Michael Pollitt | freelance technology journalist

hello i recently had a bill pop up from mysexworld .com i only had it for a few days but it was getting very annoying anyhow on the fourth day i tried a system restore which has done the job i have not had a pop up for a few days now the system restore does not lose any information that you have in youre files it just seems to get rid of any unwanted files or viruses i hope this will be useful to anyone who reads youre articles. thanks

Hi, I’ve just been reading forum posts regarding MBS and noticed several posts from you. I have just had a huge row with my 14 year old son because he showed me these pop-ups on his laptop demanding £39.99 for a subscription to a site that he insists he has never heard of. I phoned the number on the pop up and was told that he must have accessed the site. I complained that adult sites should not be so easily accessable to minors and was told that Mysexworld is only accessable by typing in the actual website address or through links from other adult sites. They said I could not cancel the subscription unless i paid and that it will continue accumulating at £39.99 per month until September 2008 if I don’t pay it. I believe my son when he says he didn’t access it but I can’t be 100% sure that one of his freinds didn’t. They are threatening legal action if I don’t pay – I am really angry and would love to help put a stop to this extortion. I’m not worried about the computer, I’ll throw it away if I have to but these people shouldn’t be allowed to get away with this!

[Using the Internet Explorer History View program will help find out what's happened - Michael]

Sara – This story is being followed by You and Yours (Radio 4’s own Watchdog programme) and have invited people to contact them. You should find their details on the Radio 4 website.

Sara and others:

You and Yours are following up on Friday’s story tomorrow (Tuesday 11th July) between noon and 1 p.m.

As before, you’ll be able to Listen Again on the Radio 4 website later in the afternoon and for 7 days thereafter.

Sorry for the typo in my last comment: the follow up is on WEDNESDAY 11th July.

Yep I have it aswell. It first apearred on Saturday, and again tonight. I really couldn’t say how it has got on my computer. Has anybody actually paid? What happens if you dont? And what is the most effective way of knowing it is gone? I have the trial of prevx but it hasn’t found this particular virus as yet.

<p>Right, after reading loads about this tonight, I finally did a system restore. I tried this alot earlier but nothing happened. I then went back to reading, did more prevx scans, deleted the files that somebody said were MBS from my system 32 and felt quite confident I had sorted it. I then went back to system restore and tried a point 9 days before my first bill appeared. It suddenly decided to work and when my pc restarted it did so quicker than it has even since before that restore point. I took the advice I had read to turn off the system restore, which deletes all previous restore points, and then turned it back on again. I really think I have got this off the computer now! I looked back in system 32 and the previous files aren’t there. I’d like to say a big thankyou (fingers crossed it’s worked!) to everybody who has posted info about this as I was worried. I’d never have paid them, I would have been happier to let my pc die and buy a new cheap one than give my cash to those ******* [edited - Michael], but if there is anything I can do to help as in write emails to people to widen the knowledge of this then please say who would be best to write to. Also I’m assuming that once it’s gone it’s gone, but if they have my IP address couldn’t they just send it again? Is it wise to change Internet providers?</p>

OK sorry for one slight masked swear word whilst writing the 4 paragraphs offering help! [edited! - Michael] I wont go into the detail I did before because it could be deleted again, but I (hopefully) have solved the problem by doing a system restore 9 days before the first bill appeared. From the advice I saw, after the restore you should turn off system restore, so it deletes all other restore points, and then turn it back on again. The files that I had found in system 32 that are supposed to be from mbs are not there anymore, and my pc is fine with no bills, as of yet anyway!

Ben: Contact Trading Standards in Leeds and in your own area and complain – the more complaints, the more seriously they must take the problem (and they are aware). Write to you MP – s/he will also have to follow it up if you ask them to. Again, the more people do this, the better. If you’re sure you didn’t knowingly enter into this, contact the police (some people have done this – again, the more complaints, the more seriously it has to be taken). Radio 4’s You and Yours may also still be following this story – you can contact them through their website.

And finally, did you submit your IE History to Michael Pollitt? Email him direct to ask if he wants it.

Your original posting has anyway reappared. Anybody who’s been hit by MBS’s pop ups will understand why you were so upset.

I don’t think you should worry, Ben. I have a very strong feeling that MBS would not want to go too near a court of law, in any case, as it would shine too much of a spotlight on their modus operandi. System restore has been totally effective for us, and this over three months on.

Good luck!

OK that’s great thanks. I will write to trading standards, but have just been so far tentatively waiting for a new bill, and reading the other thread about this. I do think it’s sorted though. I may have already said, but I did the system restore, and deleted the other restore points. I also now have prevx and am doing a full scan daily and it’s not finding anything. In the system 32 folder those key files aren’t there, and in my add ons there is nothing suspicious either. The first bill was Saturday, the second on Monday and so I would have expected another today, especially as the bills are supposed to appear at least more frequently. I’m confident I’ve sorted it! Thanks to all who have commented on it, as I mean it shows what a problem it is for so many to get infected. It makes you think it’s only a matter of time before everybody get’s it on their system! I only wondered if they could send a virus to your IP address if they have it logged but am no expert. I considered changing providers as I am no longer bound in a contract, but I take it once the virus is out of the system the threat of a computer shutdown is gone.

Ben, that’s great news. I don’t think you need worry about the IP address – it appears that what they do is done through the software, and once it’s off, you’re home and dry. That’s what we’ve found, anyway.

I’m glad you’re contacting Trading Standards, and if you can copy into the other places I’ve mentioned, especially your MP, that would be good too.

I’m awaiting a response from our MP. MPs should follow these matters up on behalf of their constituents, and if the OFT, etc., hear from more than one MP, it should flag up warning signs to them.

I came back home after 4 days away visiting family and found an icon on my pc which id never seen before. I did a scan of this icon before opening it and was told it was ok. I opened the icon to see what it was and I saw a bill for £39.99 for a sex site I knew nothing about. I phoned the number on the bill and asked what this was all about. I was told someone had accessed a sex site called MySexWorld.com and agreed to the terms and conditions of the site access. I had no idea what they were talking about and told them I was refusing to pay a dime and would contact the police and Trading Standards. I was told that they work closely with Trading Standards and that the bill was legitimate and had to be paid or my pc would be ‘locked down’ and i would’nt be able to access the Internet.MBS ahve held my pc to ransom and done exactly as they said, HOW i don’t know but my pc was ‘frozen’ and I had to pay £39.99 to ‘unlock’ it. I asked my nephew about this as he was staying at our home while we were away and he , after much cajoling and raised voices, agreed he had been on my pc and was curious about a certain site that accessed illegal games from a torrent site for free and had clicked on a pop up and then clicked it off when he became aware it was an adult sex site. He swears he never accessed the site at all and I believe him. Now, I ahve this scum extorting money from me. I have had some help from others regarding this curse, and I think I have deleted all files from my pc, the only thing is, my pc froze on IE and I couldnt log off without doing ‘ctrl, alt, delete.I may have some software still there that ive missed. Ill give you a summary of files I was told to delete and maybe you could tell me if there are more.
imvalid.ico.baco
imvalid.ico
axaccessctrl.ocx
MySexWorld.ico.
The first 3 I found the last one no.I saw an active X file that looked suspicious but im not sure what to do with it….MSWINSCK.OCX
Are there any other fikles in C:\WINDOWS\system32 that I may have missed or anywhere else on my pc please?
I found files relating to MicroBillsys and SptBot Search and Destroy deleted them. I also used Brute Force Uninstall in safe mode and it deleted files too.I nkow that spyware and antivirus software leave certain files on pc’s especially when they look like they belong there, so is there any files that I need to look for that I’ll have to delete manually please. Send me a list of what to look for and Ill report back if I find and delete them. Thanks in anticipation. Lee saxon

Lee:

Did you follow through your intention of contacting Trading Standards, etc.? This is important, especially since your nephew, from what you say, did not go through the process of ‘agreeing’ to the Terms and Conditions for the software to be downloaded.

Also, have you followed the advice offered by Michael above? Your Internet Explorer History could be worth a look to see what actually happened to you.

And finally: This is an issue affecting a lot of other internet users. There is a forum entirely dedicated to this at http://www.mbsvictims.org.uk. Do take a look at it. While you are presently concerned, and understandably, with your own predicament, it is important to all internet users for these kinds of practices to be tackled at root. However MBS may be trying to justify their practices, they are causing a great deal of stress and upset in the virtual community.

I was hit too,paid up in a panic and then found the victim site.
I then purchased previx2 [Prevx 2.0] and deleted the trojan .After this I emailed mbs to demand that they take action and remove my name from their list.
Anyway my email did not reach their address for whatever reason,so I logged on to “mysexworld”to “resign”
I COULD NOT ACCESS THIS SITE.So how could I have done this previously?

Please please Could someone please tell me how to get rid of the pop up bill, in very simple language. I, nor any of my family have downloaded, requested or watched any thing with this content !!!!.

Its now becoming worrying and annoying.

Thanks

The pop-up is caused by two .exe files. MBS may change their names from time to time. However the two I know are monrtu.exe and monstu.exe. You can check for these in the task manager processes tab. If you try to ‘end process’ here they will restart immediately – each one restarts the other. If you run msconfig and then look on the startup tab you will see all programs that start automatically when you turn on the PC. One of thse will be the .exe. If you try to remove it it will be replaced immediately. Therefore you need to select the boot.ini tab in msconfig and check the box marked /safeboot. Then restart the PC – you will be prompted to do this when exiting msconfig. When your computer has restarted in safe mode open up msconfig and delete the entry in the startup tab that contains the .exe. Then go to windows/system32 and delete the exes from there. Go back to msconfig boot.ini tab and uncheck the /safeboot checkbox and then restart your PC. This will have stopped your pop-ups. To remove all traces you can get a virus/spyware app to find them for you – however this is not necessary.

I cannot locate the desk top icon to fire up “mysex world” and being as I have paid the £39:99 I would like to be able to down load to this site. could you please tell me how to retrieve this site.I bet this different to most of the questions you are asked. thankyou

I removed it manually by… [I have deleted the rest of Khalid's comment. Sorry, I'm unable to publish any removal instructions on this blog for legal reasons - Michael]

I have recieved a pop up for platte media as have many others by information viewed on your site and others. Ihave not entered into any agreement with tese people or give them any 4 diget code or anything else. however after trying to remove it for a week or so i decided to ring them they insisted that i must have sigend and agreed terms, not so. i told them that i have no injtention of paying any money over for something i have not requested.
i am the sole user and therefore no other person could of done it.
They told me they would need my name and address so they could send me a uninstall code , I told them that i did not wan’t to give these details , but they said that was the only way other than pay the bill, after protest and frustration of these peoples attitude , i gave them my name and address under protest.
i have however recieved a key number and code number to uninstall software on my computer.
Which I can not find any software on my computer other than the bill that keeps presenting itself.they suggest that i go to their site platte .com
go to utility and down load
run file enter code follow instructions.
Is this a wise thing to do or will I be downloading something that i did not want in the first place or will it be the start of a never ending circle committing my self.
Yours truly.
Kevin.

platte seem to be running very near the edge of legal trading, i had no idea i had enterred into any sort of agreement with this company, yet like everyone else i get a pop up that tells me to pay up OR risk all sorts of nasty things happening to me.
Well platte take your best shot my letters are already winging their way to the OFT, and i will most certainly take you through the courts should the need arise.
This company is operating a con sign up for your free films,and thats what i thought it was FREE and i have been conned by them, i look forward to when they are forced by law and public opinion to cease trading and stop their dispicable activities.