One of the laptops in my company have been nadly infected with a virus called Troj_FakesPyp.C. When I boot normally, I cannot execute any program, because I get an error saying, "Appliction Cannot be executed, Do you want to activate your antivirus software now?" I say No of course. I tried to run Malwarebytes, in Safe mode but didn't find anything. I tried to run Combofix in safe mode but didn't find anything either.
There are a lot of pop ups and Windows Security Alerts asking me to Scan using Antivirus System Pro and to activate the software. What do you think I can do?
Thanks!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If you do find out that you have the "windows System suite" virus. Try the following. Open IE via My computer (type trendmicro.com using My computer) and this takes you to trendmicro.com and IE should stay open, go to feetools and download the Rootkit buster, removed the rootkits. After the reboot, use Malwarebytes to remove the other infected files. You use the My Computer, because if you try to open website directly from IE is shuts down.
You need to download (again) Malwarebytes and Combofix but with different names. Ex: malwarebytes.exe rename to mbam.123.exe
Once that is done, follow the instructions here. Note: you may need to log on as a different user vice the infected profile.
http://www.bleepingcompute
You've got to isolate the process running the malware.
In safe mode, have you tried opening msconfig from your run line, and selecting "diagnostic startup - Load basic devices and services only" and then starting normally to see if the virus was disabled?
If not, can you type taskmgr in your run line to open up your task manager, so you can check your process for it?
Once you find it, you can download hijackthis or use your safe mode with command prompt to delete the virus manually.
You have to terminate Antivirus System Pro processes and then run anti-spyware application. First of all, end sysguard.exe and look for other suspicious processes. The full list of Antivirus System Pro files and processes:
http://www.2-spy
Then download Spyware Doctor and scan your PC. Download link:
http://www.2-spyware.
Business Accounts
Answer for Membership
by: PriceDPosted on 2009-08-12 at 14:26:10ID: 25083210
Did you try a to remove the rootkits?