remote hard drive as well as on my laptop.

Thanx for responses to come...I hope.

btk

if youre happy with XP PRO you can buy a new pc on yugster for $204

[red tail]

http://www.yugster.com/todays-deals/yours-until-gone

[njbchbum]

btk - i hope you have recovered from this malcontent malware! if not, and for others concerned about this malware - there is a great thread about removing this nasty aggrevation on one of the cnet forums - good to copy/save for future reference.

http://forums.cnet.com/7723-6142_102-530178/xp-home-security-2012/

[CarGuys]

Another reason to leave the PCworld and move to MAC

As I sit here typing on XP waiting for it to hit me also.

What were you doing that downloaded this mess?

I have Norton and Spyblaster, Spybots CCleaner and Advanced System Wear 5 all running,

Mac salesperson said what are you going to do with your two hours of cleaning time gone!

Good luck with the cooties cleaning! I would just blow out the system and reload fresh XP.

Be careful of restore. It will transfer the virus to that safe section.

H

[jojo]

I like the technicians at MMD on 441.

[Jazzper]

Did you try running MalwareBytes (with the latest database) from a flash drive yet?

PS.
Their Pro version was the best $25 piece of s/w I've ever bought. Just using it running all the time in the background (instead of dealing with problems in reactive mode) and MSE has kept my 2 XP machines and this Vista one safe for a year or 2 now.....knock on wood-:)

[billethkid]

so far nothing works. No matter what file or icon you use the virus shuts off access especially any virus or malware fighters. Using restore it does the same thing...as soon as one tries to access system restore it blocks it. This morning I was able to get to system restore from the intro to the safe mode...it gives one the option to operate in the safe mode or go to system restore. The system then proceded allowing me to set a new date....however when it comes time for the PC to reboot, the virus prevents the shut down.

I have not tried to use malware from a flash drive. I assume one saves the download to flash, then access from "my computer"? I further assume this should be done in the safe mode.

More later.

btk

[Jazzper]

btk,

What I've done for others is download and install it onto a flash drive from another PC. Actually install it on that flash drive -- e.g. it F: drive or whatever it come up as -- so that it goes out and gets the latest MalwareBytes database. Then take that flash drive over to the infected PC and run it there. In some cases I have had to boot up the infected PC in safe mode to get it to run since some malware screws up the registry such that it will not recognize the USB ports and flash drive. I always run it at least once after deleting the malware it finds -- until it reports back that no errors were found. MWB has always come thru though....Good luck!!

[zcaveman]

As far as I am concerned, you are way past Malwarebytes or any other app that does not directly address your problem. If there is not an app out there on the Internet that directly addresses the XP Home Security 2012 virus removal then you need to see a professional.

I recommend MMD:

They are on 27/441. A couple of blocks south of 466.

109 S. US Hwy 27/441
Lady Lake, Fl 32159
(352) 750-3707


Unfortunately it is now Saturday afternoon and I think they are closed for the weekend.

I do see several sites with a XP Home Security 2012 virus removal process. Give one or two of them a try.

I did help a person with a virus using one of the internet removal tools but not this one.

Good Luck!!!

Z

[Jazzper]

Here's a nifty YouTube video of step-by-step instructions on how to get rid of it using two Malwarebytes tools.

http://www.youtube.com/watch?v=EX_C5hheRPE

Looks like you're correct, zcaveman. This video showed their other tool, Roguekiller, is also required. Probably worth giving it a shot before shelling out any $$$.

Again....good luck!!

[swimdawg]

That malware came from or through the TOTV site. I got it this morning when I was writing a post regarding catastrophic ground collapse in another thread. I was on my Dell PC when it struck in the middle of my posting. I'm now on my Apple iBook G4 laptop computer. Thank goodness I have it.
I immediately unplugged from the internet and tried to run Malwarebytes that is already installed on that computer. Wouldn't run. OK, I have a CD for it although from earlier this year when I got another virus from the AARP site. Malwarebytes fixed it. Still wouldn't load so I guess I'm going to have to download a later version and see what happens or try another product. I'm thinking these things are coming from ads placed on the websites as they're both good sites and nowhere else that I go on the internet has caused me these problems. I do searches very carefully and I do ebay and another forum without problems.
Beware and update your protection now.

Oh no! It's on my desktop. Yikes!

[THE NEWCOMER]

I was looking at the TOTV New Posts this morning when the MALWARE hit me. I was reading the post about the sinkholes. I didn't know where it came from but I was researching an external web site that someone had post about sinkholes. I was looking at the location of a sink hole reported July 19, 1974 near Wildwood outside the Villages. I download a site that would help me with the location of sinkhole which was list long -82.036111 lat 28.852778
I download Maps4PC and that when it hit me. I think I was able to remove the MALWARE but I'm not sure because I'm not that good with computers. I was ready to take to Best Buy. Good luck!

[Virtual Geezer]

While on TOTV on Friday I received a red screen and a warning for something I cannot remember. I just hit the back arrow and was back at TOTV and continued reading the posts with no problems. I then ran Malwarebytes on a full scan along with Microsoft Security Essentials and both reported no problems.

Now if you get this red screen there are a couple of things to do.

1. DO NOT CLICK ON THE ANYTHING WITHIN THE BODY OF THE WEB PAGE.

2. Use the back arrow on your browser to go back a screen and then close your browser and run Malwarebytes and Microsoft Security Essentials.

3. Another thing you can do if that screen pops up is to just power the computer off. The next time you reboot the computer it will ask you how you want to boot up and just use the normal mode and you should be okay. Run Malwarebytes and Microsoft Security Essentials for a complete scan. Your desktop icons may not be arranged the way you had them but they are all still there.

VG

[billethkid]

I have now tried to load malwarebytes from a flash drive and the new starin of this virus actually learns as you go through the steps and once it determines where your headed it blocks all access.
Most of yesterday afternoon I was trying everything the Malwarebytes site recommended....they had several alternates on how to trick the virus...none worked.

Tomorrow I will be working with one of their techs on a chat connection to see what we do next.

This episode has given me comfort for the time I have spent over the years always backing up to a portable hard drive as well as my laptop.
If you are not backed up you better do it.

I am also going to purchase Malwarebytes pro version for my laptop...I do not want to take a chance getting my laptop infected.

I will post what I learn as I go. Thanx for all the suggestions and support.

btk

[TOTV Team]

We take Malware, trojans, and security on the site very seriously. We will run additional scans but have not found anything that indicates TOTV as the source. If you have any technical data you would like to share please email to us.

[Virtual Geezer]

When I received the screen pop up the other day I tried to do a screen capture but anything I tried would not work. At that point I did what needed to be done to get out of the situtiation.

Next time I think I will take a picture of the screen on my cell phone for reference as I have had people do that before when I was working in level 3 IT support.

VG

[zcaveman]

While on TOTV on Friday I received a red screen and a warning for something I cannot remember. I just hit the back arrow and was back at TOTV and continued reading the posts with no problems. I then ran Malwarebytes on a full scan along with Microsoft Security Essentials and both reported no problems.

Now if you get this red screen there are a couple of things to do.

1. DO NOT CLICK ON THE ANYTHING WITHIN THE BODY OF THE WEB PAGE.

2. Use the back arrow on your browser to go back a screen and then close your browser and run Malwarebytes and Microsoft Security Essentials.

3. Another thing you can do if that screen pops up is to just power the computer off. The next time you reboot the computer it will ask you how you want to boot up and just use the normal mode and you should be okay. Run Malwarebytes and Microsoft Security Essentials for a complete scan. Your desktop icons may not be arranged the way you had them but they are all still there.

VG

I got the red screen also. At the time I was just looking at the New Post titles. Like you I got out and then got back in and did what I had done before and did not get the screen again.

All you said are good suggestions.

One question. Do you run the Malwarebytes quick scan or the full scan? I usually run the quick scan. I will probably run the full scan this afternoon when I am away from the PC.

[ducati1974]

Time for a Mac! I gave up on this nonsense with Windows last year and have had none of this with my Mac.

[Virtual Geezer]

One question. Do you run the Malwarebytes quick scan or the full scan? I usually run the quick scan. I will probably run the full scan this afternoon when I am away from the PC.

Z
When something like this happens I run a full scan as soon as possible. I run the quick scan every couple of weeks on my desktop and lap top.

The red screen happened on my lap top so the full scan did to take that long. As far as the desktop goes that takes a lot longer as I am spinning 2 500 gig hard drives and both are 80% full.

The one key thing to remember that if you are in the position of the OP, BTK, then you HAVE to boot the computer in safe mode with networking to run Malwarebytes or you are just wasting your time.

VG

[mitchbr47]

Time for a Mac! I gave up on this nonsense with Windows last year and have had none of this with my Mac.

I have both a Mac and a PC. The mac is my primary computer and computer platform of choice. I just shudder to think about the lack of productivity dealing with all of these malware and spyware issues on a daily basis. With my PC running Windows 7 I have Norton. Of curse running in the background slows it down. So far I've been lucky. But I watch where I go and am careful with Flash files.
So the question to ponder is the extra money for a Mac worth it compared to the frustration, headaches and expenses buying antivirus software and the expense having someone repair it? What about the security issues with private information that could be compromised?

[cappyjon431]

I got hit with the same thing today, probably from TOTV, but I can't remember which thread triggered it. Mine rendered my entire system inoperable, kept getting an offer to buy Vista Antivirus 2012 to cure this new virus.

I was able to reboot in safe mode (I had the adds for the Vista Antivirus 2012 pop up multiple times in "safe" mode which was strange) and eventually get to system restore from the start menu. I restored back to two days ago and it appears to have fixed the problem.

As extra protection, I updated my Norton, did a scan, and it appears as if my system is now OK.

What a pain in the arse.

[CarGuys]

I agree Sir!

The Apple store said what are you going to do with all your free time instead of running cootie killers all day.

Major Geeks . com get Oibit Malware Fighter and Advanced system 5 free.

Also download Spyware Blaster as you say pain in the butt!

[billethkid]

I was fortunate to get connected with the customer support gurus at Malwarebytes.
On their website and forum they supply a series of options on how to get around the infection to get the PC to operate. When none of those work they request you contact them by email.

They assigned a case number and a "helper". All communications was done via email...they are on the West coast....and via my lap top (uninfected PC).

They walked me through a series of analytical links which I downloaded to a flash stick and then onto my infected desk top. The links ran differing programs to sort out the problem(s) and create a log which I in turn emailed back to them. With that information they then would send the next link and instructions. Had to run three different programs but finally a clean computer once again.

The customer support was outstanding and very timely. I never had to wait more than an hour to get a response back.

I would pass along a caution that just backing away or changing system restore points may not necessarily remove the virus. It could still be in some corrupted files to resurface later.

Even after the last pass on mine was completed, they sent a link to remove the existing Malware application and another link to re-install a "fresh" version to assure that even the Malwarebytes program had no corruption.

Go to their website and sign up to their forum as there is an awful lot of material that would be of interest. I found the path I needed in their frequently asked questions.

I was using their free version and there was no charge for ANY of the customer support.

btk

[njbchbum]

so glad to read that your malware dilemma is over! and glad to read such a glowing report of the tech assistance you received from the mwb staff!

guess i'll invest in the full product and service since my "free" download is only for a 30 trial!

does anyone know if there is a "free" version that is not a 30 day trial?

[ajbrown]

Here's a nifty YouTube video of step-by-step instructions on how to get rid of it using two Malwarebytes tools.

http://www.youtube.com/watch?v=EX_C5hheRPE

Looks like you're correct, zcaveman. This video showed their other tool, Roguekiller, is also required. Probably worth giving it a shot before shelling out any $$$.

Again....good luck!!

I did not read all posts in this thread until recently. I have seen the content of this video twice in the past week on my computer. I did not associate the subject of the OP with what I had seen until I saw this video. I cannot confirm what site caused it, if it happens again I will try to pay more attention.

What I can tell you is that both times the page came up just as in this video, telling me to register, etc. In both cases, I did not get infected. I firmly believe this is because I run my browser in a piece of software called Sandboxie. This product allows you to run software in a "sandboxed" environment. When this malware "hit" me, it infected this sandboxed area. All I had to do was clear the sandboxed area using the Sandboxie tool and restart the browser.

I do not sell this product, I use the free version of this product and have been saved a few times. If you interested, check out http://sandboxie.com/

Have safe day....

[ajbrown]

I was fortunate to get connected with the customer support gurus at Malwarebytes.
On their website and forum they supply a series of options on how to get around the infection to get the PC to operate. When none of those work they request you contact them by email.

.......<Stuff snipped by Alan>

I was using their free version and there was no charge for ANY of the customer support.

btk

Great product, great story. I had no idea they would provide such support for us folks using it for free. After reading your story, I am proceding to purchase the product for $25. This is the type of company I like to support. I hope the real-time protection is as good as the rest of the product!

[red tail]

Great product, great story. I had no idea they would provide such support for us folks using it for free. After reading your story, I am proceding to purchase the product for $25. This is the type of company I like to support. I hope the real-time protection is as good as the rest of the product!

i have the for sale version and it is great !

[Blackie]

I run my browser in a piece of software called Sandboxie. This product allows you to run software in a "sandboxed" environment. When this malware "hit" me, it infected this sandboxed area. All I had to do was clear the sandboxed area using the Sandboxie tool and restart the browser.

I do not sell this product, I use the free version of this product and have been saved a few times. If you interested, check out http://sandboxie.com/

Have safe day....

I have been running my browser in "sandboxie" for several years - it provides great peace of mind and I have never had a problem with it.

It works just as expected.

[billethkid]

yes there is a free version of Malwarebytes available. Once the free trial is over I would guess there will be an option to either buy the Pro version or go to the free version.

Since the clean up I am currently running the free trial of the Pro version and the end of the trial I will buy the Pro version. They have definitely earned my business.

btk

[CarGuys]

You must feel Sooooooooooo much better. So nice tech support is really there to help you!

I am looking into this product.

I just clicked on this post and my XP sent up a blocked attack. I have been on other areas all night with no cootie alerts!

Take Care- Herv

[ajbrown]

Once again today I got whacked by this annoying piece of Malware and when I got hit I figured I would share how Sandboxie works. When I got hit, my browser exits, at the same time this screen pops up:

http://i1002.photobucket.com/albums/af146/ajbrown2007/totv/sandboxie_screen.jpg

Next comes all of the pop ups shown in the video earlier in this thread. For kicks I take no action on them, but rather run Malwarebytes and see this

http://i1002.photobucket.com/albums/af146/ajbrown2007/totv/malwarebytes_screen1.jpg

As you can see, Malwarebytes finds the issue. Notice how the issue is under the directory c:\sandbox. This is where my sandbox exist and where a breach is contained.

At the same time, those annoying popups and live scan windows from the attack are all still there, asking me to run a free scan, etc.

I instead go to the Sandboxie control and delete contents of sandbox and all popups exit and I am back to normal.

http://i1002.photobucket.com/albums/af146/ajbrown2007/totv/sandboxie_clean_screen.jpg

Very cool....

[VillagesFlorida]

Below is a screen shot I just captured of the Norton Internt Security warning that I received while here on TOTV. Norton blocked the threat so I didn't get infected. I am not sure if this is something really bad, had it been allowed into my computer......not familiar with the site. Norton rated the threat as "High" in severity.

[CarGuys]

My Norton did this once on this site but how to you capture a screen shot?

Nice job Did you go to Nortons site and report the site.

Herv

[Skybo]

I’ve had 6 high-level intrusion attempts (blocked by Norton) in the past two or three days, all of which happened while I was viewing TOTV.

[CarGuys]

Our Admin swears he has scanned and cleaned this site however I feel there is a stealth something that has been launched into the TOTV system,

Admin and most moderators ( FRANK ) are running Macs! So lucky them they don't get hit as we do.

No fair!

STD's on TOTV yuck

Herv

[Virtual Geezer]

Xp Security 2012 Malware is going around and just not isolated to TOTV. I have been on a different message forum this morning and found a discussion regarding this same malware. That forum "looks" very similar to the Vbulletin software that is used here but I did not find and copyright or other notification stating so.

If you Google "Xp Security 2012 Malware" you get a lot of hits.

VG

[CarGuys]

People should put their computer skills to better use rather than create malware that makes others life's miserable.

I have a question.

I there a huge difference between

Malware
Virus
Bots
Trojans

???

[ajbrown]

People should put their computer skills to better use rather than create malware that makes others life's miserable.

I have a question.

I there a huge difference between

Malware
Virus
Bots
Trojans

???

Alot of the people that write this stuff likely do it for sport. It is a sad statement for sure. Here is a nice summary of terms....

http://www.cisco.com/web/about/security/intelligence/virus-worm-diffs.html

[TOTV Team]

True they do it for sport and also to hopefully get your email and put you on a spam list or worse password information. It is always a good idea even with TOTV to change your password from time to time and definitely change passwords if you think you have been hit by Malware.

Not only have we scanned and checked everything but we have had 2 other separate and independent experts do the same and there was nothing found on TOTV.

[SALYBOW]

I too have this infestation. I am going to take mine to CMD Computers on 441 just south of 466. The re4ason malware etc won't work is because you have to boot it up in a sector that is not Windows. You need a special disk to do this. It is going to cost 133 but it comes with two Antivirus programs that are 98% effective. I cannot get on the net or get to my restore. It has blocked all avenues for help. WhY do people do this? Merry Christmas maybe?? OH well off to the service people. :cus:

[Virtual Geezer]

I too have this infestation. I am going to take mine to CMD Computers on 441 just south of 466. The re4ason malware etc won't work is because you have to boot it up in a sector that is not Windows. You need a special disk to do this. It is going to cost 133 but it comes with two Antivirus programs that are 98% effective. I cannot get on the net or get to my restore. It has blocked all avenues for help. WhY do people do this? Merry Christmas maybe?? OH well off to the service people. :cus:

Wow. You have to boot your computer in safe mode with networking (hitting F8 after the manufacture information appears) and then run Malwarebytes. If you do not have Malwarebytes you will have to get it on a jump drive / memory stick or from a CD. Have never heard of booting up in a sector that is NOT windows in all my years of working on computers. In no way is this malware attacking the header track of the hard drive so there is no need to be playing around with sectors in any way shape or form.

As far a blocking all avenues of help that is correct as that is the way this malware works. That is why you have to use the safe mode.The safe mode will only load the minimum programs necessary to operate the computer and you clean it from there. After running malwarebytes and your up to date anti virus you will be good to go.

Now that I know what this malware is and what it is doing it is only a different flavor of one that has been around for a few years. Fairly easy cleanup.

VG

[Virtual Geezer]

People should put their computer skills to better use rather than create malware that makes others life's miserable.

I have a question.

I there a huge difference between

Malware
Virus
Bots
Trojans

???

Malware - a malicious program that takes control of your computer. It does not destroy any files on your computer but attacks the operating system.

Virus - can destroy programs and files. It can be a program that is placed on your computer and may or may not run at the time it is installed. It may be activated when you open another program on your computer and then will start destroying your files. It may also wait and attach itself to other files and be passes along to others. Most of what you see today are malware and NOT viruses.

Bots - short for robots. This is a program that is placed on your computer and will reside there until a command is issued from the mother ship to activate and run. Most common bot is called a denial of service where thousands and thousands of bots are sent to computers around the world and just sit there doing nothing for days, weeks or even months. Then the mother ship decides to attack some one or company or web site. The command is sent and the thousands of computers all try to connect to a website or hosting server or even a company server. The server cannot handle the load and is brought to it's knees.

Trojans - similar to a virus but it may or may not destroy files and programs. It may capture information from your computer such as keystroke and send them back to the mother ship in hopes they can gain you password or other personal information (bank accounts etc.)

VG

[billethkid]

I did get an attack while I was on TOTV yesterday. The Malwarebytes caught it immediately and removed it.

It may be coincidence that is when it "popped".

btk

[VillagesFlorida]

My Norton did this once on this site but how to you capture a screen shot?

Nice job Did you go to Nortons site and report the site.

Herv

I don't know which version of Windows you are running but I am using Windows 7. You can see how to "Snip" by going to this web site: http://windows.microsoft.com/en-US/windows7/products/features/snipping-tool

If you have a different version of Windows just do a Google search using that operating system in the search box. When you have the screen up that you want to capture follow the instructions above. I did the "rectangular" snip. When asked, I saved the screen shot (snip) to My Pictures. To post the snip here you just "attach" it by going to the paperclip at the top of this box (the box you are typing in). Browse for the snip in My Pictures, or wherever you saved it. Click on it to attach it. It may not look like it is attached but it will be when you post here. You can try sending the snip to yourself first, just to see if that works.....I use myself as a guinea pig all the time when I am testing new ways of doing things! And, don't forget, you can always come back here and edit your post if you aren't happy with it. There seem to be other ways to do this snipping procedure but this is the one that was easy for me.

[CarGuys]

This program just rooted out a coulpe of nasty things that Norton Internet Security Spyblaster Spybot CCleaner and Advanced System Care 5 missed.