XpSecurityCenterr redirecting websites Trojan

[StlHakusho]

So yesterday while searching the net I try to go to digg.com and instead of Digg, I get a website that features a pop up & advertisement for XPsecuritycenterr (two r's)

I've ran a scan using NOD32, SpySweeper & TrojanHunter 5.0 & the problem still keeps popping up. NOD 32 picks the problem up when the website pops the pop ups up, but just doing a scan it doesn't find anything. & I've ran a full scan of CCleaner using the default settings and then rebooted.

I've googled the problem and it appears that the Mac community has found a solution for this new issue by downloading http://www.dnschanger.com/

But I'm running Vista SP1, so what am I to do?

I've included snapshots of the problem & how it appears in NOD32's quarantine.

http://img55.imageshack.us/my.php?image=captureek5.jpg - The Pop Up

http://img98.imageshack.us/my.php?image=capture2sk3.jpg - The Web Site

http://img521.imageshack.us/my.php?image=capture3je4.jpg - The NOD32 Quarantine

Any help is greatly appreciated.

[glc]

That's a rough one to get rid of. If you don't have much data to lose, back it up and do a wipe/reinstall. If you want to try to clean it up, download the free versions of Malwarebytes and SuperAntiSpyware and scan with them. You may have to do the scans in safe mode.

FYI, your infection is called XPAntivirus2008.

[StlHakusho]

That's a rough one to get rid of. If you don't have much data to lose, back it up and do a wipe/reinstall. If you want to try to clean it up, download the free versions of Malwarebytes and SuperAntiSpyware and scan with them. You may have to do the scans in safe mode.

FYI, your infection is called XPAntivirus2008.

I'm going to try to clean it. I got a nasty virus last week that forced me to have to have to format & reinstall. It's just mind boggling that I'm getting this stuff though because I haven't had a Virus or Trojan of this sort in years and now I've had two in a week.

[StlHakusho]

That's a rough one to get rid of. If you don't have much data to lose, back it up and do a wipe/reinstall. If you want to try to clean it up, download the free versions of Malwarebytes and SuperAntiSpyware and scan with them. You may have to do the scans in safe mode.

FYI, your infection is called XPAntivirus2008.

I ran both programs in Safe Mode & SuperAntiSpyware found the issue! Some DNS Changer file & 2 registry keys. But it worked and I have my computer back. Thank you, Thank you!

Also for anyone who sees this and has the same issue, the infection won't let you download SuperAntiSpysweeper or the updates on your computer. I had to use my dad's computer to download these files and then transfer them unto my own computer to install & run them.

[glc]

Yes, that's one symptom of that malware - it blocks access to antimalware sites unless you can find a raw IP address for them.

[rjfvillarosa]

I got a nasty virus last week that forced me to have to have to format & reinstall. It's just mind boggling that I'm getting this stuff though because I haven't had a Virus or Trojan of this sort in years and now I've had two in a week.
A friend of mine had a similar problem with Wannado in France, it turned out he was using OutLook Express and the problem seemed to be Wannado's server, obviously I couldn't prove it but it was almost as if the viruses would attach themselves to his OE emails. As soon as he stopped using OE the problem went away.
He brought his laptop here oneday and showed me, of 40 or 50 emails in OE his antivirus was showing around 30 of them to be infected.

[itsgt]

go into safe mode,

go to start

run

type in msconfig and turn off all the start up programs, scan with spybot,malwarbytes and or AVG

Also use desktop hijack

I use this way all the time to get rid of the 2008 / 2009 virus and always clear it out without having to reformat the drive

You should also look around for obvious malware in the windows folder and systems 32 folder

[glc]

You are about 4 hours late, Sarge! Looks like SAS fixed it.

[Negeva]

Might want to add:

127.0.0.1 www.xpsecuritycenterr.com
127.0.0.1 xpsecuritycenterr.com

To your HOSTS file.