Results 1 to 12 of 12

Thread: MBS bill virus/malware

  1. #1
    Registered+
    Join Date
    Nov 2006
    Posts
    60
    Thanks
    32
    Thanked
    0 times in 0 posts

    MBS bill virus/malware

    Hi all

    Yet another friends computer (words getting round so maybe i should start charging ) has been handed to me this one has a problem with MBS (micro billing services) who have installed a very difficult to get rid of pop up program. I have searched the hexus forums but there is nothing posted on this so i will tell you what i know.

    MBS collect payments for websites (usually porn sites) and use a pop up proram to annoy or blackmail people into paying for something they are unaware they agreed to. A lot of people are adamant they have not visited the site(s) involved nor agreed to payment for anything.

    Problem is the removal of what most people seem to regard as a a blatant con. Instructions on its removal can be found with a google search. These instructions include disabling add ons and files with mbs in the title. The files are said to be found in C:\windows\system32.
    Works for a lot of people. However in my friends laptop there are no add ons or files that match the description given. Obviously these files/addons are hiding under different names. There are many add ons i am not sure of so disabling one at a time and restarting would be very time consuming.

    So finally my question. Does anyone have experience of this and what range of different files names i should be looking for or indeed what names the addons could be hiding under. I have also looked in msconfig under startup and tools.

    Many thanks
    Last edited by unclecrash; 21-01-2008 at 11:03 PM. Reason: refining a statement

  2. #2
    Treasure Hunter extraordinaire herulach's Avatar
    Join Date
    Apr 2005
    Location
    Bolton
    Posts
    5,618
    Thanks
    18
    Thanked
    172 times in 159 posts
    • herulach's system
      • Motherboard:
      • MSI Z97 MPower
      • CPU:
      • i7 4790K
      • Memory:
      • 8GB Vengeance LP
      • Storage:
      • 1TB WD Blue + 250GB 840 EVo
      • Graphics card(s):
      • 2* Palit GTX 970 Jetstream
      • PSU:
      • EVGA Supernova G2 850W
      • Case:
      • CM HAF Stacker 935, 2*360 Rad WC Loop w/EK blocks.
      • Operating System:
      • Windows 8.1
      • Monitor(s):
      • Crossover 290HD & LG L1980Q
      • Internet:
      • 120mb Virgin Media

    Re: MBS bill virus/malware

    does avast/spybot etc not get it?

  3. #3
    radix lecti dave87's Avatar
    Join Date
    Sep 2005
    Location
    England
    Posts
    12,806
    Thanks
    657
    Thanked
    931 times in 634 posts
    • dave87's system
      • Motherboard:
      • Asus
      • CPU:
      • i5 3470k under Corsair H80 WC
      • Memory:
      • 8gb DDR3
      • Storage:
      • 240gb SSD + 120gb SSD
      • Graphics card(s):
      • Asus HD7950
      • PSU:
      • XFX 600w Modular
      • Case:
      • Lian Li PC-A05FNB + Acoustipack
      • Operating System:
      • Windows 10 Pro
      • Monitor(s):
      • 2x Dell S2309W (1920x1080)
      • Internet:
      • BT Infinity Option 2

    Re: MBS bill virus/malware

    To be sure it is entirely gone? I'd reformat. Not exactly a helpful suggestion, but 100% guaranteed to work.

  4. #4
    Registered+
    Join Date
    Nov 2006
    Posts
    60
    Thanks
    32
    Thanked
    0 times in 0 posts

    Re: MBS bill virus/malware

    I have not tried avast or spybot (i will look them up now) Norton and avg do not find it though.

  5. #5
    Senior Member godsdog's Avatar
    Join Date
    Jul 2007
    Location
    Jelly Wall Hotel
    Posts
    737
    Thanks
    15
    Thanked
    61 times in 54 posts
    • godsdog's system
      • Case:
      • Silverstone TJ04
      • Monitor(s):
      • Samsung 204B
      • Internet:
      • UKFSN ..have to check

    Re: MBS bill virus/malware

    It's actually quite messy this. MicroBillSys file traces are listed at the bottom.

    You can run SUPERAntiSpyware and Spybot-S&D but depending what kind of infection / payload has been delivered it would be simpler and quicker to reinstall, especially if you're not familiar with system clean ups.
    Last edited by godsdog; 22-01-2008 at 01:00 AM.
    .
    "Ladies and Gentlemen, take my advice: Pull down your pants and slide on the ice"

  6. #6
    Fried Chip Extremist alsenior's Avatar
    Join Date
    Nov 2005
    Location
    Stafford
    Posts
    2,949
    Thanks
    103
    Thanked
    191 times in 145 posts
    • alsenior's system
      • Motherboard:
      • DFI Lanparty Jr x58-T3H6
      • CPU:
      • Core i7 920
      • Memory:
      • 6 x 2GB ocz Gold
      • Storage:
      • 1 TB Samsung F3
      • Graphics card(s):
      • 1gb 4890 vapor-x xfire
      • PSU:
      • xfx 850W
      • Case:
      • Lian-li Pc7
      • Operating System:
      • Windows 7 X64
      • Monitor(s):
      • Dell 2208WFP
      • Internet:
      • 30mb Virgin media

    Re: MBS bill virus/malware

    i have cleaned this up a few times. there is a forum post somewhere else that give you the heads up on how to remove it. give me a few minutes and i'll find the site

    Edit : found How to remove MBS account manager - Geeks to Go!
    Quote Originally Posted by Jay View Post
    What kind of emergency would need Windows 95? I think you are already in a bad state of emergency when your backup plan is Windows 95.
    Beginners guide to raid Beginners guide to raid post edition Hexus.Social - FAQ

  7. Received thanks from:

    unclecrash (13-02-2008)

  8. #7
    Mostly Me Lucio's Avatar
    Join Date
    Mar 2007
    Location
    Tring
    Posts
    5,163
    Thanks
    443
    Thanked
    445 times in 348 posts
    • Lucio's system
      • Motherboard:
      • Gigabyte GA-970A-UD3P
      • CPU:
      • AMD FX-6350 with Cooler Master Seldon 240
      • Memory:
      • 2x4GB Corsair DDR3 Vengeance
      • Storage:
      • 128GB Toshiba, 2.5" SSD, 1TB WD Blue WD10EZEX, 500GB Seagate Baracuda 7200.11
      • Graphics card(s):
      • Sapphire R9 270X 4GB
      • PSU:
      • 600W Silverstone Strider SST-ST60F
      • Case:
      • Cooler Master HAF XB
      • Operating System:
      • Windows 8.1 64Bit
      • Monitor(s):
      • Samsung 2032BW, 1680 x 1050
      • Internet:
      • 16Mb Plusnet

    Re: MBS bill virus/malware

    This is where I find my copy of System Mechanic a useful tool, it's uninstaller tends to get rid of just about all files and registry keys associated with a particular program, no matter where it finds them on the PC.

    I wish they'd sell a license and copy that could run straight from a USB memory stick

    (\___/) (\___/) (\___/) (\___/) (\___/) (\___/) (\___/)
    (='.'=) (='.'=) (='.'=) (='.'=) (='.'=) (='.'=) (='.'=)
    (")_(") (")_(") (")_(") (")_(") (")_(") (")_(") (")_(")


    This is bunny and friends. He is fed up waiting for everyone to help him out, and decided to help himself instead!

  9. #8
    Senior Member godsdog's Avatar
    Join Date
    Jul 2007
    Location
    Jelly Wall Hotel
    Posts
    737
    Thanks
    15
    Thanked
    61 times in 54 posts
    • godsdog's system
      • Case:
      • Silverstone TJ04
      • Monitor(s):
      • Samsung 204B
      • Internet:
      • UKFSN ..have to check

    Re: MBS bill virus/malware

    Except things change. The last updated version was clocked at September 26th 2007 on the sunbelt article, and from what I remember it's changed since then too. In other words, I wouldn't be too complacent about full removal using bfu.


    Edit: quick check reveals that November 11th was another update version and there has probably been another. AntiVir anti virus picks it up and it's also the best remover out of the three free ones. So I would change AVG to Avira's AntiVir. So try BFU and run Antivir and then run two antispyware programs above and provided you haven't got some dastardly newer version, you should be ok (maybe).
    .
    .
    Last edited by godsdog; 22-01-2008 at 12:20 PM.
    .
    "Ladies and Gentlemen, take my advice: Pull down your pants and slide on the ice"

  10. #9
    Registered+
    Join Date
    Nov 2006
    Posts
    60
    Thanks
    32
    Thanked
    0 times in 0 posts

    Re: MBS bill virus/malware

    Spybot found two files (from memory sprzu.exe and u2 something can't remember the rest of the name) associated with mbs so i manually removed them. The following was also highlighted....
    HKEY_LOCALMACHINE\software\microsoft\windows\currentversion\run,mbssm32.
    I checked in regedit but it was not there. Any ideas why or how i can find it?

    Never used bfu before. It looks like i have to name the file it will delete so do i have to run it for each file (Other forums on the subject say there are six files to remove in total meaning i need to find their names before using bfu) or will it remove all associated files.

    I am switching to nod32 soon and will recommend to my friend he does the same but should i (we) be running more than just nod32 to gain complete protection from programs such as these or is a regularly updated nod going to be sufficient.

  11. #10
    radix lecti dave87's Avatar
    Join Date
    Sep 2005
    Location
    England
    Posts
    12,806
    Thanks
    657
    Thanked
    931 times in 634 posts
    • dave87's system
      • Motherboard:
      • Asus
      • CPU:
      • i5 3470k under Corsair H80 WC
      • Memory:
      • 8gb DDR3
      • Storage:
      • 240gb SSD + 120gb SSD
      • Graphics card(s):
      • Asus HD7950
      • PSU:
      • XFX 600w Modular
      • Case:
      • Lian Li PC-A05FNB + Acoustipack
      • Operating System:
      • Windows 10 Pro
      • Monitor(s):
      • 2x Dell S2309W (1920x1080)
      • Internet:
      • BT Infinity Option 2

    Re: MBS bill virus/malware

    NOD32 should be sufficient unless he's the one actively installing the software.

  12. Received thanks from:

    unclecrash (13-02-2008)

  13. #11
    Senior Member godsdog's Avatar
    Join Date
    Jul 2007
    Location
    Jelly Wall Hotel
    Posts
    737
    Thanks
    15
    Thanked
    61 times in 54 posts
    • godsdog's system
      • Case:
      • Silverstone TJ04
      • Monitor(s):
      • Samsung 204B
      • Internet:
      • UKFSN ..have to check

    Re: MBS bill virus/malware

    Quote Originally Posted by unclecrash View Post
    Spybot found two files (from memory sprzu.exe and u2 something can't remember the rest of the name) associated with mbs so i manually removed them. The following was also highlighted....
    HKEY_LOCALMACHINE\software\microsoft\windows\currentversion\run,mbssm32.
    I checked in regedit but it was not there. Any ideas why or how i can find it?
    The combination of AntiVir / SUPERAntiSpyware / Spybot should clean it. Failing that it's a HijackThis job where you have to look at the infection - and unless someone has the time to go through it properly (I don't have the time right this second to go through it properly) then your best bet is either reinstall or let Nod32 have a go at it.

    Quote Originally Posted by unclecrash View Post
    I am switching to nod32 soon and will recommend to my friend he does the same but should i (we) be running more than just nod32 to gain complete protection from programs such as these or is a regularly updated nod going to be sufficient.
    The staple diet of an average Windows system should have a decent anti virus package, spyware prevention and spyware removal capability. Nod32 is one of the best on the market. Combine that with Spywareblaster (prevention and free) and SUPERAntiSpyware and/ or Spybot S&D (removal and free) you should be more than covered. ...unless you are being deliberately reckless.
    Last edited by godsdog; 22-01-2008 at 02:58 PM.
    .
    "Ladies and Gentlemen, take my advice: Pull down your pants and slide on the ice"

  14. Received thanks from:

    unclecrash (13-02-2008)

  15. #12
    Registered+
    Join Date
    Nov 2006
    Posts
    60
    Thanks
    32
    Thanked
    0 times in 0 posts

    Re: MBS bill virus/malware

    I read throgh the link you provided alsenior and now understand how to use bfu properly. Cheers. I will try that and hope it finds the files i can't.

    Many thanks to all who posted replies.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Bill Gates and Hell
    By XA04 in forum General Discussion
    Replies: 12
    Last Post: 29-05-2006, 12:43 AM
  2. Phone bill help
    By Robert in forum Help! Quick Relief From Tech Headaches
    Replies: 1
    Last Post: 27-05-2006, 11:54 PM
  3. Bill Hicks: A slight return.
    By blockers in forum Consumer Electronics
    Replies: 5
    Last Post: 28-06-2005, 11:41 PM
  4. Always check your orange bill
    By shiato storm in forum General Discussion
    Replies: 8
    Last Post: 28-06-2005, 02:41 PM
  5. BT replaces 'red bill' with Indian call centre nag
    By Steve in forum General Discussion
    Replies: 13
    Last Post: 04-08-2004, 05:54 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •