Micro Billing System scam

It sounds like spyware, do you run any of these on your pc ? Spybot (https://www.safer-networking.org), AVG Anti Spyware (https://www.free.grisoft.com), Ad-Aware (https://www.lavasoft.com) ? These are all free tools to remove spyware.
Go to the links to download for free.

You can run all of these on your pc, at our shop we put them on as standard.
There is a sticky I think which gives you more info on FREE anti-virus/spyware software

Spybot (google search) is free,easy to use and will wipe it off.

found this

http://www.pcadvisor.co.uk/forums/index.cfm?action=showthread&threadid=261874&forumid=1

You can do all of this off line from the internet, infact i would adivse you to be DISCONNECTED when you do the following!

You need to disable an activeX control in your web browser for starters!

Ensure you are logged on as an adminstrator (in XP).

I did this on someone else computer because they started to get this and had no idea how it had started at all and the timer had got up to 9 minutes, this when the person needed to be study work for the course they were on!

I can not rember the exact names of files so please bear with me!

Goto the Tools menu and select Manage Add-ons..., this will open up an window, in here you will see a control that starts with mbs, mbs......., select it and then at the bottom click on the disable radio button.

This does not delete the item!
OK the window!

Now we need to go and see where the other items reside:

open up My Computer from the desktop!

if you can not see the windows folder in the following part, you will have to go into the Tools menu and then Folder Options, in the window that opens you need to go to the view tab. Here you need to go down and clik the radio button for "show hidden files and folders" you will find this under Hidden files and folders.

you will also need to unselect the tick box for "Hide extensions for know file types". This will allow you see the extension .exe and .dll etc for what we will be looking for in a minute!

We need to goto into the c drive, then into the windows folder, from here we go into the system32 folder(XP).

That being: C:\WINDOWS\system32

In system32 we are looking for these two files:

mbsmon32.exe
mbsreg.exe

Click the toolbar to display the information as details instead of thumbs etc! This is important!

Note the date that these files were installed on the pc and click on the header bar to sort all of the files into date order when they were last modified.

Now look down the date column and find that date, you will see about 6 files i think, you will see the icons used by the two files above plus some others, one or two may be dll files!

NOTE ****

It is important to find the files on that date BUT ensure that the files you select all have the same TIME STAMP as mbsmon32.exe and mbsreg.exe, this will ensure you only pick the files that were installed with these two files!

****

note these files down and log off the computer!

Boot XP up and start pressing F8!

This will bring up a menu to boot XP in safe mode and into the all seeing administrator!

Choose to use ****** safe mode! *******

This will start and maintain a low resolution screen, this is ok.

At the log on choose the Administrator even if your user id (logon) has Admin rights!

A warning window will display on the screen, ok this and allow it fully load!

Now open my computer (or explorer) and goto the files we found earlier!

Those being in: C:\WINDOWS\system32

*** Remember the TIME STAMP ***

Select them and delete them!

Start up msconfig by going to the start button on the desktop ( bottom left) and goto run, in the box that appears, type msconfig and click ok. A window will open, goto the startup tab and untick the program identified as mbs...... ok that and allow the computer to reboot!

You can now delete the icon of the desktop and from the startup menu from the start button.

edit:- the file names may look like

1. winiconmon.ico.bak0
2. winicomon.ico
3. mbssm32.exe
4. Sexxxpassport.ico

or

winiconmon.ico.bak0
iniconmon.ico
UBSauthenticateAXC.ocx
Sexxpassport.ico

cheeymonkey2404 wrote: »

Hi

I haven't got a clue how this thing got on my pc, it just poped up today saying i owed £39.99. I rang to helpline number and this very stroppy women said i accessed the site on the 1st July at 10.01 and i had 3 days to cancel my free trial subcribtion and those 3 days have now passed so i have to pay £39.99. I haven't even heard of this site and it's certainly not something i would look at.


Please can someone help me to get this off my pc, i've tried the instructions posted below but i can't find any files starting with MBE.

I not a computer whizz kid, so really don't know what to do!!!!


Help please.........

Have you gone through the malware removal guide sticky on this board?

Farway wrote: »

This was discussed today on Radio 4 "You & Yours"

It may not have been you that looked at the pics, someone else having access to your PC maybe? The radio one was the hubby [I would hate to be in his shoes]

Doesn't take into account that it could easily be third party spyware that subscribes that computer remotely. There have been cases where people were actually out of the country with house locked up when they supposedly subscibed to the service on their pc (doubt a burglar would expertly lockpick a house just to view pr0n on the pc and then leave the house immaculate). I think it says it all that many anti malware companies now list in their databases as spyware and the company resorts to blackmailing you by incapacitating your property.