Symptoms: pop-ups coming up everytime when you start your computer.
Download HijackThis and save the file to your desktop.
Double click on the file to extract it to it’s own folder on the desktop.
Download FileASSASSIN and save to your desktop (this tool is compatible with Win 2000/NT/XP only).
* Start fa-setup.exe for install
* Start FileASSASSIN.
* Select the following file(s) C:\WINDOWS\system32\rtnfs.exe, C:\WINDOWS\system32\mbssm32.exe to delete by dragging it onto the text area or select it using the (…) browse button.
* Select a removal method. Start with “Attempt FileASSASSIN’s method of file removal.”
* Click delete and the removal process will begin.
* If that did not work then, start the program again and this time check “Use delete on reboot function from windows.”.
Note: If you cannot find the file, you may have to Reconfigure Windows XP to show hidden files, folders.
Now you need to run HijackThis and click “Do a system scan only.” Place a check next to the following entries (if they are still there):
O4 – HKLM\..\Run: [Windows_Protect] rtnfs.exe
O4 – HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
O4 – HKLM\..\RunServices: [Windows_Protect] rtnfs.exe
Now close all browser and other windows except for HijackThis, and click “Fix Checked” to have HijackThis fix the entries you checked.
Reboot your PC.
Run the Panda online virus scan.
– Once you are on the Panda site click the Scan your PC button
– A new window will open…click the Check Now button
– Enter your Country
– Enter your State/Province
– Enter your e-mail address and click send
– Select either Home User or Company
– Click the big Scan Now button
– If it wants to install an ActiveX component allow it
– It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
– When download is complete, click on Local Disks to start the scan
– When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Update: If you are still having problems with MBS spyware try Automatic removal MBS Account Manager
Wow! I was getting fed up with the MBS cr*p
I should mention Brute Force did it for me – thanks
Cheers for the info, the brute force uninstall worked a treat even tho i could not find any of the file or hijack entrys mentioned in the instructions, i ran the bfu script and all gone.
Cheers