More AVSystem care

[Alycie]

In case someone who know how to stop this guys with the avsystemcare malware, here is the owner information: I have tried everything I can do to stop this. I may have found a temporary cure. I removed firefox from my system and reinstalled. Haven't seen it since. But am holding my breath.

Domain Name: AVSYSTEMCARE.COM

Registrar: YESNIC CO. LTD.

Whois Server: whois.yesnic.com

Referral URL: http://www.yesnic.com

Name Server: NS1.AVSYSTEMCARE.COM

Name Server: NS2.AVSYSTEMCARE.COM

Status: ok

Updated Date: 21-may-2007

Creation Date: 07-jun-2006

Expiration Date: 07-jun-2008

>>> Last update of whois database: Thu, 09 Aug 2007 15:26:35 UTC <<<

:Registrant::

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

::Administrative Contact::

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

::Technical Contact::

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

::Name Servers::

ns1.avsystemcare.com 85.12.60.11

ns2.avsystemcare.com 85.12.60.22

::Dates & Status::

Created Date 2006-06-07 03:04:05 EDT

Updated Date 2007-05-22 01:01:45 EDT

Valid Date 2008-06-07 03:04:05 EDT

Status ACTIVE

[Alycie]

This is the owner info for AVSystemcare. I have had this thing hijacking my computer for over a week. I have tried everything.

I was looking to see if a program showed up in my list, so I could delete it. Did not see anything. But saw two installations of firefox. Deleted one and the other disappeared. I had to reinstall. I have not seen the avsystemcare since then but it has only been a few hours.

Domain Name: AVSYSTEMCARE.COM

Registrar: YESNIC CO. LTD.

Whois Server: whois.yesnic.com

Referral URL: http://www.yesnic.com

Name Server: NS1.AVSYSTEMCARE.COM

Name Server: NS2.AVSYSTEMCARE.COM

Status: ok

Updated Date: 21-may-2007

Creation Date: 07-jun-2006

Expiration Date: 07-jun-2008

>>> Last update of whois database: Thu, 09 Aug 2007 15:26:35 UTC <<<

:Registrant::

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

::Administrative Contact::

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

::Technical Contact::

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

::Name Servers::

ns1.avsystemcare.com 85.12.60.11

ns2.avsystemcare.com 85.12.60.22

::Dates & Status::

Created Date 2006-06-07 03:04:05 EDT

Updated Date 2007-05-22 01:01:45 EDT

Valid Date 2008-06-07 03:04:05 EDT

Status ACTIVE

The previous information has been obtained either directly from the registrant or a registrar of the domain name other than Network Solutions. Network Solutions, therefore, does not guarantee its accuracy or completeness.

Show underlying registry data for this record

[JeanInMontana]

Hi Alycie and welcome to Malwarebytes. I know how angry these things can make a person. But please don't post into HiJack This log threads. I doubt you got rid of your problem reinstalling Firefox either. If you would like assistance please follow these instructions and post in the HiJack This forum. Start your own topic.

If you haven't already, please get these programs, update and run a complete scan removing all items found.

Spybot Search & Destroy Be sure to immunize with this one also.

AVG AntiSpyware

Then go here and run a scan PandaActive Scan

Post the logs from the Panda and AVG scans please, along with a log from this program HiJack This!

I will analyze the logs and give you further instructions. Be patient and persistent. These things can take time and many procedures.

[Unadecal]

Name : Francheska Karlotti

Email : avsystemcare@yahoo.com

Address : Main Street, 26, Road Town

Zipcode : SW7 4DS

Nation : VG

Tel : 442081149243

Fax :

Hello Alycie,

I hope you finally got rid of this piece of malware. As for the information that you dug up, it appears to be forged. the Zipcode and telephone numbers appear to correspond to London (UK), but the Address line is bogus (the correct address for the Zipcode is Cromwell Road, Kensigton, London - "Road town???") and I did not bother finding out which country VG corresponds with.

Obviously the domain owner does not want to be traced and YesNic do not bother to run background checks on their clients. YesNic purport to have zero tolerance on abuse, but they are notorious for hosting all sorts of rubbish and since they are in Korea, they are also beyond reach of any authorities. I guess that as long as their bills are paid...

Regards,