Comments on: Total XP Security http://www.2-viruses.com/remove-total-xp-security Thu, 09 Feb 2012 13:37:12 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14342 admin Tue, 27 Apr 2010 06:46:59 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14342 Spyware doctor works with AVG if you have anti-spyware/malware version only. There is a version with antivirus as well, though I would use different antivirus (not avg, AVAST, avira, or nod32/kaspersky) for better overall coverage. Spyware doctor works with AVG if you have anti-spyware/malware version only. There is a version with antivirus as well, though I would use different antivirus (not avg, AVAST, avira, or nod32/kaspersky) for better overall coverage.

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14341 admin Tue, 27 Apr 2010 06:45:37 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14341 Yimin : Antivirus software, no matter how good it is, focuses on broader spectrum of parasites. Thus they are a bit slower on 0 day vulnerabilities and fresh trojans, promoting rogues. That is why firewalls and anti-malware with real time protection is important too. I agree - it depends from luck as well. Thank you for the note about scheduled tasks. Yimin : Antivirus software, no matter how good it is, focuses on broader spectrum of parasites. Thus they are a bit slower on 0 day vulnerabilities and fresh trojans, promoting rogues. That is why firewalls and anti-malware with real time protection is important too. I agree – it depends from luck as well.
Thank you for the note about scheduled tasks.

]]> By: Tesa http://www.2-viruses.com/remove-total-xp-security#comment-14333 Tesa Tue, 27 Apr 2010 01:20:37 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14333 Does uhm.. Spyware Doctor work with programs like AVG? Or will I have to remove AVG somehow to use SD? I can't get to a removal tool for AVG right now since Total XP Security's got my IE on lockdown, more or less. Proxy redirects and what not. I only got here because someone sent me a link via MSN. Does uhm.. Spyware Doctor work with programs like AVG? Or will I have to remove AVG somehow to use SD?
I can’t get to a removal tool for AVG right now since Total XP Security’s got my IE on lockdown, more or less. Proxy redirects and what not.
I only got here because someone sent me a link via MSN.

]]> By: Yimin Rong http://www.2-viruses.com/remove-total-xp-security#comment-14329 Yimin Rong Mon, 26 Apr 2010 20:06:29 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14329 admin: We had licensed and legal commercial versions of trusted and respected anti-virus products installed and up-to-date at the time of infection. I think just bad luck to be hit with something newer than the latest update. One note - checking of scheduled tasks and proxy redirection should be indicated in the removal instructions. Otherwise it will come back. admin: We had licensed and legal commercial versions of trusted and respected anti-virus products installed and up-to-date at the time of infection. I think just bad luck to be hit with something newer than the latest update.

One note – checking of scheduled tasks and proxy redirection should be indicated in the removal instructions. Otherwise it will come back.

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14328 admin Mon, 26 Apr 2010 19:50:20 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14328 Yimin : I would recommend getting good anti-malware and antivirus, both with real time protection. There is a trick these viruses use: changing windows update server, which is not detected by most antivirus/antimalware programs. thus once you update windows, you get infected again. Also, you have to check hosts file and proxy manually. Most of these problems can be avoided having good antivirus and anti-malware :) And not relying on after-the-fact scans with malwarebyte free :) Yimin : I would recommend getting good anti-malware and antivirus, both with real time protection. There is a trick these viruses use: changing windows update server, which is not detected by most antivirus/antimalware programs. thus once you update windows, you get infected again. Also, you have to check hosts file and proxy manually.
Most of these problems can be avoided having good antivirus and anti-malware :) And not relying on after-the-fact scans with malwarebyte free :)

]]> By: Yimin Rong http://www.2-viruses.com/remove-total-xp-security#comment-14326 Yimin Rong Mon, 26 Apr 2010 19:32:08 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14326 After using every tool at my disposal (including MalwareBytes) to remove bad registry entries, scheduled tasks, corrupted files, and rootkits, and getting a clean scan, then repairing the Windows installation and updating, the infection was back in full force the next day. I finally had to admit defeat and rebuild to a non-Windows O/S. The major sign that I was still not clear of infection was that some browsers were returning redirected pages - guessing proxy redirection. We received some blacklisting notices dating from when the computer was infected and connected to the Internet, so it's likely the computer was hijacked and sending out spam. Important note: if you are infected, assume a keylogger is installed, so change any potentially compromised passwords ASAP from another uninfected computer. This rogue is definitely worthy of being classified as extremely dangerous. After using every tool at my disposal (including MalwareBytes) to remove bad registry entries, scheduled tasks, corrupted files, and rootkits, and getting a clean scan, then repairing the Windows installation and updating, the infection was back in full force the next day. I finally had to admit defeat and rebuild to a non-Windows O/S.

The major sign that I was still not clear of infection was that some browsers were returning redirected pages – guessing proxy redirection.

We received some blacklisting notices dating from when the computer was infected and connected to the Internet, so it’s likely the computer was hijacked and sending out spam.

Important note: if you are infected, assume a keylogger is installed, so change any potentially compromised passwords ASAP from another uninfected computer.

This rogue is definitely worthy of being classified as extremely dangerous.

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14286 admin Sun, 25 Apr 2010 08:09:27 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14286 J-bird: all products will ask you to pay at some point. Including Mbam: its real-time protection module, which is critical for avoiding infections is not available in free version. J-bird: all products will ask you to pay at some point. Including Mbam: its real-time protection module, which is critical for avoiding infections is not available in free version.

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14279 j-bird Sun, 25 Apr 2010 00:46:43 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14279 <a href="#comment-14268" rel="nofollow">@admin</a> I do appreciate your comments. You have a very good point about the manual removals. When I ran it, it did detect a lot of infections that malwarebytes did not find. But you do understand my skepticism in light of the numerous attacks, and the resulting loss of hair over this issue. I will give it a second chance. @admin
I do appreciate your comments. You have a very good point about the manual removals. When I ran it, it did detect a lot of infections that malwarebytes did not find. But you do understand my skepticism in light of the numerous attacks, and the resulting loss of hair over this issue. I will give it a second chance.

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14268 admin Sat, 24 Apr 2010 18:32:19 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14268 J-bird: Spyware doctor was long before rogues became active and it will be after rogues cease to exist. Even free version gives some advantage: It lists viruses that infect and you can track down which files are infected. Also, it blocks some virus attacks. If you choose not to believe me, you can read about it in wikipedia or PCMag, etc. About paying for it: If you do not want it, or it does not detect your version of parasites, do not pay for it. Remove parasites one by one manually. However, there is no single free for all full anti-malware tool. About hosts file: It looks like something protects your hosts file from opening. It is likely that this is virus process or an antivirus. I would try using killbox or similar utility to remove old version... J-bird: Spyware doctor was long before rogues became active and it will be after rogues cease to exist.
Even free version gives some advantage: It lists viruses that infect and you can track down which files are infected. Also, it blocks some virus attacks. If you choose not to believe me, you can read about it in wikipedia or PCMag, etc.
About paying for it: If you do not want it, or it does not detect your version of parasites, do not pay for it. Remove parasites one by one manually. However, there is no single free for all full anti-malware tool.
About hosts file: It looks like something protects your hosts file from opening. It is likely that this is virus process or an antivirus. I would try using killbox or similar utility to remove old version…

]]> By: David http://www.2-viruses.com/remove-total-xp-security#comment-14210 David Fri, 23 Apr 2010 16:33:31 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14210 Just as a heads up they have modified the executable again it is now calling itself vma.exe Just as a heads up they have modified the executable again it is now calling itself vma.exe

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14209 j-bird Fri, 23 Apr 2010 16:25:31 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14209 So i tried this and it seems to have worked. Do you see anything wrong with this attempt. step 1: Open (C:\Windows\System32\Driver\Etc\hosts) as administrator in notepad step 2: save to desktop as hosts.file (it will appear as hosts.file.file) step 3: change the name. Highlight and erase the .file so it only reads hosts (will appear as hosts.file) step 4: delete corrupted hosts file in (C:\Windows\System32\Driver\Etc\hosts) step 5: copy and Paste the new hosts.file from desktop to this location. step 6: reboot So i tried this and it seems to have worked. Do you see anything wrong with this attempt.

step 1: Open (C:\Windows\System32\Driver\Etc\hosts) as administrator in notepad
step 2: save to desktop as hosts.file (it will appear as hosts.file.file)
step 3: change the name. Highlight and erase the .file so it only reads hosts (will appear as hosts.file)
step 4: delete corrupted hosts file in (C:\Windows\System32\Driver\Etc\hosts)
step 5: copy and Paste the new hosts.file from desktop to this location.
step 6: reboot

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14207 j-bird Fri, 23 Apr 2010 15:58:33 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14207 I tried rebooting in safe mode and still the same "Cannot create..." Message. I tried rebooting in safe mode and still the same “Cannot create…” Message.

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14205 j-bird Fri, 23 Apr 2010 15:30:43 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14205 I have been reading about spyware doctor, and there is many who recommend against it due to the fact that you have to buy it to remove the buy now pop ups from malicious malware. Seems like one sort of supports the other! At your recommendation, i did download and install, and now it too wants money. Not sure i like where this is going. I have been reading about spyware doctor, and there is many who recommend against it due to the fact that you have to buy it to remove the buy now pop ups from malicious malware. Seems like one sort of supports the other! At your recommendation, i did download and install, and now it too wants money. Not sure i like where this is going.

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14204 j-bird Fri, 23 Apr 2010 15:01:54 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14204 Will do, BTW. Thanks for your help. Will do, BTW. Thanks for your help.

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14203 admin Fri, 23 Apr 2010 14:59:45 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14203 It should have no extension. Try rebooting into safe mode and edit file then. It should have no extension. Try rebooting into safe mode and edit file then.

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14202 j-bird Fri, 23 Apr 2010 14:54:56 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14202 <a href="#comment-14201" rel="nofollow">@admin</a> i am on xp pro I can open the file, I can edit the file, but when i try to save the file i get "Cannot create the C:\\Windows\system32\drivers\etc\hosts file. Make sure that the path and filename are correct." Or if i try to save as , It saves it as a .txt file. I choose the options File name: hosts Save as Type: All Files Encoding: ANSI (but i have tried all options Unicode, Unicode big Endian, UTF-8) and it always saves as a .txt file. What is the extension i need to use? @admin
i am on xp pro
I can open the file, I can edit the file, but when i try to save the file i get

“Cannot create the C:\\Windows\system32\drivers\etc\hosts file.
Make sure that the path and filename are correct.”

Or if i try to save as , It saves it as a .txt file. I choose the options
File name: hosts
Save as Type: All Files
Encoding: ANSI (but i have tried all options Unicode, Unicode big Endian, UTF-8)
and it always saves as a .txt file.

What is the extension i need to use?

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14201 admin Fri, 23 Apr 2010 14:47:05 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14201 J-Bird : are you on xp? on vista or 7 you need to edit it as administrator (right-click on notepad icon, run as administrator and then open the file). J-Bird : are you on xp? on vista or 7 you need to edit it as administrator (right-click on notepad icon, run as administrator and then open the file).

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14199 j-bird Fri, 23 Apr 2010 14:42:12 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14199 <blockquote cite="#commentbody-14196"> <strong><a href="#comment-14196" rel="nofollow">admin</a> :</strong> J-bird: Check your proxy settings and hosts file. Remove proxy (if it is set) and empty hosts file. (C:\Windows\System32\Driver\Etc\hosts). Also, scan with spyware doctor. </blockquote> I found the hosts file and opened it in notepad, but it will not save. What file extension do i need? I read that i need to change the name of the original hosts.file and then resave the revised and cleared hosts.file, but it wont save. Any suggestions? for anyone concerned, here is a brief list of the redirects... 74.125.45.100 test1111.com 74.125.45.100 test1112.com 74.125.45.100 4-open-davinci.com 74.125.45.100 securitysoftwarepayments.com 74.125.45.100 privatesecuredpayments.com 74.125.45.100 secure.privatesecuredpayments.com 74.125.45.100 getantivirusplusnow.com 74.125.45.100 secure-plus-payments.com 74.125.45.100 (xx)getantivirusplusnow.com 74.125.45.100 (xx)secure-plus-payments.com 74.125.45.100 (xx)getavplusnow.com 74.125.45.100 (xx)securesoftwarebill.com 89.248.168.188 (xx)google.ae

admin :
J-bird: Check your proxy settings and hosts file. Remove proxy (if it is set) and empty hosts file. (C:\Windows\System32\Driver\Etc\hosts). Also, scan with spyware doctor.

I found the hosts file and opened it in notepad, but it will not save. What file extension do i need? I read that i need to change the name of the original hosts.file and then resave the revised and cleared hosts.file, but it wont save.
Any suggestions?

for anyone concerned, here is a brief list of the redirects…
74.125.45.100 test1111.com
74.125.45.100 test1112.com
74.125.45.100 4-open-davinci.com
74.125.45.100 securitysoftwarepayments.com 74.125.45.100 privatesecuredpayments.com 74.125.45.100 secure.privatesecuredpayments.com 74.125.45.100 getantivirusplusnow.com 74.125.45.100 secure-plus-payments.com 74.125.45.100 (xx)getantivirusplusnow.com 74.125.45.100 (xx)secure-plus-payments.com 74.125.45.100 (xx)getavplusnow.com 74.125.45.100 (xx)securesoftwarebill.com
89.248.168.188 (xx)google.ae

]]> By: admin http://www.2-viruses.com/remove-total-xp-security#comment-14196 admin Fri, 23 Apr 2010 13:55:40 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14196 J-bird: Check your proxy settings and hosts file. Remove proxy (if it is set) and empty hosts file. (C:\Windows\System32\Driver\Etc\hosts). Also, scan with spyware doctor. J-bird: Check your proxy settings and hosts file. Remove proxy (if it is set) and empty hosts file. (C:\Windows\System32\Driver\Etc\hosts). Also, scan with spyware doctor.

]]> By: j-bird http://www.2-viruses.com/remove-total-xp-security#comment-14192 j-bird Fri, 23 Apr 2010 13:29:27 +0000 http://www.2-viruses.com/remove-total-xp-security#comment-14192 <blockquote cite="#commentbody-14191"> <strong><a href="#comment-14191" rel="nofollow">j-bird</a> :</strong> I was first infected with Antivirus XP, then Antispyware XP, and most recently, Total XP. I successfully remove them, and sure enough a week or so later they reappear. I use a combo of the suggested regedit instructions, Malwarebytes, and finally Combofix (be careful, use with caution). Yet i continue to get a newer version of this weekly. I am sure i am removing it, but i don’t know why it contioinues to return. The “common denominator” or consistant variable is when I do a google search, and select the site listed at the top three. The malware return in some form or another. My Google is also always opening in Netherland, and I am in USA. I am Uninstalling my Google tool bar and reinstalling just to check?! Any one have any ideas? Or has anyone seen this repeating attacks? I am running Firefox 5.0. </blockquote> also i am using Avast 5.0.462

j-bird :
I was first infected with Antivirus XP, then Antispyware XP, and most recently, Total XP. I successfully remove them, and sure enough a week or so later they reappear. I use a combo of the suggested regedit instructions, Malwarebytes, and finally Combofix (be careful, use with caution). Yet i continue to get a newer version of this weekly. I am sure i am removing it, but i don’t know why it contioinues to return. The “common denominator” or consistant variable is when I do a google search, and select the site listed at the top three. The malware return in some form or another. My Google is also always opening in Netherland, and I am in USA. I am Uninstalling my Google tool bar and reinstalling just to check?! Any one have any ideas? Or has anyone seen this repeating attacks? I am running Firefox 5.0.

also i am using Avast 5.0.462

]]>