My PC is being held to ransom
My story today in technology Guardian – My PC is being held to ransom – looks at an online billing system developed by Micro Bill Systems. It’s used by the porn website sexxxpassport.com but has disrupted PCs owned by people who say they’ve never signed up but receive a popup (Your MBS Bill). The story was prompted by a reader contacting Ask Jack
Please also see my later story – Legal wrangles over porn billing software (The Guardian, 31 May 2007) and my associated blog post
Of the several removal methods talked about in forums, Prevx 2.0 appears to be the fastest and most effective. There is a free trial which allows any unwanted files to be removed immediately. Prevx 2.0 will also safeguard your PC from future problems. Taking backups before trying any of the removal methods is recommended.
I’m interested in hearing from anyone who believes that MBS was downloaded without their consent and can provide me with evidence (before looking at the removal methods in forums). Details of the Internet Explorer History View program to help do this are below.
3 July: There is a story here from PC Advisor
6 July: BBC Radio 4 You and Yours programme has covered the MBS story today here (listen again for the next week only)
11 July: BBC Radio 4 You and Yours programme has broadcast a follow-up piece on the MBS story today here (listen again for the next week only)
2 August: Please do not confuse Micro Bill Systems Ltd (MBS) of Leeds with MBS Systems of Louth in Lincolnshire. MBS Systems has nothing to do with porn billing – do not telephone them to complain.
8 August: Lisa Kelly of Web User magazine has written a two page story – “Is your PC being held to ransom?”. See issue 167 (2-15 August). Read part 1 and part 2 online.
11 August: There is an MBS victims forum here: http://mbsvictims.org.uk/ It’s been set up by Andy Merrett to discuss and share information about MBS.
24 January 2008: I have written a new feature on MBS in Guardian technology today – Porn bill firm opens new front. Please also see this post.
27 March 2008: Breaking news on MBS – see What MBS did after popups for porn: films.. with popup bills from technology Guardian and my latest post.
Nobody has provided proof that installation is without user consent
Two sites – sexxxpassport.com and mysexworld.com – use the software
191 people have complained to West Yorkshire Trading Standards (see link to my later story above)
How did the software get onto your PC? Try running the IE History View (IEHV) program (see instructions below)Removal solutions reported by users include fhiufhyrefyer’s method, Prevx 2.0, My Anti Spyware and Virus Vault Security Forum Warning: manual removal methods involving ’safe mode’, file deletion, system restore, and Windows system directories are potentially risky. If you delete the wrong files, your PC may stop working properly.
If you contact me about MBS, I can promise anonymity if you wish.
The Internet Explorer History View program (3 May 2007)
(please note: this method also applies to Platte Media – there is an improved set of instructions for Platte here)
How did the MBS software get onto my PC? You can answer this question using the Internet Explorer History View program (iehv.exe). Here’s how to run it:
–
a) If your problem started within the last 20 days or so, please download this tool (described) from here. You will need to move the downloaded zip file (42 Kb) into a folder (create a new one under ‘my documents’) and unzip (extract) it.
b) Then click on the iehv file (IE History View) to run the program – it just lists your browser history by giving the date and time for every site visited.
c) You will see a list of sites visited over the last 20 days (default browser setting – it may be less or somebody might have recently wiped the history – see below for advice).
d) You can sort the entries into modified date order (by earliest first) by clicking on the ‘modified date’ heading. Getting the sort order right is essential to track your browsing history accurately.
e) Select all the entries (use ‘edit’ top of screen, click, then ’select all’ or just use Ctrl and A). All the entries will then be ‘ticked’. Save them to a text file (file, save selected items) for closer examination.
Important note: The MBS bill appears on the fourth day after the billing software was first downloaded to your computer – look for sexxxpassport.com, mysexworld.com (note: the installation for mysexworld appears as ‘membersmatter.net’) or any other porn sites when reviewing the browser history with everyone who used the PC. When the bill pops up (or porn is viewed), the site also involved is microbillsys.com.
Anybody who seriously thinks (after a careful review of their history) that the billing software downloaded without consent must be prepared to submit their saved Internet Explorer history view file to me for technical examination. Despite many emotive claims to date, nobody has provided proof that installation is without user consent. Please ensure your history file is in modified date order – earliest first. You’re also advised not to make any changes to your PC until this examination is complete.
–
Insufficient browser history? You can use ’search’ to determine when the billing software was installed. Instructions for Windows XP: Start/search/all files and folders/insert MBS into ‘all or part of the filename’, click ’search’. This may take a while. Then hover the mouse (don’t click) on any filenames found that begin with ‘MBS’ i.e. mbsmon32.exe or mbsreg.exe. This will give you the date/time. Note: Some users are reporting that filenames have changed. An indication of what filenames are involved can be found from the removal script here. The times on the files you find with search will help determine who might have been using the computer.
Updates to this post
Update 8 March: An interesting letter in technology Guardian today from Peter Sandford about his 11-year-old daughter’s traumatic experience with the Micro Bill Systems billing software. More letters here.
Update 16 March: Have you found the Micro Bill Systems popup recently disrupting your PC even though you never visited sexxxpassport.com to sign-up? Do you know (or think you know) where you got the MBS software from? Or have you no idea?
If you’re convinced that you didn’t visit the sexxxpassport.com web site to download the software, then a browser history may help solve the mystery. Please e-mail me (see top left of sidebar) with an Internet Explorer browser history using this simple program (you can save the history to a file). The IE history is only useful if you’ve had the problem for less than three weeks (IE’s default history setting is 20 days). I can promise anonymity if you wish.
Update 26 March: In addition to the browser history, please e-mail me the Micro Bill Systems reference number from the popup bill.
Update 28 March: There’s another letter from a reader here (scroll down to end) here.
Update 29 March: A reader tells me today that he successfully removed the billing software using Prevx1 (note: now replaced by Prevx2) after weeks of disruption.
Update 2 April: The National Consumer Federation now has an opinion (PDF – see page 2)
Update 11 April: I was contacted today by somebody who told me her 15-year old son had signed up to sexxxpassport.com. She was told by Micro Bill Systems that “by falsely stating they were eighteen or over they have attempted to obtain services by deception. This is a criminal offence.” Micro Bill Systems offered to cancel the invoice provided she obtained a declaration from a solicitor (at her expense) that her under-age son had accessed the service. She then removed the software using the manual method described here (where she – writing as Nicola1 – also gives more information).
Update 18 April: It’s worth keeping an eye on the PC Advisor forums – this thread (and now this thread too – 23 April, and this thread - 1 May, and this thread (Andy Merrett’s blog) – 3 May, another thread – 8 May) to see how other people have coped. I’m interested in hearing from anyone who reckons (and can help prove with an Internet Explorer history file- see above) that the Micro Bill Systems software installed silently – no warnings, no permission given. You can contact me via tech@guardian.co.uk or my e-mail address top left in the sidebar. Alternatively, please leave a comment on this post (it will be moderated).
THE COMMENTS ON THIS POST ARE NOW CLOSED: Platte International Ltd (Platte Media) has taken over the operations of Micro Bill Systems. For the latest information including my story about Platte Media in the Guardian newspaper (Popup billing finds a new screen, 26 June 2008) or to leave a comment, please visit this post.
my household has no memory of signing up to anything. we have tried to pay the bill but was not allowed, and now we can not access the site to cancel even though the bill is going up every month. it has even affected my pc which now has a virus which affects the incoming of emails. if anyone can offer advice please please help!!!!!!!
[Peter, I have e-mailed you. Michael.]
Michael,
Re: MBS
There is some useful info on the PC Advisor web site. Although I have got the software off my computer I have now received a response to a mail I sent them saying I would not be paying.. I must have sent this before I had removed it.
The mail from them is below. I do not think I would be stupid enough to sign up to this in the first place and this must have been disguised for me to miss it. (it is possible that I visited the site but have not knowingly used it)it looks like I was logged on for a minute or two !! but I don’t recall.
Do you think they have a legal case against me if I just ignor them and do not pay ? all they have is my e-mail address ?
Mail from MBS:
Regards
Justin
[the e-mail from Micro Bill Systems has been edited off this comment - it stated how Justin became a 'member' of the site through viewing, clicking, and installing software. It demanded a payment of £19.99 and listed the dates/times when the sexxxpassport site was accessed.]
i am writing this as anon to save some possible issues from a client, but i have hada client ask me to take a look at his pc where it was saying he had visited the above mentioned site, i KNOW 100% he didnt visit the said site and so after a few minutes googling have found a resoloution to this issue, it seems that a lot of people are being affected by this, they acknowledge on there site that some A/V software companies are brnading there malware AS malware and are complaining about this, i hope they dnt get away with this. it also seems that the exacutable files which run the ACTUALL software are being reproduced with viruses in there. It is also very tru that a sys restore IS disabled after this malware is installed
i am about to totally re-format the said clients pc to wipe this rubbish off his pc
what i want to know is how the hell are they getting away with this.
you wouldnt hold a gun at a shop keeper who had maybe short changed u, which is what they are more or less doing.
Also i have been reading a lot about this and it has been said a few times that it is possible this “software” will render your computer useless and even buying a new HDD wont fix it. well i can definatly say thatthis isnt true, the only way that, that would be possible is by it deleting the bios, those tatctics havnt been used in viruses for YEARS and are obsolete as most bios’s are protected againts this type of attack
been having problems with mbs pop-ups on the wifes laptop noticed straight away what had happened my 11 year old had been typing rude words into address bar but to my annoyance i couldnt cancel has i had no log in details no chance 11 year old with dyslexia who cant read long words if i’d got hair ***** e-mailed mbs with no reply from my desktop and the cheeky bleeders sent me an e-mail to sign up to sexxxpassport.com with the click anywhere on the message to gain instant access what a cheek i am furious to say the least how easy are they making it surely this cannot be allowed to continue.
I’ve been in touch with Michael Pollitt with the IE history from a laptop in our household which had the MBS problem. Sadly, in our case the user concerned appears to have glibly, and without understanding the consequences, clicked onto links which apparently led to a sign up – a salutory lesson to all users of the internet perhaps since it wasn’t what had been intended.
But, to reassure others, we’ve been able to remove their silently installed software using the restore function, without the need for us to install other software. If Michael is happy for me to publish this here, I can do so. The key point, if you use this route, is to ensure (once you’ve done your system restore) you remove other restore points. It has worked for us.
I’m a 15 year old girl and am being hassled by these MBS popups! please can ’sussex’ publish how they got rid of these popups? apparantly i signed up for 2 porn sites, but i believe that this is due to my younger brother trying to access some porn, and without meaning to he installed something, although i have no idea what this is. please help!
Updating my earlier post on the (to date) successful method for removing MBS:
There appears to be a solution using system restore. I’ll post what I remember was done to resolve this on our pc. If anyone sees any flaws in this, please don’t hesitate to correct.
The switching off and switching on the System Restore points is pretty crucial, I understand.
Start > Accessories > System Tools > System Restore
Select a Restore Point well before the activity
Restore System
Then go into the Control Panel > System > System Restore
Check the box which turns off System Restore > OK to apply
Then do the reverse (i.e. Control Panel >System >System Restore > UNcheck the box > OK to apply ) This last action turns System Restore back on.
Fingers crossed, no more pop ups in the last few days, and a check of the system 32 folder (where the stuff was located) shows it to be clear
Please note that the turning system restore on and off needs to be done through the Control Panel.
[I suggest that you backup your PC (just the stuff you don't want to lose) before trying this or any other removal methods. Backups should be a regular habit anyway! - Michael]
Thank you so much for your information here. My 10 year old daughter had this MBS bill appear tonight after not using her computer for a while. She was really devastated and wouldn’t stop crying. They were trying to claim 39.99 from her and as she knows money is tight was especially upset. As the computer is relatively new I have used the system restore method and it seems clear for now. Thank you so much.
Pip: I’m glad it’s worked for you and your daughter. It is now over four weeks since we restored our system and, to date, the pop ups haven’t returned. I also checked the system and it remains clear of all the software MBS downloaded onto the computer.
Hi I have an additional problem now, i tried using the removal method that I told you about but my computer doesn’t appear to have safe mode if that’s possible. I pressed f8 when it started up a few times but nothing happened. Is there any other way that I can delete these files?
Thank you
Thank you sussex for your advice, I have followed the steps you suggested and cannot find any files in the system32 folder anymore and have done a search on my computer and cannot find any files anywhere else either. Do you know if there is a chance I may still have to pay the £39.99 and will they have a legal case against me? I do believe my computer to have been used for these purposes although bit by myself. Thank you so much for your help. It has been a huge weight of my shoulders,
Katrina
Hey can someone talk through the system restore method 4 me as i dnt understand how to use it. Thanx alot!!!
Scott (12): Probably easiest to get somebody to help you if you’re not sure how to do the system restore method – they won’t see what you’ve been accessing (so you don’t need to feel ashamed). Just be sure to pick a restore point about a week before you think you visited the website where the problem came from, or, if not sure of this, choose a restore point about 10 days from when the pop ups first appeared.
It may be of interest that I’ve looked in the web history of an affected computer and found dozens of visited porn sites last week. In fact I know this to be untrue – I used the computer last and viewed the history to select a site – and none of these porn sites were there then, and they are now. I am certain these sites are added into the history by this malicious software to make you think they have been visited and to shame families into paying to ‘keep it quiet’. And how are these hateful people supposed to track you down and obtain their money?
StevieG: Have you followed Michael’s advice and sent in your IE history?
[no, he hasn't yet - Michael]
1 google Microbilling systems and scam and see how many complaints there are (86 hits) you only have to see the volume —-there are more complaints than for IBM!!!
2 there are countless examples of other victims claiming the same thing and it is a case of our word versus theirs….are we all lying or were we trapped?
3 why are there ads to help you deal with these scum if there is nothing wrong with them?
4 why does a reputable company have only a po box number?
5 why are the responses so low from this company when they get complaints?
6 why is the customer complaint line a premium rate number and leave people on hold for ages (read the complaints files)?
7 why is no one from this company prepared to give their name? (though the directors can be traced via companies house) are they ashamed???
8 the IE history shows where the sites were accessed, it doesn’t show the consent ageement, (if I got Beckham to autograph a blank paper and then told him he has made loads of promises it would be illegal)
9 in my case the IE history The record downloaded shows that I was on the site onthe 9th June but I never accepted the contract it also shows that I have never accessed the site I have supposedly agreed to access until this morning (four days later) to cancel the subscription—–if I had knowingly paid to access Porn why the hell would I would I wait 4 DAYS to access what I had paid for??? it is simply ridiculous
10 In my opinion they have perfected a screen which freezes the PC and can only be fixed by clicking( and therefore by deemed to have accepted)
I have no proof for this but will have my IT friends see if this is possible (it certainly used to be the case)
Ashley Bateup (MD) this is a scam, you know it and we know it
Dear Sussex!!!
Could you please help me out, my computer was used by my friends since i was out for holiday and seems that the have signed up for that stupid porn site. MBS keeps popping up. do you know how can i get rid of it on windows vista??
Thank you so much for your help in advance
Cheers
Bacho: Look on this thread, and on PC Advisor forums. It seems there are a number of ways of getting this off your pc.
i want to know, windows have a facilities to show all the activites of usser, after the use, and if usser clear all histry, tmp
if any please maill
Woofle
……..”if I had knowingly paid to access Porn why the hell would I would I wait 4 DAYS to access what I had paid for??? it is simply ridiculous”
Precisely.
I have approached the Office of Fair Trading to try to glean further ways to complain about MBS, having already complained to Consumer Direct and elsewhere. They have replied and I give the bare details below, with their reference, which others may want to quot if they think it worth trying to flag this up as something hitting a number of consumers.
Their ref: EPIC/E/E/6490
“The Office of Fair Trading’s remit is to protect the “collective” interests of consumers in the UK by acting to ensure that the practices of traders comply with a range of consumer protection laws. We have no powers to assist individual consumers in their private disputes with traders or to offer legal advice. Nor are we able to offer opinions on the legitimacy or otherwise of a trader.
“For advice relating to your individual case, you may wish to consider contacting Consumer Direct. Consumer Direct is a telephone and online consumer advice service, funded by central Government and managed by the OFT. Consumer Direct provide clear, practical, impartial advice relating to problems and disagreements you may be having with suppliers of goods or services.
“Consumer Direct offer free help and advice to consumers living in Great Britain. The contact number for Consumer Direct is 08454 04 05 06, or you can visit their website on
http:www.consumerdirect.gov.uk
“The OFT website contains detailed useful information for consumers about scams go to http://www.oft.gov.uk/oft_at_work/consumer_initiatives/scams/htm for further details”.
They go on to say that their complaint has been registered on their database and that the information in it will be assessed for evidence of possible breaches by the trader concerned of consumer protection legislation.
The Office of Fair Trading
Fleetbank House, 2-6 Salisbury Square, London EC4Y 8JX
Switchboard (020) 7211 8000
Web Site: http://www.oft.gov.uk
I addressed my complaints to the ’scams’ email address posted on the OFT website.
i done a system restore and ive been free from so thanks sussex butwhat i want to know is can they realy hijack your pc with no details of?? thx again sussex
Liam: It would seem so. There are others who know more about the technical side – I don’t.
Nobody is ever asked for their personal details – MBS would say that this is the ‘advantage’ of their system, particularly given the types of site who form their clientbase. It’s a matter of opinion, though.
I recently removed this from a pc someone had been using at work. You can do it by restarting the pc in safe mode (F8 at startup) then running programs such as spybot search and destroy and removing what it finds. Then look in the folder mycomp/windows/system32 and remove the ‘mysexworld’ files and any subsequent files created at the exact same time as that. All this must be done in safe mode though otherwise it won’t be deleted. Restart again, then you can check whether it’s going to start popping up again by pressing ctrl alt del and checking the processes tab, look for smvalid or something, that’s what produces the pop up.
mysexworld has my computer not only would i like it removed what can i do about the mbs bill or do i just ignore it
Peter: If you didn’t request it, you shouldn’t pay it, should you? And there are many who haven’t requested, haven’t paid, and are still here to tell the tale.
I’d focus on sorting out your computer. There are two methods suggested on this blog which have both worked for people. Your choice!
But – have you also looked at the other points raised on this Blog? People are trying to find out what is going on, and your help could make a difference. Think big – Think consumer-power!
Sorry if this appears twice – I’m not sure if it posted the first time.
Peter: look higher up this page for two methods which have worked for removal of the MBS blight. You alone know if you should or shouldn’t pay the bill – there are plenty of people for whom it has snuck on unawares. But, first of all, perhaps you could help Michael and other consumers by contacting him asap?
thank you for your reply as sugested by a gentleman in another message he used prevx 2.0 i downloaded the free version from one of the hyper links in one of the other mesages it has worked i no longer get the mbs bill on my computer thank you for your help
Peter: I am glad for you – but hope you are also able to help future ‘victims’ by contacting Michael Pollitt in the way he has suggested above.
I too briefly clicked on MySexWorld and was immediately hit by Viruses. I used Norton Antivirus and it took out two viruses. 4 Days later my bill for £39.95 appearred as a pop-up. I seem to have removed it by use of NoAdware Software that scanned my PC (for free). You can then pick off the Micro Billing Systems Files (.exe type) and delete them. This seems to have stopped the pop-ups and my PC has returned to normal. My concern is about paying for a website I visited but did not logon to. I gave no personal info so was wondering about traceability?
Michael and Fellow Sufferers,
My brother is also suffering from the MBS problem which seems to be blighting so many people at present. I have *thoroughly* interrogated him about any websites etc that he has accessed and he has denied all acceptance of anything related to MBS or porn websites. It is an odd thing that although he has been attacked by this (I have tried multiple anti-virus scans to get rid of it to no avail, and am about to try system restore as suggested above) I have not. I was wondering if anyone knows if there is anyway for MBS to trace him – they do not have an email address or anything else.
Good luck to everyone else with this problem. I really hope these disreputable people get their deserved come-uppances.
hi can anyone tell me if i manage to delete this mbs rubbish which i doubt as iam useless with computers will i still have to pay the bill £39.99 and can they take me to court i know my husband as visted sites like this but i know he would not knowingly sign to pay for anything i have contacted them they said we have accepted t&c and have to pay so i contacted them again but they have not got back please help
hi again just to let you know i tried restore and it did not work so i downloaded prevx 2.0 free trail and that seems to have worked i have had no bill popping up just like to say thank you to ev1 for the advice given in other messages people like that should not be allowed to get away with it…
i like to cancel the all wedsite porn and the mbs bill thank you
There must be some legal floors in this software.
As the company are disabling a computer to which the person asking for the software/services, may not be the custodian of the computer, nor have any right to accept services which will affect the computer.
Also apart from the fact that a computer has asked for services, how do they pin point who is asking for the services.. If a person cannot be identified, then how can they disable a computer, which could belong to anybody or nobody..
I would like to see the company MBS take a PC to court over the money..
This type of thing is not uncommon, and spyware / malware gets on computers and actually mimics human behavior without the user even knowing it’s there.
Try Spybot, AdAware AND then a startup manager called Winpatrol to get safe again…
[A link to sunjuiced dot com has been edited off this comment. Since when did solar lights have anything to do with the post's subject?! - Michael]
People should take more care of who uses and what users do on their home or buisness computers.
This stuff is bound to happen if people have full access to a system, though I did wonder does vista provent this from being installed with there new protection software?
Hi I am at the end of my thread…. I started receiving pop up bills from mbs about a week ago after emailing them 8 times I had no choice but to pay the bill as my daughter uses the laptop for school home work and it’s my business, after paying them yesterday within 5 minutes they sent another bill which has now blocked my internet for over 24 hrs. I have since made over 13 phones call to rude people who say they can’t help it’s going to head office but won’t give me the number. I have lost just over £250.00 worth of work for over 24hrs and they keepingt elling me to log on to there website to uninstall the program but i can’t get on the internet to do that on that PC. If anyone can help with a program i can stick on a key fob I wooudl appricaite it as they have no intension of helping me
many thanks chey sorry it’s so messy I’m just angry
Hi i have just found a bill for this site on my 15 yr old Daughters laptop. I phoned the number given on the bill 0800 092 5551; explained that this bill had shown up on her laptop. They asked for my email address to send a form which i have to sign; send back with a copy of her passport/ birth certificate. They asked for £29.95 but would waver the charge if i send the info on my daughter. On the day they said the item had been downloaded, we were all on our way to Scotland, No one was at home which is where the laptop was left . I have emailed back, support@microbillsys.com stating this information & letting them know that due to only having a PO box i would look into them further by asking before i sent my daughters personel details to them. They also state because the Lap Top is in my house I am responsible for the bill. They insist that Registration took place on the 20/1/08 at 19:26:01 when we were all in Turriff in Scotland 400 miles away from the laptop, on the 24/1/08 16:45:26 site access request — accepted then again at 16:45:48 just seconds later.We did not arrive back home untill the 1st feb.I am rather worried how easy they have got onto my daughters pc.
My son thinks he has fully removed this site from my daughters lap top & it is working better. Time will tell. I have not yet heard from MBS in reply to my email. The Phone number I have is 0800 092 5551 OR 0871 231 7373 they only give address with PO Box 185, Leeds LS12 9AJ.
[I have edited off the link to showpinkzone - Michael]
THE COMMENTS ON THIS POST ARE NOW CLOSED: Platte International Ltd (Platte Media) has taken over the operations of Micro Bill Systems. See note above.