General discussion

RealSafePC27p.xorg

Twice this week my browser has been taken over by a site who's URL doesnt make sense.

http://www2.realsafepc27p.xorg or http://www2.realsafepc24p.xorg

It loads a page with a simulated computer scan. The only way to kill it is to close the browser. I did not find any mention of this URL in either Google or WhoIS. Has anyone seen this behavior?

Spybot says I'm clean.

Discussion is locked
Follow
Reply to: RealSafePC27p.xorg
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: RealSafePC27p.xorg
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Comments
- Collapse -
Some Things to Try..

rbarruec..

If you haven't scanned with Malwarebytes' Anti-Malware, I would suggest giving it a try. The free version can be downloaded from here or (directly) from here. Save it to your desktop.

Double-click on the mbam-setup.exe, making sure to "Check for Updates" afterwards. Run a Quick Scan. After the scan completes, click OK and Show Results . Make sure everything is checked, before clicking Remove Selected. Reboot to complete the disinfection process.

If Malwarebytes' Anti-Malware doesn't find anything try scanning with:

A-squared Free 4.5
http://www.emsisoft.com/en/software/free/

F-Secure's Online Scanner
http://www.f-secure.com/en_EMEA/security/tools/online-scanner/

Best of luck..
Carol

- Collapse -
A Similar URL?

rbarruec..

While reading some news articles just now, my eyes fell upon a screenshot. The URL reminded me of your post. Look at the URL in this screenshot. The shot was included in an article titled, "Rogue Antivirus Gangs Seize on McAfee Snafu". The title and article "speak for itself".

It's not the exact same URL, but it does look "somewhat" similar. My point? I would hope you made use of other scanners, in addition to Spybot. You have all to gain, and nothing to lose. Perhaps, with the exception of a little time. Plain

Carol

- Collapse -
I think it was BitTorrent

Carol,

Your screen shot is exactly what I was seeing. I have run SpyBot and AdAware and have found nothing. I did uninstall a BitCometAgent in Firefox and have since seen nothing. I got that after installing the BitComet software, even after uninstalling BitComet the Addon was still in Firefox. I had to disable it manually.

If I see the issue again. I leave another post. Thanks.

- Collapse -
Sounds like it was..

Hopefully it's gone .. gone.. gone! IF you ever run into it again, give Malwarebytes' Anti-Malware a try.

Thanks for posting back and letting me know. It was bothering the heck out of me, that I couldn't find ANY reference to the URL you posted. When I saw the screenshot, my eyes "lit up like a Christmas tree". (As "they" say) Grin

I'm glad to hear "all is well".

Stay safe..
Carol

CNET Forums