My Anti Spyware

Found new fake codec and new rogue antispyware

Sunbelt blog reported about new malwares.

DVDacess (hosted at inc-codec(dot)com)

is a Trojan horse that drops and executes a copy of Trojan-Zlob, a back door Trojan that allows the remote attacker to perform various malicious actions on the compromised computer.

VirusHeal (hosted at virusheal(dot)com)

a clone of rogue security product SpyHeal.

For protect your PC, add both domains in the your blocklist.
If you have problems with these malwares and can`t uninstall them, then try free spyware removal tool – smitfraudfix.

Related articles: How to remove malicious codecs.

Automatic removal HaxDoor trojan

This trojan allows others to access the computer, drops more malware, installs itself in the Registry.

For check your PC, Download HijackThis and save the file to your desktop.
Double click on the file to extract it to it’s own folder on the desktop.

Now you need to run HijackThis and click “Do a system scan only”. If your found any simulat entry

O20 – Winlogon Notify: pptp32 – C:\WINDOWS\SYSTEM32\pptp32.dll
O20 – Winlogon Notify: avpe32 – C:\WINDOWS\SYSTEM32\avpe32.dll

then you have HaxDoor trojan infection!

For remove the serious infection, please follow these instructions step by step.

Download haxfix.exe. Save it to your desktop.
Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark “Create a desktop icon”.
Click “Next”.
When the installation is completed, make sure that the checkmark “Launch HaxFix” is placed.
Click “Finish”.
A red “dos window” (dos box) will open.

Select option 2. Run auto fix by typing 2, and then pressing Enter.
If an infection is found, you’ll get a message to close all other open windows.
Close them, except the red dos window from haxfix and then press Enter.
The computer will reboot.

Haxdoor can drops more malware, also if you are still having problems with your PC , then please follow the steps outlined in the topic linked below Spyware removal – Read Before Posting

Automatic removal MBS Account Manager

MBS Account Manager is a program from Micro Bill Systems in the UK. The program provides billing and collection services for websites (mostly adult in nature). This software is potentially unwanted as apart from constantly displaying demands for money for it’s services, attempts to install further unwanted components using ActiveX. MBS Account Manager will display a bill as a pop-up, when the bill is ignored, the popups become more frequent.

A HijackThis log will show two running processes and a Startup entry similar to one of these:

O4 – HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
O4 – HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\smvalid.exe

4 months ago, i have wrote about MBS spyware , if old instructions don`t work, try next steps:

1. Download the Brute Force Uninstaller to your desktop.
Right click the BFU folder on your desktop, and choose Extract All. Click “Next” and then in the box to choose where to extract the files to, Click “Browse”. Click on the + sign next to “My Computer”. Click “Next”, and Uncheck the “Show Extracted Files” box and then click “Finish”.

2. Download the MicroBill Removal script. Save it in the same folder you made earlier (c:\BFU). Then, please go to Start > My Computer and navigate to the C:\BFU folder. Start the Brute Force Uninstaller by double-clicking BFU.exe

3. Behind the scriptline to execute field click the folder icon and select mbs.bfu. Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.) Wait for the complete script execution box to pop up and press OK. Press exit to terminate the BFU program.

4. Restart your computer.

If you are still having problems with spyware after completing these instructions, then please follow the steps outlined in the topic linked below Spyware removal – Read Before Posting.