TOTAL SECURITY pop up message driving me nuts

P0psicle

Hi
I hope someone may be able to help or guide me in the right direction.

Since yesterday on my home pc I have been getting numerous pop up messages which appear to be coming from an application called Total Security.

There are two ways that this happens:
1. A Total Security message pops up when I am logged on anywhere to the www and covers the screen with a msg to the effect - 'Danger, your PC is threatened by malicious Spyware. It then offers me an opportunity to register now for $59.95 which of course I have not opted for. I get out of this by clicking the close X but of course this kicks me out of my internet session.

2. This is a worse scenario. A Total Security message pops up generally when I am on my email. I can't remember what this message says but it is on the same lines as the one I mentioned above. This time there is no close X button to click and the only way that I can end this nuisance is by going into the Windows Task Manager and ending the offending process. It took me a little while to figure out which .exe was the appropriate one. However it turns out the that the .exe beginning with the letters TS...... was the correct process to end.

Both situations are maddening because in each case I have to log back in to whichever internet session I was already in.

I have the PC (Dell) for 5 years and have always had an up to date version of Norton anti virus running. (I have subscribed to it via Eircom and pay for it on my bill)

I'm not assuming this is a virus but it is just as maddening as what I think a virus would be. Last night I ran a complete scan of my pc using Norton (it took about 3 hours) and it did not report any issues.

Can anyone help at all to explain what this Total Security thing is? Is it a virus? Is it something else? But more importantly have you any idea how I can stop the pop ups - popping up?

P0psicle

I've put it on a word doc attached

Well, I think I've attached it - my first time may not be very successful.

aidan_walsh

It does indeed look like you have a virus. I have moved the thread to the Virus Removal forum.

Can you try running the tools and posting the logs mentioned in this thread please?

P0psicle

OK so the attachment worked. Just to add now that the pop up has popped up at least 5 times in the last 5 minute throwing me out of boards each time.

Please help if you can

aidan_walsh

Can you run the tools in the thread I linked please and post the logs here? It will give us far more information than just the screen shot will.

P0psicle

Sorry for not responding until now. Thank you for the instructions which I did start following last night but then lost track and as I didn't understand exactly what I was doing decided that it would be safer not to continue. Apart from that I kept getting thrown out every few minutes !!

I have spent a lot of the day onto Eircom help desk and after recommending that I delete cookies, temp files etc they then directed me to a site that has a program called SPYBOT. After spending 3 hours with SPYBOT (attempting to remove what Eircom believe is Spyware) I am now no better off and the virus/spyware/whatever is still there.

At least they demod to me how to get rid of the pop up and not get thrown out of the application I am in. This is simply done by clicking the back button !!!

I am off on hols now for a week so I have to leave it unfortunately. What frustrates me most is that the whole www seems to be riddled with virus/malware/spyware and you never know the day or the hour your pc will be attacked. The only positive out of all of this is that I have survived for 5 years without the annoyance of these 'viruses'

Thanks for going to the trouble of helping me.

Agent Smith

Hi, and Welcome to boards.ie


Firstly, I'd Download AVG Free as an anti virus. I find its better then norton and some of the other ones out there.

make sure you have a decent Firewall set up. Zonealarm is Good.

Also, Can you try using firefox as your brouser, its a perfect replacement for IE and should be able to keep you running online.


Lastly, when you get back, can you do the following


"click start"
"run"
type in "msconfig"

and go to the start up tab
and give us a list of whats running on startup?

Xaniaj

Had a similar problem with this; it was basically blocking any program that I could have used to attempt to get rid of it. (ie I’d try and open my anti visur, task manager, system restore etc, it would block the programs from opening). It was also blocking my Firefox but not my older version of IE luckily enough! In my case, I also tried to manually delete the files from my local drive (with no luck as it forced the computer to restart when I went deleting the files).

What fixed it in the end is to do a quick reboot and when it starts up, IMMEDIATELY open up task manager. You can open it up before the total security program starts so you have a few seconds where you can close end the process before it forces task manager shut again (sort your list of processes and it should appear as a random number.exe), after that, use whatever program to remove it from your computer and get your anti virus up to day.

Hope that helps!

P0psicle

"click start"
"run"
type in "msconfig"

and go to the start up tab
and give us a list of whats running on startup?

Regarding the above instructions, I've done as requested but how do I provide you with the list of what's running, the list doesn't all display in one window.

Agent Smith

Sorry for the delay.


You can expand it by streching it out, take a screenshot and post whats running.

TwistsAndTurns

Hi P0psicle, My brother-in-law had the same proplem but it was called Cyber Security. I ran Malwarebytes Anti-Malware first and then I went looking for it in the registry and removed the entry and it seemed to do the job. Two weeks ago or so and no problems on his computer. I'll outline what I done and maybe aiden or actorseeksjob or some of the good guys on here may be able to say if this was ok.

Go to start and run, enter Regedit in box and click ok. Registry Editor will open up, what your looking for now is HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ CS
RUNNING PROGRAM\cs.exe in your case it will be ts.exe.

Open each section HKEY_CURRENT_USER then look for SOFTWARE and so on until you come down to the run file when you open this on the right side you should see your ts.exe file. I deleted this and restarted the computer and everything was ok.

If this is wrong to do somebody let me know as I'am still a novice picking up alot of good stuff from your sticky's here.