HT Logs. Tips, FAQs, Analyze.

ntuser_mssec.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: ntuser_mssec
Filename: ntuser_mssec.exe
Command: %UserProfile%\start menu\programs\startup\ntuser_mssec.exe
Startup Type: Startup folder
HijackThis Category: O4
HijackThis Line:

O4 – Startup: ntuser_mssec.exe

DDS Line:

StartupFolder: c:\documents and settings\user\start menu\programs\startup\ntuser_mssec.exe

Combofix/RSIT Line:

C:\Documents and Settings\user\Start Menu\Programs\Startup
ntuser_mssec.exe

Description: trojan FakAlert also known as Mal/FakeAV-BT [Sophos], TrojanDownloader:Win32/Fakeinit [Microsoft], Trojan.FakeAV [Symantec], Trojan.FakeAV [PC Tools], Trojan-Downloader.Win32.FraudLoad.wxpn [Kaspersky Lab]

How to remove: use HijackThis + Malwarebytes` Anti-malware or the steps below.
1. Download OTM by OldTimer from here and save to your desktop.
Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):

:files
%UserProfile%\start menu\programs\startup\ntuser_mssec.exe

:Commands
[emptytemp]
[Reboot]

Click the red Moveit! button. If you are asked to reboot the machine choose Yes. When the tool is finished, it will produce a report for you.

2. Download Malwarebytes Anti-malware. Install, perform a scan and let it remove what it found. Reboot afterwards (important).

This entry was posted on Thursday, May 27th, 2010 at 12:43 am and is filed under O4, Startup folder, Trojan. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.