DelphiFAQ Home Search:

SpySheriff displays secure32.html - where does Secure32.html come from?

 

comments223 comments. Current rating: 5 stars (82 votes). Leave comments and/ or rate it.

Question:

My computer got infected with Spysheriff and I was able to remove it. But it still shows a blue background and the bogus warning as the background - which is set up in file c:secure32.html. When I delete the file, it comes back. Where does this Secure32.html come from?

Answer:

The file secure32.html is generated by a program called Paytime.exe.
Paytime.exe is located in C:\WINDOWS\system32\paytime.exe

How to solve this problem:
  1. Bring up your taskmanager by pressing Control + Alt + Delete, in some Windows versions select the 'Processes' tab. Then click on 'Paytime.exe' and end the task.
  2. Delete paytime.exe, which you should find under c:WindowsSystem32
  3. Delete c:secure32.html
  4. Run Explorer. It will tell you that it cannot find the path for secure32.html. Use the default configuration of Explorer and everything will be OK.


Content-type: text/html

Comments:

You are on page 13 of 15, other pages: 1 2 3 10 11 12 [13] 14 15
2007-01-02, 03:36:57
anonymous from Latvia  
try to find some deleter prog to deltee autosys.exe because its a malaware or virus how u want to call itu can look for info ar google
2007-01-02, 09:48:54
anonymous from India  
In my case of secure32.html it was a file by the name autosys.exe & WeRed.exe which was causing the problem.Finally I had to format my C drive as it was causing problems to my Net connection
2007-01-03, 06:49:11
anonymous from Iceland  
Start-Run
Type Regedit and press Enter
This brings up the registry
Press F3
Type secure32.html and press Enter
For each found reference, delete it and press F3 again until all references have been deleted
Restart your computer
Open IE and change the home page to whatever you want
Problem solved (for me anyway)
2007-01-03, 08:56:13
anonymous from United States  
can anybody help i can not validate windows 11 my computer was wiped and it not the orrigal copy of windows in my computer is there any way round this
2007-01-03, 09:04:59
HAPPYUSER from Australia  
rating
IF THEM 4 STEPS DON'T WORK THEN TRY THIS:

1.) Goto C:\Windows\System32

2.) Find the File named AUTOSYS.EXE (This is what sends the dreaded secure32 nightmare.

3.) Delete AUTOSYS.EXE (enjoy peace of mind once more.)

AND TRY THIS

Start-Run
Type Regedit and press Enter
This brings up the registry
Press F3
Type secure32.html and press Enter
For each found reference, delete it and press F3 again until all references have been deleted
Restart your computer
Open IE and change the home page to whatever you want


THEN IT SHOULD WORK PERFECTLY BECAUSE THATS WHAT I DONE
2007-01-03, 09:06:28
HAPPYUSER from Australia  
BY THE WAY SPYSHERRIFF ALSO STUFFS UP MSN IN A WAY
2007-01-03, 14:55:31
anonymous from United Kingdom  
ok peeps i also could not find any of the above .exe files that have been refered to in above posts so i got rid of it like this
to get rid of it i had to start in safe mode in the administrater profile run spybot and delete all the spyware (in this case coolwww)
then restart again in safe mode in my profile and do the same then start internet explorer still in safe mode then delete all the history etc then change the home page then restart in normal (so far so good)
2007-01-04, 08:54:59
anonymous from United Kingdom  
Ok this is good advice and will remove the malware, If however anyone is having the problem that allthough it is gone you can no longer change your default startpage, you try to change it but it just reverts back to c:\secure32.html.
What you need to do is in IE, goto Tools > Internet Options > (TAB) Advanced > Then near the bottom you will find Reset. This is the big bad IE reset button, you may loose some settings but it will also reset your default page. Im sure there is a registry hack to do this and i think i even saw one whilst scrolling down the page, but it think this is more suitable for a non registry savy user. Thanks P.S This will only work once the malware has been removed, this is just to clear up the aftermath so to speak.
2007-01-05, 04:28:42
office22b@yahoo.com.tw from United Kingdom  
Help! I cannot change my IE start page from defaulting to secure32.html, not even in regedit!

Chris
2007-01-06, 00:34:56
anonymous from Canada  
Just Use Spybot Search&Destory do a full system scan and you'll be fine
2007-01-06, 17:27:54
Nygge from Sweden  
rating
TACK HAPPYUSER !!!! Det fungerar kanon fint!!! It really works grrreat
2007-01-06, 23:41:21
anonymous from United States  
thx to the anonyomous person who said to do the regedit found 51 secure32.html registries thx alot
2007-01-09, 08:22:11
mr t uk from United Kingdom  
A big big thankyou to HAPPYUSER your solution seems to have worked perfectly and it was so easy thanks again.....now how do i delete the little shit who created it
2007-01-11, 11:40:06
anonymous from Belgium  
Wel I got same prob, I'm getting the norton antivirus warning that it's blocking my homepage change. I 've tryed many things, like spybot, ad aware,.... also we these tips out here , i can't fix it, can't find paytime, no secure 32 anywhere. I might have found autosys, but i can't remove it.
I also don't understand the hijack stuff =S

Plz help me, explain as much as you can, cause im no pro =S

Tnx
2007-01-11, 12:23:03
from Canada  
Does anyone have secures0.exe and msasvc.exe on their systems. Are either of these malware?

Thanks
You are on page 13 of 15, other pages: 1 2 3 10 11 12 [13] 14 15

 

 

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture: