This windows is not genuine and will shut down in five minutes

[gazter]

Just let people know about a dreadful infection that came from a company that cold calls and encourages people to visit www.ammey.com (the site is currently dead) for some security software.

Anyway the software tells the user that their machine has a fake windows license, and they need to buy one from the link their software takes them to.

That was removed without too much trouble. However it left behind something that took me *hours* to get rid of, and thats a bogus warning that pops up *before* vista logon, ie before the user enters their password.

The message is full screen with the windows vista graphic in the background, telling the user their machine has failed the genuine test and a user needs to buy a license otherwise it will shut down in 5 minutes, forcing the user to click ok.

Well, after running combofix, mse, malwarebytes, superantispyware, multi-av. gmer, tdds killer, autoruns, hijackthis etc and none of them picking anything up.

It dawned on me that this was the kind of message that can be implemented via local group policies on business etc.

I search the registry for references to the exact word, and there the little sod is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

legalnoticecaption

and

legalnoticetext

Deleted the contents of these registry items, machine running fine......

Hope that helps

[David H. Lipman]

< snip >

Well, after running combofix, mse, malwarebytes, superantispyware, multi-av. gmer, tdds killer, autoruns, hijackthis etc and none of them picking anything up.

It dawned on me that this was the kind of message that can be implemented via local group policies on business etc.

I search the registry for references to the exact word, and there the little sod is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

legalnoticecaption

and

legalnoticetext

Deleted the contents of these registry items, machine running fine......

Hope that helps

Hey, you used my Multi-AV Scanning Tool, cool.

For obvious business reasons those Local Policy keys are left alone.

[gazter]

Hey, you used my Multi-AV Scanning Tool, cool.

For obvious business reasons those Local Policy keys are left alone.

Of course, as a last resort, I use it if all else fails...

[screen317]

Thanks for letting us know about this. Will forward this to our developers.

[shadowwar]

We could target that message if its static and unique and not something they would legitly use.

Would you happen to have those files still?

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!