This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

keep getting fake 'security warning' and 'you won' popups

25 min read

This thread's last reply is from May 6, 2008, 6:16 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

walkingwounded
April 26, 2008, 7:26 AM UTC
Note: I ran these in the order you mentioned above but as you can see the file name has changed again. Sorry for posting out of sequence, I will pay more attention now.

otmoveit2 log:

file changed to:
c:\documents and settings\steve\local settings\application data\qbvxkdr.exe
=====================
result of moveit (green area):
File move failed. c:\documents and settings\steve\local settings\application data\qbvxkdr.exe scheduled to be moved on reboot.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04252008_235336
======================
Got a prompt to reboot, so I did.
Bio-Hazard
April 27, 2008, 6:04 AM UTC
Hello!

It is important that you dont reboot until we get this infection killed. It changes file name everytime you reboot.


Run CFScript

Open Notepad and copy/paste the text in the box into the window:



File::

c:\documents and settings\steve\local settings\application data\qbvxkdr.exe



Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"qbvxkdr"=-


Save it to your desktop as CFScript.txt

Refering to the picture above drag CFScript.txt into ComboFix.exe This will let ComboFix runagain. Restart if you have to. Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall



Logs/Information to Post in Reply

Please post the following logs/Information in your reply

  • Combofix Log
  • A fresh HijackThis Log ( after all the above has been done)
Bio-Hazard
April 30, 2008, 4:14 PM UTC
Hello!

It has been few days since my last post.
  • Do you still need help with this?
  • Do you need more time?
  • Are you having problems following my instructions?


Note: If after 48hrs you have not replied to this thread then it will have to be CLOSED!


Bio-Hazard
walkingwounded
May 1, 2008, 2:32 AM UTC
Sorry for the delay posting back (had a family emergency to deal with).

I followed your instructions in the last post tonight and the problem seems to be gone now (no pop-ups in the last hour). Great job!

Thank you very much. :-)
Bio-Hazard
May 1, 2008, 5:58 PM UTC
"walkingwounded" wrote:Sorry for the delay posting back (had a family emergency to deal with).

I followed your instructions in the last post tonight and the problem seems to be gone now (no pop-ups in the last hour).


I hope everything is ok now with your family. Could you please post the Combofix Log and new HijackThis Log for me to see so i can make sure that you are clean.

Thank you,

Bio-Hazard
Gary R
May 6, 2008, 6:16 AM UTC
Due to lack of response this topic is now closed.

If you still need help open a new thread in the Malware Removal forum and wait for a new helper.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Gary R