8 replies to this topic

[drewready]

Hi all,

I am having similar symptoms like other threats I have seen on here. A "Security Center Alert" pops up and only gives the option to
"Enable Protection," which then redirects me to a Perfect Defender 2009 screen. I did the most recent update and the program found Vuondo,
but this popup still keeps coming up every 15 minutes or so. The pop-up says "Trojan.Zlob.G" has been found.

Please help,

Andrew

[Colourjam]

drewready, on Dec 6 2008, 09:01 PM, said:

Hi all,

I am having similar symptoms like other threats I have seen on here. A "Security Center Alert" pops up and only gives the option to
"Enable Protection," which then redirects me to a Perfect Defender 2009 screen. I did the most recent update and the program found Vuondo,
but this popup still keeps coming up every 15 minutes or so. The pop-up says "Trojan.Zlob.G" has been found.

Please help,

Andrew

I have this exact same issue, any help would be muchly appreciated!

Thanks

[Dr. Sinistaar]

Same problem here. I've found people who have described a similar trojan and propose a solution, but this one is different enough that their solution doesn't work (http://www.myantispy...y-center-alert/). They suggest disabling TDSSserv.sys (which isn't running on my computer) and point to some potential sources of the trojan that don't seem to be on my system.

This trojan is nefarious as it seems to disable all Internet access but the link to the spyware "removal" progtam it's trying to sell you. I've tried launching IE, Firefox, and Safari with no luck. Luckily, I've got an unaffected laptop. Hope someone can help.

I've tried cleaning with AVG, Windows Defender, and Adaware as well.

My HT file is attached, for what it's worth.

Thanks for any help anyone can provide
Martin

Attached Files

•  hijackthis.txt   11.71K   64 downloads

[randg]

I have the same exact issue... any help would be very much appreciated. Thanks in advance.

[JohnD2]

Same problem here too. I am not completely blocked from internet, but browser sessions crash frequently, with the following messages:

Exception EAccessViolation in module spcffwl.dll at 000022B0.
Access Violation at address 017222B0 in module 'spcffwl.dll'. Write of address 00000011.

Runtime error 216 at 01721ED5.

The exception unknown software exception (0x0eedfade) occurred in the application at location 0x7c812a5b.

Much obliged for any help.

[Jaxryley]

You could try following the Pre HJT Posting Instructions.

If still no fix then maybe post a Hijackthis log.

[kalros]

I have the exact same problem. The internet browser works for a short time then quits if you don't respond to the fake security alert. The initial home page address does not change, but every time you open firefox it automatically brings you to a page that says:

"
Insecure Internet activity. Threat of virus attack
_______________________________________________________________
Due to the insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your
knowledge, and can lead to system slowdown, freezes and crashes.
Also insecure Internet activity can result in revealing your personal information.
To get full advanced real-time protection for PC and Internet activity, register your antivirus software.

We recommend you protect your PC now and continue safe Internet browsing.

*Click here to get full advanced real-time protection and continue browsing

*Continue to this website unprotected (not recommended)
"

My internet is useless now, and I have to use a different computer to get to this page. AVG and Mcafee have both failed to prevent or detect this virus. I was able to download and run (with a lot of crashing) superAntiSpyware which detected about 27 threats, which I quarantined and deleted, but this has done nothing. I am running windows XP.

any help would be greatly greatly appreciated!

[JohnD2]

I renamed files 'spcffwl.dll' and 'kjzna1562565.exe' in C:\Documents and Settings\<myusername>\Application Data\Google.

I still get the security center alert, but the browser doesn't get hijacked anymore.

[Tigger93]

Hello.

Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

Someone will be happy to assist you further with cleaning your system.

During this scan and cleanup process you should not install any other software unless requested to do so.