161.40.59.127 attacked port 13567 BankerfoxA

[Hollywood2]

I am running 64 bit win7 and use Microsoft Security Essentials which is updated and real time protection is enabled. when a pop up window claimed i was infected by Bankerfoxa port 977 attacked port 13567 161.40.59.127 asking me if it wanted me to have it turn on my virus protection I hit my toolbar to see if security essentials was loaded ( which it was suppose to be but it was not) so i click start/programs, Microsoft security essentials i right click it run as admin and it opens its window and then closes and a pop up claims one of its files are corrupt and ask again if it wants me to have it start my anti virus program, while this attack is in progress i cannot use the prompt and run sfc /scannow or chkdsk /f all of Microsoft tools are disabled I have to reboot in order to stop this from happening and it has happened twice both times while looking for something with Google. wondering if anyone else has had this or similar and should i switch to avira anti virus
thanks

 

[stormy13]

Following this,

How to Remove BankerFox.A

should get rid of it. And for what it's worth the IP address that was reported by that popup, I don't think they were trying to hack your computer,

Whois record for 161.40.59.127

 

[KazeNoKoe23]

Following this,

How to Remove BankerFox.A

should get rid of it. And for what it's worth the IP address that was reported by that popup, I don't think they were trying to hack your computer,

Whois record for 161.40.59.127

LOL@the Whois record. Definite win. :roflmao:

 

[arkhi]

Following this,

How to Remove BankerFox.A

should get rid of it. And for what it's worth the IP address that was reported by that popup, I don't think they were trying to hack your computer,

Whois record for 161.40.59.127

Your link wanted us to download a registry-related program which, based on past experiences, aren't really reliable.

McAfee lists BankerFox.A as a fake malware as per FakeAlert-SpywareProtect

Based on McAfee's data, Microsoft list this similar scenario as caused by Encyclopedia entry: Trojan:Win32/FakeSpypro - Learn more about malware - Microsoft Malware Protection Center

 

[gladson1976]

One thing I don't understand, if MSE was not running then where did the popup come from ?? :huh:

 

[arkhi]

It has to be one of those websites were they trick you in to installing rogue anti-virus malware. See my first link, some screenshots are there.

 

[Bill2]

Scan with Malwarebytes and Spybot.

 

[Hollywood2]

I thank all of you for your knowledge, i am downloading the file and hopefully kill whatever it is. MSE was running at the time of the first pop-up window i believe the pop-up window was responsible for disabling MSE and the prompt (admin) was lame also you could type sfc /scannow and enter but it would not run, chkdsk /f also as arkhi said the reason for it is to have you buy it out of fear, both times i i rebooted it went back into hiding i suppose i do know both times i was using goggle and again both time i was looking at the choices of my search motor mounts for a neon. the program kept asking if i wanted it to turn on my anti-virus program each time i would (x) close it but when i try and start MSE this banker thing rendered it useless and another pop-up would claim the exe file is corrupt and again ask to turn on virus. i thank you all very much and i will do as you have suggested. thanks

 

[Corrine]

Hi, Hollywood2. Another name for the rogue is Antivirus Soft. See the removal guide at Bleeping Computer: Remove Antivirus Soft.