VIRUS nightmare!

[genuinegraphics]

Hey all,

Got a major problem with a friends laptop. He somehow managed to get a virus/malware into his laptop and it has downloaded a fake anti virus program called 'AntiVirus Scan'. I am trying to delete it but no luck. I've tried getting through to it through the registry and that still doesn't work and even taskmgr but still no luck.

It keeps popping up annoying websites and pop ups and doesn't let me run any application at all and keeps telling me that the system is infected please run a scan.

I've tried downloading Malwarebyts and it installed but when I run it, it just doesn't let me.

Any ideas?

Thanks in advance for all that can help

 

[stugster]

http://tinyurl.com/5r7ekrs

First result, scroll down the page you've gone into to "How to remove Antivirus Scan manually:"

Follow instructions.

 

[LicensedToTrade]

Sounds like a rootkit, I can't think of a reason why you couldn't remove it through regedit.

Bloody rookits are everywhere at the moment.

 

[genuinegraphics]

LOL! like the beggining bit of that but I tried that and just doesn't work. I cannot actually get into the registry folder everytime I open it it'll close and i'll get a message saying

'Application cannot be executed. The file regedit.exe is infected. Do you want to activate your antivirus software now?'

but if I click yes it'll take me to a phoney site etc I can browse through the documents but cannot open them as everytime I open a application (even task manager) i'll get the above message saying that application name and everything else written.

 

[LicensedToTrade]

LOL! like the beggining bit of that but I tried that and just doesn't work. I cannot actually get into the registry folder everytime I open it it'll close and i'll get a message saying

'Application cannot be executed. The file regedit.exe is infected. Do you want to activate your antivirus software now?'

but if I click yes it'll take me to a phoney site etc I can browse through the documents but cannot open them as everytime I open a application (even task manager) i'll get the above message saying that application name and everything else written.

You can access the registry in safe mode. So reboot and mash your F8 OR F10 key until you get the option to run in safe mode.

 

[DesignerNick]

LOL! like the beggining bit of that but I tried that and just doesn't work. I cannot actually get into the registry folder everytime I open it it'll close and i'll get a message saying

'Application cannot be executed. The file regedit.exe is infected. Do you want to activate your antivirus software now?'

but if I click yes it'll take me to a phoney site etc I can browse through the documents but cannot open them as everytime I open a application (even task manager) i'll get the above message saying that application name and everything else written.

Does it let you do it when you are in Safe Mode?

 

[genuinegraphics]

Sounds like a rootkit, I can't think of a reason why you couldn't remove it through regedit.

Bloody rookits are everywhere at the moment.

Neither could I. I can remove it from regedit it just wouldn't let me get into the registry itself lol Once I found that the program has been installed it'll keep showing pop ups and just wouldn't allow me to open anything so he's brought it abit late because the virus has gone in quite badly but just checking if anyone knows a solution where a malware wouldn't let you open any program before I reboot it.

 

[genuinegraphics]

You can access the registry in safe mode. So reboot and mash your F8 OR F10 key until you get the option to run in safe mode.

Thanks i'll try that now. Just running it in safe mode to see what happens if not i'll try that. Thanks.

 

[genuinegraphics]

I've managed to get into the registry now just a matter of locating the software but it's running in safe mode so once I get that done i'll let you all know how I get on

Thanks

 

[stugster]

I assumed you were in Safe Mode already; sorry.

Try gettin MalwareBytes going in SafeMode

 

[genuinegraphics]

Try gettin MalwareBytes going in SafeMode

Yeah i'm running a scan now (60 files infected ) just trying to see if I can find it in registry no luck at the moment not sure if it'll show up but once I do the scan i'll restart again and see what happens.

 

[LicensedToTrade]

Yeah i'm running a scan now (60 files infected ) just trying to see if I can find it in registry no luck at the moment not sure if it'll show up but once I do the scan i'll restart again and see what happens.

It will most likely have a name made up of several random letters and numbers, they usually stick out a mile cZ7hd748w kind of thing, it should be visible in the task manager processes tab.

 

[genuinegraphics]

It will most likely have a name made up of several random letters and numbers, they usually stick out a mile cZ7hd748w kind of thing, it should be visible in the task manager processes tab.

Nothing like that is showing up at the moment but i'm giving it a scan through MalwareBytes and it's picked up 63 now so hopefully see what happens when i get rid of those and see if it'l get rid of it

Thanks all that have helped i'll let you know what goes on

 

[DesignerNick]

You will probably still have to remove the rogue AV manually though. Whenever I have done it they are always a manual process.

 

[JoyDivision]

Try running Rkill before using Malware bytes. Have you tried running TDSSKilller?

What happens when you run autoruns does it show up anything unusual?

You have to see Malwarebytes just as a tool for malware removal but most the time it misses too much.

 

[JoyDivision]

Nothing like that is showing up at the moment but i'm giving it a scan through MalwareBytes and it's picked up 63 now so hopefully see what happens when i get rid of those and see if it'l get rid of it

Thanks all that have helped i'll let you know what goes on

Always use Process Explorer or Autoruns, Task Manager is not reliable as it is the first thing which rootkits target. Even process explorer is not that great.

I am finding that Autoruns is the tool I use most to aid manual removal these days. Hijack this is also good.

 

[genuinegraphics]

DONE IT!! thanks guys I did the scan in safe mode and still it didn't work then I remembered system restore so done it till Christmas and it's fine now just putting in virus softwares in but other then that it's back to normal and working fine.

Thanks guys for all your help

 

[DesignerNick]

Just make sure you do all the scans etc afterwards in case there were any nasties there at Christmas.

 

[genuinegraphics]

Just make sure you do all the scans etc afterwards in case there were any nasties there at Christmas.

Yeah just going to that after I install it all. The user doesnt really know much about computing so going to have to teach that too

Thanks

 

[Podge]

If you have problems again - geeks to go - is an excelent forum, they have dedicated users who will help out with any pc problems. I picked up a virus last year - them porn sites are terrible for picking up viruses - and they helped me shift it.