Security Alert

[eusetep]

I have a Dell Dimension 5150 running Windows Xp and on start up frequently get a Security Alert window stating

'Revocation information for the security certificate for this site is not available. Do you want to proceed?

 

Yes No View Certificate

 

How can I stop them appearing. I have on many occasion installed the certificate but they keep on appearing.

[RandyL]

Is this when viewing web pages in Internet Explorer?

[eusetep]

No, more often than not, when I switch the computer on

[RandyL]

No, more often than not

So you do get this sometimes when browsing and sometimes at startup?

 

Is your date and time correct?

Is your browser IE?

Do you have Norton?

What happens when you click Yes?

Is windows fully updated?

[eusetep]

Date and time is correct

Browser is Firefox

No, I use Kaspersky

When I click yes the Security Alert window closes

I have automatic updates switch on.

Sorry about the delay in replying but I lost the thread!

[RandyL]

Scroll down to the Encrypions tab and the Certificates section on this page. http://support.mozilla.com/en-US/kb/Options%20window%20-%20Advanced%20panel

 

If you click on the Validation button the first two things are ticked on mine.

[eusetep]

There are three which can be ticked. Only the top one was ticked. I can only tick either one of the top two. The bottom one wasnot ticked so I have ticked that one. I have now upgraded to Firefox version 5. maybe this will help Many thanks. I have another problem now with update manager. Any ideas Randyl?

[RandyL]

What is this? http://consumer.installshield.com/

 

This or other software you installed may be a cause not a solution. I really see no need for this type of software and often times it is bogus and causes problems.

 

Personally I would uninstall it and see how things run. If that does not help I would consider that other installed software or malware are at the root of the problem.

 

I'll contact our malware experts and have them take a look at this thread just in case.

[Starbuck]

Hi eusetep

 

After looking into this, i feel that Randy is partly correct in what he says.

This or other software you installed may be a cause not a solution. I really see no need for this type of software and often times it is bogus and causes problems.

it seems that this is installed along with an other program to ensure the updates get through.

The program this is meant to be updating may have been removed.

Another cause of this is:

If you're getting "Error 3" in the InstallShield Software, Program, or Update Manager (they're all the same thing), take a look in your C:\Program Files\Common Files\InstallShield\UpdateService\ folder. I guarantee that you are missing the pm.html, pm.css, and ISUSPM.exe.manifest files. Then, look in the images folder in that same directory .... are they missing?

To be honest, it's not a program that you actually need anyway.

All important programs will automatically update with their built in updaters.

If the files mentioned are missing, you could copy them from another system that has them on ..... or just remove the program.

[etavares]

Hi,

 

This could be as simple as a incorrect time on your computer; to a mistake on the companies part, to malware trying to load a page it shouldn't.

 

First, check your computer's date and time. Is it accurate?

 

Next, when the error pops up again, click View Certificate and post a screenshot of the result.

 

Finally, let's run a quick MBAM check:

 

Please download Malwarebytes Anti-Malware and save it to your desktop.

alternate download link 1

alternate download link 2

 

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware

  [*]Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

[eusetep]

Wow! I find this a little daunting! Many thanks chaps but all this is way above my head. . I'm 71 and my mind is not as agile as it once was. I will have to try and work through your instructions. I must admit that I have not had a recurrence of the Revocation Certificate problem so thanks for resolving that problem.

[eusetep]

G'day RandyL

 

 

Working through the responses first of all you ask what is http://consumer.installshield.com/ . I have absolutely no idea! I went through all the programs in 'Add or Remove Programs' but could not come across it.

 

 

G'day Starbuck

 

 

I checked C:\Program Files\Common Files\InstallShield\UpdateService\ folder and found ISUSPM.exe. But the images folder is empty. With my level of expertise it would be simpler just to remove it if it is not needed.but how do I remove the program? As mentioned above I can't see it in the 'Add or Remove Programs' list.

 

 

G'day etavares

 

 

Yes, the computer's date and time is correct.

 

 

If you consider that this problem is still 'lurking in the background' and it pops up again, I will post a screen shot of the View Certificate.

 

 

Before I continue with downloading the Malwarebytes Anti-Malware program, will it conflict with my Kaspersky Internete Security 2011 suite?

[Starbuck]

Hi eusetep

 

Follow the step outlined by etavares first.

MBAM will not conflict with any other security program.

[eusetep]

G'day etavares

 

Downloaded and run MBAM, following is the log. I noticed this is just a trial version. Is it worth buying a full version?

 

Malwarebytes' Anti-Malware 1.51.1.1800

http://www.malwarebytes.org

 

Database version: 7196

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

7/19/2011 3:08:47 PM

mbam-log-2011-07-19 (15-08-47).txt

 

Scan type: Quick scan

Objects scanned: 175362

Time elapsed: 3 minute(s), 9 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 2

Files Infected: 0

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

HKEY_CLASSES_ROOT\MyWaySearchAssistantDE.Auxiliary

 

(Adware.MyWaySearch) -> Quarantined and deleted

 

successfully.

HKEY_CLASSES_ROOT\MyWaySearchAssistantDE.Auxiliary.

 

1 (Adware.MyWaySearch) -> Quarantined and deleted

 

successfully.

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

c:\program files\MyWaySA (Adware.MyWebSearch) ->

 

Quarantined and deleted successfully.

c:\program files\MyWaySA\SrchAsDe

 

(Adware.MyWebSearch) -> Quarantined and deleted

 

successfully.

 

Files Infected:

(No malicious items detected)

[etavares]

Hello,

 

I personally only use the free version. It's really handy and updated often. I really like the program. I don't have experience with the full version, but I've heard really good things about it. You'll only want one program each running in real time from these 3 categories: 1) antivirus, 2) antispyware/malware (MBAM fits here) and 3) firewall.

 

Next time you get the certificate error, click View Certificate and post a screenshot. We can see what site it's trying to open and narrow down the culprit.

[eusetep]

Update Manager

 

Hello,

 

I personally only use the free version. It's really handy and updated often. I really like the program. I don't have experience with the full version, but I've heard really good things about it. You'll only want one program each running in real time from these 3 categories: 1) antivirus, 2) antispyware/malware (MBAM fits here) and 3) firewall.

 

Next time you get the certificate error, click View Certificate and post a screenshot. We can see what site it's trying to open and narrow down the culprit.

 

 

 

 

 

[ATTACH=CONFIG]551.vB5-legacyid=1213[/ATTACH]

 

 

G'day,

 

 

 

 

Just for information the Update Manager window appeared again on startup showing Error # -3. I checked the 'consumer.installshield site' and stumbled across FLEXnet Connect Software Manager. I run the program which apparently uninstalled the Update Manager. So far there has been no impact and I will see if the error comes up again.

 

 

http://extremetechsupport.com/images/misc/pencil.png