How do i get rid of XP Security Installer Virus?

circa808 · 06-26-2008, 02:10 PM

I somehow got a virus and its called XPSecurityInstaller. I checked my startup using msconfig and XPSecurityInstaller and braviax.exe keep running on startup even if i uncheck it and apply it. I tried using Ad-Aware, Spybot S & D, Avira Antivir, Registry Mechanic. I just cant seem to get rid of it. It says by my clock on my desktop "Your computer is infected", the yellow balloon comes up lik every 5 minutes. I found its registry values in regedit and deleted it. It also made a XPSecurityCenter folder in my C:\ProgramFiles\XPSecurityCenter\XPSecurityCenter. exe" /hide. Someone told me that this is a virus that tries to make you buy some anti-virus program that is supposedly supposed to get rid of the virus but doesn't and then your out $50. How do i get rid of this virus? O yea, my anti-spyware protector found this virus while scanning and i delete it but it seems to be coming back all the time. TR/Crypt.XPACK.Gen

Respital · 06-26-2008, 06:43 PM

Hello.

Download Hijackthis.
Link: http://www.trendsecure.com/portal/en...kthis/download
Install the program to the default directory.

Run Hijackthis and select "Do a system scan and save a log file".
Copy the entire log file and paste the contents here.

Do not fix anything unless advised to do so.

Hijackthis. will allow all of the computer security experts to check for the virus, where it's located along with any other problems you mite have.

circa808 · 06-26-2008, 07:22 PM

It wont let me run HiJackThis. It won't let me run Spybot S&D, Spyware Doctor, Ad Aware anymore and some other Anti-virus programs i could install.

Briguy · 06-26-2008, 07:48 PM

Quote:

Originally Posted by circa808

It wont let me run HiJackThis. It won't let me run Spybot S&D, Spyware Doctor, Ad Aware anymore and some other Anti-virus programs i could install.

You could see if a repair installation would allow you to run HijackThis. It might solve a lot of your problems. After it's finished post a HijackThis log and run and post a combofix log. You can download combofix here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Perform a Repair Installation

Configure your computer to start from the CD-ROM drive. For more information about how to do this, refer to your computer's documentation or contact your computer manufacturer. Then insert your Windows XP Setup CD, and restart your computer.

1.

When the Press any key to boot from CD message is displayed on your screen, press a key to start your computer from the Windows XP CD.

2.

Press ENTER when you see the message To setup Windows XP now, and then press ENTER displayed on the Welcome to Setup screen.

3.

Do not choose the option to press R to use the Recovery Console.

4.

In the Windows XP Licensing Agreement, press F8 to agree to the license agreement.

5.

Make sure that your current installation of Windows XP is selected in the box, and then press R to repair Windows XP.

6.

Follow the instructions on the screen to complete Setup.

g25racer · 06-26-2008, 08:25 PM

^^ Is that all you recommend?? Geez

Briguy · 06-26-2008, 08:27 PM

Quote:

Originally Posted by g25racer

^^ Is that all you recommend?? Geez

Do you have any better ideas! I didn't see you suggest anything!!!!

g25racer · 06-26-2008, 09:26 PM

Why not just use Killbox and kill the process?

g25racer · 06-26-2008, 09:27 PM

Or a simple restore point should take care of it.

Briguy · 06-26-2008, 09:42 PM

Quote:

Originally Posted by g25racer

Why not just use Killbox and kill the process?

I hope he can get the program to work.

Being that he can't get hijackthis to work.

cohen · 06-26-2008, 11:28 PM

Quote:

Originally Posted by g25racer

^^ Is that all you recommend?? Geez

I've seen it about 5 times now!

Quote:

Originally Posted by Briguy

Do you have any better ideas! I didn't see you suggest anything!!!!

Well i do, run Hijackthis then run combofix. But HJT won't work so combo fix sounds good:

Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.

Download this file from one of the three below listed places :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

06-26-2008, 02:10 PM	#1 (permalink)
circa808 New Member Join Date: Jun 2008 Posts: 2	How do i get rid of XP Security Installer Virus? I somehow got a virus and its called XPSecurityInstaller. I checked my startup using msconfig and XPSecurityInstaller and braviax.exe keep running on startup even if i uncheck it and apply it. I tried using Ad-Aware, Spybot S & D, Avira Antivir, Registry Mechanic. I just cant seem to get rid of it. It says by my clock on my desktop "Your computer is infected", the yellow balloon comes up lik every 5 minutes. I found its registry values in regedit and deleted it. It also made a XPSecurityCenter folder in my C:\ProgramFiles\XPSecurityCenter\XPSecurityCenter. exe" /hide. Someone told me that this is a virus that tries to make you buy some anti-virus program that is supposedly supposed to get rid of the virus but doesn't and then your out $50. How do i get rid of this virus? O yea, my anti-spyware protector found this virus while scanning and i delete it but it seems to be coming back all the time. TR/Crypt.XPACK.Gen Last edited by circa808; 06-26-2008 at 02:16 PM.

06-26-2008, 08:25 PM	#5 (permalink)
g25racer Diamond Member Join Date: Feb 2008 Location: Hamilton, MI Posts: 3,852	^^ Is that all you recommend?? Geez __________________ CPU - AMD Athlon 64x2 5200+ @ 2.6ghz Ram - 2GB Stock clock HD - 320gb seagate & Samsung 750gb 32mb cache GPU - XFX 8600GT XXX Zalman @ 680 or 700mhz PSU - Ultra X-finity 600watt OS - Vista Home Premium(32) & Ubuntu (8.04) Ultimate Ed Audio - JVC 460watts Control - Logitech G25 Wheel & Logitech Rumblepad 2 Games - GTR2 and LFS -- Race Sim's for Life --

06-26-2008, 09:26 PM	#7 (permalink)
g25racer Diamond Member Join Date: Feb 2008 Location: Hamilton, MI Posts: 3,852	Why not just use Killbox and kill the process? __________________ CPU - AMD Athlon 64x2 5200+ @ 2.6ghz Ram - 2GB Stock clock HD - 320gb seagate & Samsung 750gb 32mb cache GPU - XFX 8600GT XXX Zalman @ 680 or 700mhz PSU - Ultra X-finity 600watt OS - Vista Home Premium(32) & Ubuntu (8.04) Ultimate Ed Audio - JVC 460watts Control - Logitech G25 Wheel & Logitech Rumblepad 2 Games - GTR2 and LFS -- Race Sim's for Life --

06-26-2008, 09:27 PM	#8 (permalink)
g25racer Diamond Member Join Date: Feb 2008 Location: Hamilton, MI Posts: 3,852	Or a simple restore point should take care of it. __________________ CPU - AMD Athlon 64x2 5200+ @ 2.6ghz Ram - 2GB Stock clock HD - 320gb seagate & Samsung 750gb 32mb cache GPU - XFX 8600GT XXX Zalman @ 680 or 700mhz PSU - Ultra X-finity 600watt OS - Vista Home Premium(32) & Ubuntu (8.04) Ultimate Ed Audio - JVC 460watts Control - Logitech G25 Wheel & Logitech Rumblepad 2 Games - GTR2 and LFS -- Race Sim's for Life --

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

06-26-2008, 07:22 PM	#3 (permalink)
circa808 New Member Join Date: Jun 2008 Posts: 2	It wont let me run HiJackThis. It won't let me run Spybot S&D, Spyware Doctor, Ad Aware anymore and some other Anti-virus programs i could install.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
HELP riddled with Trojans :(	Hey it's me	Computer Security	32	03-19-2008 05:12 PM
advertisment by adssite annoying pop ups analyse hijack log	alyoob	Computer Security	11	01-10-2008 09:08 AM
hijack this log	spkenn5	Computer Security	29	11-17-2006 05:45 AM
computer running REALLY slow	gmen5681	Computer Security	3	09-06-2006 04:28 AM
Infected With Look2me;Popups include:Dofact,Yourtruths,Drivecleaner.Here is HJT Log.	ranzy	Computer Security	9	09-05-2006 03:54 PM