My Safari Web Browser got redirected to http://scanner.power-antivirus-2009.com/?aff=

[Former Member]

While typing this, I was being shaken by earthquake in Burbank, Calif, held on my chair and just about to press 'Submit.' Wow, we haven't felt this for quite some time. :confused:

I was playing my Garmin GPS and saw "Exhibits International, Sun Valley, Calif.," found "Curriculum Vitae - S.C.Schoneberg Fine Arts - Portraits, Paintings" and got redirected to this

possibly dangerous link removed for safety reasons

Watch out, if you happen to experiment, beware.

[exbrit]

Removed the link. Are you OK now as your post seemed really just to be advising folks of this occurrence?

If not do the usual precautions of running extra anti-spyware tools, any of the free ones we recommend here: http://community.mcafee.com/showthread.php?t=136913

No anti-virus application is perfect that's why we recommend these other products, before you question their use again as you did in previous posts.

If your browser has been hijacked then use Hijackthis as instructed at the bottom of that thread.

Hope that helps.

[Former Member]

Oppps, sorry for putting that link. My work's laptop has McAfee AV+AS enterprise, plus other anti-malware stuff. If I were using Windows XP SP2, Microsoft Internet Explorer or Opera, it would have automatically loaded in my computer. I'd fixed a Windows XP SP2 recently the user said this Antivirus 2009 just popped up in his computer even if has the same McAfee like what my laptop got....

GET /?aff=1O5O HTTP/1.1
Host: scanner.power-antivirus-2OO9.com
Connection: close

So it's from Russia with love!

~$ whois -h whois.estdomains.com power-antivirus-2009.com
--
Domain Name: POWER-ANTIVIRUS-2OO9.COM

Registrant:
Sawert Alliance ltd.
Peltonen Martti (seodancer@gmail.com)
Jeledoroznaya str. 14
Volovoso
Leningradskaya oblast,188410
RU
Tel. +7.9218901266

Creation Date: 29-Jul-2008
Expiration Date: 29-Jul-2009

[exbrit]

That is rogue anti-spyware and should be easy enough to get rid of using anti-spyware tools or the Hijackthis method.

You say "just popped up" - as in time gone by. Has the problem been fixed or what?

[Former Member]

I used Spybot_S&D before. It has option to prevent your computer from accessing rogue sites by editing hosts file, mostly at C:\Windows\System32\Drivers\Etc\hosts because mine has D:\Windows\System32\Drivers\Etc\hosts. In this case if I add a a line like "127.0.0.1 whatever.power-antivirus-2009.com" my Web browser will now says, "Internet Exploder can’t open the page “http://whatever.power-antivirus-2009.com/?aff=1050” because it could not connect to the server “whatever.power-antivirus-2009.com.”

You can also block pop ups and banner ads by editing hosts file. For more info about blocking unwanted parasites with a host file, go to http://www.mvps.org/winhelp2002/hosts.htm

[exbrit]

Ah, good advice.

[Former Member]

Actually I've been editing hosts file for quite sometime even now before seeing it with Spybot_S&D mainly to block annoying unwanted pop ups and ad banners. By the way, when scanning Windows XP's using McAfee Anti-virus with the McAfee Spyware Enterprise Module, it tend to mess up the hosts file, so I added "D:\Windows\System32\Drivers\etc\hosts" (or C:\...) in the "Set Unwanted Progam Exclusion" and do "attrib +s +s +h C:\Windows\System32\Drivers\etc\hosts" every computer in my domain. So far so good almost all business computers I maintain seldom get infected.

[Former Member]

If it's "Power antivirus 2009" then you might want to check these instructions: How to remove Power Antivirus 2009 (Uninstall Instructions).

After that, do an online scan here: http://onecare.live.com/site/en-us/center/howsafe.htm

Also, make sure you have the latest version of Windows installed. Check if your version of Windows is up-to-date at: Windows Update. Use the "Custom" button. This way you also get the "Optional" updates as well as the "Critical" updates/patches.

[Former Member]

Why should I read those threads you put there when I already figured the fix myself long time ago? Go to onecare.live.com? Wa-ha-ha-ha, I'm not a newbie to do and why should I?

[Former Member]

Are you insulting me? I'm a junior in this forum but not a newbie.
:mad:

How can I close this thread I started?