Tech Advice Needed - Malware Problem

[Saintly]

Ben, make sure you download and run Anti-Malware from Malwarebytes. Here's a direct link to the program -> http://majorgeeks.com/downloadget.ph...d909666f809b26

You do not need to purchase this program to remove the virus. And the only diff between this and the full version is scheduling scans.

[5FDP]

Thanks mate. I'm guessing that it's best to download it to an external HD or USB device instead of the PC that may be infected?

Also, (noob question here) should I run it in 'safe mode'? I didn't do the system restore in safe mode and it seemed to work.

EDIT: I've also read that some variations of this virus won't allow you to run a system restore. I'm assuming that since I was able to, it should be fixed

[MV75]

Everyone get this:

http://www.microsoft.com/security_essentials/

DO IT DO IT DO IT.

I've had it with 3rd party anti virus. The only version of this one is free, there is no $ motive.

As for the ops problem, what was it exactly? Wasn't that vista defender virus was it? My nieghbour had that nightmare a while ago.

Thanks mate. I'm guessing that it's best to download it to an external HD or USB device instead of the PC that may be infected?

Also, (noob question here) should I run it in 'safe mode'? I didn't do the system restore in safe mode and it seemed to work.

EDIT: I've also read that some variations of this virus won't allow you to run a system restore. I'm assuming that since I was able to, it should be fixed

Gotta get to know what exactly has hijacked your system first. You'll find they wipe out being able to system restore and to go to anti virus websites, so it's hard to fix the problem after the fact.

[5FDP]

Everyone get this:

http://www.microsoft.com/security_essentials/

Can I run this in conjuction with my other anti-virus s/w?

As for the ops problem, what was it exactly? Wasn't that vista defender virus was it? My nieghbour had that nightmare a while ago.

It's looks something like this (amongst a million and one other pop-ups)...



When you click on the 'remove' button, it asks for your details to upgrade to the newest version.

This is what I think I have (or a variation of) >
http://www.microsoft.com/security/po...ernetAntivirus

[MV75]

Can I run this in conjuction with my other anti-virus s/w?

No, uninstall your other stuff. Dunno. The MSE does anti vir, firewall, malware, etc. It does it all.

Besides, why would you want to?

It's looks something like this (amongst a million and one other pop-ups)...

[IMG]http://img.photobucket.com/albums/v374/vishaal_here/Antivirus_1.jpg

When you click on the 'remove' button, it asks for your details to upgrade to the newest version.

This is what I think I have (or a variation of) >
http://www.microsoft.com/security/po...ernetAntivirus

Yea, looks like a hijack. You don't get that shit accidently.

http://www.bleepingcomputer.com/viru...irus-1-removal

Personally, I'd just nuke the site from orbit, (reinstall windows), to be sure. But I assume you have a crapton of photos and other crap you've never backed up, so you can't.

[Saintly]

http://www.bleepingcomputer.com/viru...irus-1-removal

Follow the link provided by MV75, which eventuates to Malwarebytes Anti-Malware anyway~

You can download that from the link I gave in the first post from the infected computer and it doesn't need to be in safe mode to run. Just make sure you follow the instruction to restart after running a FULL SCAN

[5FDP]

Cheers guys! You're both awesome

One last question - so considering all of the above suggestions you've given me, I take it that the system restore that I ran didn't do jack?

[DarkHyren]

Can I run this in conjuction with my other anti-virus s/w?

You can, but I wouldn't recommend it.
You should only run one anti-virus on your system as they dont play nice with each other.

Also, (noob question here) should I run it in 'safe mode'?

If your system has been breached then running scans, system restores and such from safe mode is often your best bet as safe mode limits file and registry access (less chance of the virus spreading).

I guess I just want to make sure they are removed altogether avoiding having to do a complete re-install.

I would say get SpyBotSD and run it a few times to check the registry for nastys.
That program coupled with your anti-virus and windows user account control (which is on by default) should protect you.

[Saintly]

Nope, it's not popping up anymore. From what I have read elsewhere, a system restore doesn't necessarily remove the infected files but rather they are just 'dormant' and can still cause issues at a later stage.

I guess I just want to make sure they are removed altogether avoiding having to do a complete re-install.

After running malwarebytes, run a FULL AV scan (I'm certain at this point there isn't any other bug)

I would say get SpyBotSD and run it a few times to check the registry for nastys.

However if you wanted to be sure there's nothing else, you can run spybotSD. I wouldn't rely on it too heavily as the scan engine is quite similar. Also you may find that spybotSD is now rather resource intensive (not like the version they had a couple of years ago)

After which if you think your restore points are infected and don't need it anymore, you can delete it by running a disk cleanup (start, accessories, system tools), 2nd tab provides you an option to delete all restore points except the last

[DarkHyren]

After which if you think your restore points are infected and don't need it anymore, you can delete it by running a disk cleanup (start, accessories, system tools), 2nd tab provides you an option to delete all restore points except the last

Personally I find that if you don't need any of the restore points and you think they might be infected your best bet is to turn them off as it wipes them completely.
If you do actually have something hiding in the restore points, deleting all but the last one might not do anything as it could just be hiding in the last one.
Then you can run your scans in safe mode and afterwards if all is clean you can always turn system restore back on.