Hi, just a couple of things. First, I'm NOT good at computers so if you have
a suggestion how to fix it, please make it simple. Ok, when I try to sign
onto MSN, I keep getting a "we can't find your anti-spy wear protection"....I
haven't changed anything...why is that there and 2nd, for about a month I've
had a Norton Antivirus alert that tells me it has detected a virus and is
unable to repair this file....I can't X it out....I just drag it to the
bottom out of my way. What do I do?

Re: Anti-spy wear by David

David
Thu May 31 21:22:35 CDT 2007

From: "millbrookgirl" <millbrookgirl@discussions.microsoft.com>

| Hi, just a couple of things. First, I'm NOT good at computers so if you have
| a suggestion how to fix it, please make it simple. Ok, when I try to sign
| onto MSN, I keep getting a "we can't find your anti-spy wear protection"....I
| haven't changed anything...why is that there and 2nd, for about a month I've
| had a Norton Antivirus alert that tells me it has detected a virus and is
| unable to repair this file....I can't X it out....I just drag it to the
| bottom out of my way. What do I do?

You don't wear an anti-spy ? :-)

You do mean anti spyware -- right ?

You said... "Norton Antivirus alert that tells me it has detected a virus and is unable to
repair this file."

What file ?
Please provide the fully qualified name and path to the file deemed infected.

What "virus" ?
Please provide the name that Norton/Symantec called this infector.



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Re: Anti-spy wear by Gerald309

Gerald309
Fri Jun 01 12:50:25 CDT 2007

On May 31, 9:29 pm, millbrookgirl
<millbrookg...@discussions.microsoft.com> wrote:
> Hi, just a couple of things. First, I'm NOT good at computers so if you have
> a suggestion how to fix it, please make it simple. Ok, when I try to sign
> onto MSN, I keep getting a "we can't find your anti-spy wear protection"....I
> haven't changed anything...why is that there and 2nd, for about a month I've
> had a Norton Antivirus alert that tells me it has detected a virus and is
> unable to repair this file....I can't X it out....I just drag it to the
> bottom out of my way. What do I do?

=============================/.
Hello 'millbrook...' .... I have been on MSN since it came out in year
2001 I think at Version 6. The independent MSN Browser is something to
see huh?!!!

Okay, what MSN has currently has for well over a year now are the full
free versions of McAfee Antivirus, McAfee Personal Firewall, and
Webroot Spysweeper (industry leader). These are valuse at just over
one hundred dollars yearly that Microsoft gives back to the community
- who is calling them rip-offs , right ?

You may want to keep all that in mind at annual renewals of existing
software. McAfee is very good and their personal firewall is the
greatest "set and forget" you ever saw. Excellent. Recommended. You
get these all at Members Area.

Apparently you are using Symantec Norton Antivirus (one of the best
worldwide of course, but complaints of a tad heavy on resources since
they been around). I used Norton for years as world's best but believe
it or not Kapersky has been rated better than Norton for well over a
year now as, and is, the world's best.

You will want to install the McAfee Personal Firewall and Webroot
Spysweeper - NOW - if you do not have a firewall up and running or
an antispyware program. Set Webroot for automatic updates and to run
at Windows Start Up. This is another excellent set and forget program.
Webroot Spysweeper has about the best Active Shields around protecting
in real time against many, many malware threats. Long story short -
you just don't light up the computer anymore without paid active
antivirus and antispyware and a firewall running.

Okay with these things done, we now know you are protect4ed and have
excellent security protection at least downloaded and installed on the
computer. Any threats around and we can take care of it.

ANSWER.... here's what is up with Norton. When a antivirus program
flashes up a warning that so and so virus was deleted and the file
could not be fixed generally means that a virus indeed has just been
deleted and was a bad threat that could not be "cleaned" or "healed".
This means a virus kind of adds extra text to a file. If the antivirus
can not (very rare) quaratine that virus extra text from the file to
remove the threat but save the file intact - it will delete the virus.
This is to protect your computer and your personal safety of course
and is what you want.

This is a very run of the mill experience but generally only happens
with severe threat viruses. I would guess that you may have been
trying to download something from the internet when this occured or
you may have come across some infected file on your computer that
suddenly attempted to launch by your interaction without knowing
that.

Generally, all antivirus is set to quarantine a threat and also
attempt to clean the virus from any legitimate file if infected to of
course preserve legitimate files. Files can be anything from a simple
text file to pictures and movies and everything in between. In cases
of severe known threats and certain trojans - the antivirus program
will delete these immediately as they are deadly and pose a
significant threat. There is no sense to attempt fixing them in the
Quaratine section as they are known severe threats. This is all
automatic and happens in the blink of an eye.

The quarantine setion is very, very antiquadated and from the very
first days of the first antivirus software. The ONLY reason for the
Quarantine Folder is to inspect to see if there has been a legitimate
file, let's say a list of weekly chores you made for example, - to see
if is possible to "clean" the virus from your file to save that file
and it's contents. If it is not possible, then you may want to attempt
some other disaster recoverry technique - and of course this only
applies to something very valuable as either monetary wise or
sentimental obviously.

In over 6 years on PC I have never seen any file moved there. The only
thing in quarantine is the actual virus. All you do here is look it
over and the contents will show you it is virus language only in it
and you simply and safely delete the quarantined viruses. You don't
want these sitting around on your machine obviously - so you will want
to check this folder often and delete all viruses immediately to keep
your machine clean and safe.

BOTTOM LINE... since you are new, this is hard to diagnose without
more information you need to be posting - and it must be asked did you
buy and install Norton ? If not okay you have a major infection called
ransomware that needs to be addresses immediately for removal. If
these are fake warnings you are getting your computer is hijacked and
all fake messagfe will continually be generated until the malware is
removed. For an example of this look at this:

Microsoft Security Center fake warnings in your task bar... [NOTE:
These started about WMFmetafile exploit 2005, several: SpyAxe,
SpyFalcon, SpywareQuake, and several others now, new SpyLocked]
Example: "How to Remove SpyFalcon" (Review in full at website)
Examples: http://www.bleepingcomputer.com/forums/topic43659.html

Please post more information and please never allow a situation to
interrupt your computing like this months on end.... simply post in
detail and you will get the help you need if any...

webmaster: www.BlueCollarPC.Net


Re: Anti-spy ware by millbrookgirl

millbrookgirl
Fri Jun 01 22:08:01 CDT 2007

Wow, that was a lot and I swear I could have been reading greek. Each year I
renew the Norton stuff.........I know I have my firewall up....let's see, the
Norton Alert that comes up says it's from windows/addins/tuilabs.dll and the
virus name is Trojan.Vundo..........The message about the anti-spyware says
that the MSN connection center did not detect an active
antisywareprogam.............when you said that MSN has such programs for
free, how do you go about getting them or downloading them?
--
Thanks for your help!


"Gerald309" wrote:

> On May 31, 9:29 pm, millbrookgirl
> <millbrookg...@discussions.microsoft.com> wrote:
> > Hi, just a couple of things. First, I'm NOT good at computers so if you have
> > a suggestion how to fix it, please make it simple. Ok, when I try to sign
> > onto MSN, I keep getting a "we can't find your anti-spy wear protection"....I
> > haven't changed anything...why is that there and 2nd, for about a month I've
> > had a Norton Antivirus alert that tells me it has detected a virus and is
> > unable to repair this file....I can't X it out....I just drag it to the
> > bottom out of my way. What do I do?
>
> =============================/.
> Hello 'millbrook...' .... I have been on MSN since it came out in year
> 2001 I think at Version 6. The independent MSN Browser is something to
> see huh?!!!
>
> Okay, what MSN has currently has for well over a year now are the full
> free versions of McAfee Antivirus, McAfee Personal Firewall, and
> Webroot Spysweeper (industry leader). These are valuse at just over
> one hundred dollars yearly that Microsoft gives back to the community
> - who is calling them rip-offs , right ?
>
> You may want to keep all that in mind at annual renewals of existing
> software. McAfee is very good and their personal firewall is the
> greatest "set and forget" you ever saw. Excellent. Recommended. You
> get these all at Members Area.
>
> Apparently you are using Symantec Norton Antivirus (one of the best
> worldwide of course, but complaints of a tad heavy on resources since
> they been around). I used Norton for years as world's best but believe
> it or not Kapersky has been rated better than Norton for well over a
> year now as, and is, the world's best.
>
> You will want to install the McAfee Personal Firewall and Webroot
> Spysweeper - NOW - if you do not have a firewall up and running or
> an antispyware program. Set Webroot for automatic updates and to run
> at Windows Start Up. This is another excellent set and forget program.
> Webroot Spysweeper has about the best Active Shields around protecting
> in real time against many, many malware threats. Long story short -
> you just don't light up the computer anymore without paid active
> antivirus and antispyware and a firewall running.
>
> Okay with these things done, we now know you are protect4ed and have
> excellent security protection at least downloaded and installed on the
> computer. Any threats around and we can take care of it.
>
> ANSWER.... here's what is up with Norton. When a antivirus program
> flashes up a warning that so and so virus was deleted and the file
> could not be fixed generally means that a virus indeed has just been
> deleted and was a bad threat that could not be "cleaned" or "healed".
> This means a virus kind of adds extra text to a file. If the antivirus
> can not (very rare) quaratine that virus extra text from the file to
> remove the threat but save the file intact - it will delete the virus.
> This is to protect your computer and your personal safety of course
> and is what you want.
>
> This is a very run of the mill experience but generally only happens
> with severe threat viruses. I would guess that you may have been
> trying to download something from the internet when this occured or
> you may have come across some infected file on your computer that
> suddenly attempted to launch by your interaction without knowing
> that.
>
> Generally, all antivirus is set to quarantine a threat and also
> attempt to clean the virus from any legitimate file if infected to of
> course preserve legitimate files. Files can be anything from a simple
> text file to pictures and movies and everything in between. In cases
> of severe known threats and certain trojans - the antivirus program
> will delete these immediately as they are deadly and pose a
> significant threat. There is no sense to attempt fixing them in the
> Quaratine section as they are known severe threats. This is all
> automatic and happens in the blink of an eye.
>
> The quarantine setion is very, very antiquadated and from the very
> first days of the first antivirus software. The ONLY reason for the
> Quarantine Folder is to inspect to see if there has been a legitimate
> file, let's say a list of weekly chores you made for example, - to see
> if is possible to "clean" the virus from your file to save that file
> and it's contents. If it is not possible, then you may want to attempt
> some other disaster recoverry technique - and of course this only
> applies to something very valuable as either monetary wise or
> sentimental obviously.
>
> In over 6 years on PC I have never seen any file moved there. The only
> thing in quarantine is the actual virus. All you do here is look it
> over and the contents will show you it is virus language only in it
> and you simply and safely delete the quarantined viruses. You don't
> want these sitting around on your machine obviously - so you will want
> to check this folder often and delete all viruses immediately to keep
> your machine clean and safe.
>
> BOTTOM LINE... since you are new, this is hard to diagnose without
> more information you need to be posting - and it must be asked did you
> buy and install Norton ? If not okay you have a major infection called
> ransomware that needs to be addresses immediately for removal. If
> these are fake warnings you are getting your computer is hijacked and
> all fake messagfe will continually be generated until the malware is
> removed. For an example of this look at this:
>
> Microsoft Security Center fake warnings in your task bar... [NOTE:
> These started about WMFmetafile exploit 2005, several: SpyAxe,
> SpyFalcon, SpywareQuake, and several others now, new SpyLocked]
> Example: "How to Remove SpyFalcon" (Review in full at website)
> Examples: http://www.bleepingcomputer.com/forums/topic43659.html
>
> Please post more information and please never allow a situation to
> interrupt your computing like this months on end.... simply post in
> detail and you will get the help you need if any...
>
> webmaster: www.BlueCollarPC.Net
>
>

Re: Anti-spy wear by millbrookgirl

millbrookgirl
Fri Jun 01 22:11:01 CDT 2007

hey, I put the information that I think you said you needed on the reply
below you from Gerald.......does that help? and, I tried to change it to
"ware" once it was up but I couldn't change it but thanks for telling me the
correct way to spell it. :)
--
Thanks for your help!


"David H. Lipman" wrote:

> From: "millbrookgirl" <millbrookgirl@discussions.microsoft.com>
>
> | Hi, just a couple of things. First, I'm NOT good at computers so if you have
> | a suggestion how to fix it, please make it simple. Ok, when I try to sign
> | onto MSN, I keep getting a "we can't find your anti-spy wear protection"....I
> | haven't changed anything...why is that there and 2nd, for about a month I've
> | had a Norton Antivirus alert that tells me it has detected a virus and is
> | unable to repair this file....I can't X it out....I just drag it to the
> | bottom out of my way. What do I do?
>
> You don't wear an anti-spy ? :-)
>
> You do mean anti spyware -- right ?
>
> You said... "Norton Antivirus alert that tells me it has detected a virus and is unable to
> repair this file."
>
> What file ?
> Please provide the fully qualified name and path to the file deemed infected.
>
> What "virus" ?
> Please provide the name that Norton/Symantec called this infector.
>
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

Re: Anti-spy ware by Malke

Malke
Sat Jun 02 09:46:08 CDT 2007

millbrookgirl wrote:
> Wow, that was a lot and I swear I could have been reading greek. Each year I
> renew the Norton stuff.........I know I have my firewall up....let's see, the
> Norton Alert that comes up says it's from windows/addins/tuilabs.dll and the
> virus name is Trojan.Vundo..........The message about the anti-spyware says
> that the MSN connection center did not detect an active
> antisywareprogam.............when you said that MSN has such programs for
> free, how do you go about getting them or downloading them?

To remove Vundo infections:

Do the preparatory work here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with either Sysclean or Multi_AV as described in the
link above.

You may need to do:
http://www.elephantboycomputers.com/page2.html#Winfixer

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the link above (not here, please).

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigStoreUSA). Please be aware that not all local shops are skilled at
removing malware and even if they are, your computer may be so infested
that Windows will need to be clean-installed. Have all your data backed
up before you take the machine into a shop.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Re: Anti-spy ware by David

David
Sat Jun 02 10:18:33 CDT 2007

From: "millbrookgirl" <millbrookgirl@discussions.microsoft.com>

| Wow, that was a lot and I swear I could have been reading greek. Each year I
| renew the Norton stuff.........I know I have my firewall up....let's see, the
| Norton Alert that comes up says it's from windows/addins/tuilabs.dll and the
| virus name is Trojan.Vundo..........The message about the anti-spyware says
| that the MSN connection center did not detect an active
| antisywareprogam.............when you said that MSN has such programs for
| free, how do you go about getting them or downloading them?

The Vundo is a Trojan, not a virus.



Two phase answer...

Perform Part 1 then perform Part 2

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 6.0,
then you are strongly urged to remove any/all versions.
There are numerous vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 6.0 update 1 (jre 6u1)

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.6.0_01

http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1




Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.



* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Re: Anti-spy ware by Gerald309

Gerald309
Sat Jun 02 13:22:27 CDT 2007

On Jun 1, 11:08 pm, millbrookgirl
<millbrookg...@discussions.microsoft.com> wrote:
> Wow, that was a lot and I swear I could have been reading greek. Each year I
> renew the Norton stuff.........I know I have my firewall up....let's see, the
> Norton Alert that comes up says it's from windows/addins/tuilabs.dll and the
> virus name is Trojan.Vundo..........The message about the anti-spyware says
> that the MSN connection center did not detect an active
> antisywareprogam.............when you said that MSN has such programs for
> free, how do you go about getting them or downloading them?
> --
> Thanks for your help!

=====================================/.
hello again... Just up front - Norotn got really really weird in the
past 2 years. They used to have one of the best names in Antivirus.
They changed over to creating "suites" which are like the 3-fold
package of firewall, antivirus, antispyware. This got really trendy
world-wide with many companies really messing things up in antispyware
land - and this is because they all purchased really second rate
antispyware company softwares and renamed them as their suite. It has
been generally always promoted to NOT


Re: Anti-spy ware by Gerald309

Gerald309
Sat Jun 02 13:59:23 CDT 2007

On Jun 2, 2:22 pm, Gerald309 <gerald...@gmail.com> wrote:
> On Jun 1, 11:08 pm, millbrookgirl
>
> <millbrookg...@discussions.microsoft.com> wrote:
> > Wow, that was a lot and I swear I could have been reading greek. Each year I
> > renew the Norton stuff.........I know I have my firewall up....let's see, the
> > Norton Alert that comes up says it's from windows/addins/tuilabs.dll and the
> > virus name is Trojan.Vundo..........The message about the anti-spyware says
> > that the MSN connection center did not detect an active
> > antisywareprogam.............when you said that MSN has such programs for
> > free, how do you go about getting them or downloading them?
> > --
> > Thanks for your help!
>
> =====================================/.
> hello again... Just up front - Norotn got really really weird in the
> past 2 years. They used to have one of the best names in Antivirus.
> They changed over to creating "suites" which are like the 3-fold
> package of firewall, antivirus, antispyware. This got really trendy
> world-wide with many companies really messing things up in antispyware
> land - and this is because they all purchased really second rate
> antispyware company softwares and renamed them as their suite. It has
> been generally always promoted to NOT

{{{sorry....miscued the reply to early..... to finish}}}}
.... It has been generally always promoted to NOT purchase a security
suite - to bust them up and one product from one company and another
product from another company. This is also because if one of the 3
gets hit by industrial malware then it goes generally that the whola
security package is rendered worthless until they fix things.

Open MSN Browser.... Click the Security Shield up top - blue and white
shield. The drop down menu will show "Virus Guard" and 'Firewall" and
"Antispyware". If you wish to install the McAfee Personal Firewall
free or the McAfee Antivirus free or Webroot Spysweeper free - this is
where you do it. Click which one you want and you will automatically
be taken through the installation process. Done in less than 5
minutes. There is nor registration or anything at all - it is
automatic because you are an MSN Customer. You can write down any
License Number on a text file and save it to My Documents for
reference.

About the infection.... Trojan.Vundo
Apparently the full pop up message is not appearing. Usually one of
two things is occurring. One it is simply asking you "Do You Wish To
Permanently Delete Trojan.Vundo?".... and of course you click yes
because it is presenting you with a known threat that is very
dangerous and you will want that permanently deleted. Number tow, it
could be attempting to tell you that it cannot remove this threat
until you reboot into Safe Mode which is the only way to remove it.

.... Let's continue this at my groups if you will.... I do not want to
fight past other idiot responses that often happen here and then many
trolls will show up as well. I moderate my groups against this. For
instance you have Norton which has been known as one of the world's
best to remove a simple trojan here and you are getting instructions
to use independent removal utilities. This is insulting and absurd
especially to someone with quality protection.

Generally a security suite advertises to buy their full package is a
lot of times these type of messages. MSN is not intrusive like that to
interrupt a person with security software notifications about what
they have and don't have. To be getting that message you must have
installed one of the free McAfee programs - their Firewall ? MSN does
notr continually harass their customers with these type messages. If
you use their free package it will now determine what security
software you have - like here Norotn - so it will not download the
free McAfee antivirus. However, if you installed the McAfee Firewall
it may suggest once or twice to add on Webroot free. If it continually
gives some pop up - you may want to check out exactly what is going
on. This is not how MSN operates. In other words if someone signed up
for MSN right now they will NEVER get any message about what security
software they have or don't have. You have something else going on
here and there has never been any break in or phony fake spyware
messages with MSN from fakes like SpyAxe or SpyFalcon or SpywareQuake
and so on (these give fake security messages saying you are infected
and need to download their program now).
That has never occurred at MSN.com.

I really question what messages you are getting from "MSN Connection
Center"... this would NOT come from there. You may be confused as to
what you are observing. The MSN Connection Mananger does not give
messages about software - only about any temporary connection problem
to the internet.

In fact I have never seen this type message
"MSN connection center did not detect an active antisywareprogam"

If you need further help with the trojan removal - please join one of
my groups:


JOIN HERE FOR REMOVAL HELP:
BlueCollarPC.Net Website Group
http://www.bluecollarpc.net/joingroup.html
AntiSpyGroup
http://tech.groups.yahoo.com/group/AntiSpyGroup/
SpyForum
http://groups.google.com/group/SpyForum