computer

[rovers]

I have got a message from MBS banking services its not addressed to anyone but its regarding a bill for a porn line everytime I log on it appears and freezes the computer for 5 minutes then sits at the bottom of the computer screen, I have sent e-mails and recorded delivery letter but I can't get any response, can anyone help me get rid of this.

[chazza]

It is a virus, a friend of mine got the same thing. Basically it takes over your PC and replaces your ordinary internet browser with itself.

Take it to someone who knows about computers to have the virus removed. They do not have any of your details so they cannot demand money from you

[tezestwing]

Hi rovers why can't you run a anti virus program over it spybot or avg etc chazza answer seems a bit obscure hth Tez

[cascarelli]

Welcome to the world of viruses on pcs!

[Mac70]

Hi rovers.
Use Ctrl-alt-delete to open Task Manager, and look for these processes
mbssm32.exe
mbsrm32.exe
If there stop them.

You will need to reboot your computer into Safe Mode for the next steps. N.B. It would be a good idea for you to print these instructions, as you will not have access to the internet.

Important: If you have an 'always on' connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.

Boot to Safe Mode. To do this:

Restart your computer.

Continually tap the F8 button as your computer is booting (a menu appears).

Use up-arrow key to select Safe Mode and press Enter.

------------------------------------------------

Show hidden System Files

Click Start

Open My Computer

Select the Tools menu and click Folder Options

Select the View tab

Advanced Settings:

Under Hidden files and folders, select Show hidden files and folders

Uncheck Hide extensions for known file types

Uncheck Hide protected operating system files (Recommended)

Click Apply to All Folders

Click Yes to confirm

Click OK

------------------------------------------------------

Delete Files

Click on Start then My Computer, find the following files and folders (highlighted in red) and delete them, if present. Don't worry if any are missing, but please let me know.

[Mac70]

C:\Windows\System32\mbsrm32.exe <- File only
C:\Windows\System32\mbssm32.exe <- File only
C:\Windows\System32\mbsmon32.exe <- File only
C:\Windows\System32\mbsreg32.exe <- File only
C:\Windows\System32\ubsauthenticateaxc.ocx <- File only
C:\Windows\System32\ubsauthenticateaxc1.ocx <- File only
C:\Windows\System32\winregmon32.exe <- File only
C:\Windows\System32\winsysmon32.exe <- File only
C:\Windows\Downloaded Program Files\MBSInstallerAXC.ocx <- File only

mbsauthenticate.exe <- You will need to search for this file. Be careful to make sure that the spelling is exactly the same before deleting it. If in doubt, then stop and ask me.

----------------------------------------------------

Reboot the computer normally

[Paulst30]

Well Done Mac70 not only is that absolutely spot on but i think your the only person to have the patience to write all of that on here without losing the plot lol

Good call

[Mac70]

I cant take the credit. Its a common problem and I copied/pasted from one of my home forums.

[chazza]

we tried that tezestwing, it didn't work, hence having to take it to a professional

[Mac70]

chazza.
MBS is not a virus and is easily removed. If you believe you have an infection why waste money paying someone to remove it when there are thousands of willing volunteers on the net prepared to help you for free, using free tools, written by people whohate the malware writers?
Forums such as malwareremoval, Tom Coyote, Castlecops and many more are dedicated to this.
A bit of patience and reading the instructions is all you need, rather than spending 25-35 an hour.

[righttup]

bravo mac70.
its nice that people such as yourself will
take the time & patience to help others.
thats what makes a.b so good.

[rovers]

Thanks Mac70

If I could I would rate your answer 10 stars my computer was back to normal in no time.

Many thanks

Rovers

[Keeker]

I tried following Mac70's instructions for removing the MBS pop-ups, but couldn't find mbsauthenticate.exe or any of the System32 files, so I thought my computer was clear, but then when I rebooted and went on-line, the pop-up reappeared and a desktop shortcut returned? Any advice?