[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Malware disguised as Windows Restore

Posted on 2011-05-12
10
Medium Priority
?
286 Views
Last Modified: 2012-05-11
A client's computer has what I believe is a fake "Windows Restore" on it. It cranks up at the end of the boot and claims there are errors on the disk. Then a box comes up claimiing the hard drive is failing or there is no space. In addition it has wiped out all his icons on the desktop and start menu.

He is using only 1/3 or his disk and the error boxes remind me of Sheriff Spyware.

Anyone familiar with this and know how to fix it?
0
Comment
Question by:Gentlee_nh
  • 3
  • 3
  • 2
8 Comments
 
LVL 9

Expert Comment

by:rfportilla
ID: 35748055
There might be a way to fix this, but I would seriously consider backing up, wiping out, and reinstalling.  

If you REALLY want to consider "fixing" it, what have you done so far?  Have you tried safe mode?  Have you tried system restore to an earlier date?  Have you tried turning off system restore (don't do until you have exhausted sysrestore options)?  Have you tried doing chkdsk?  Searching for bad .dll's?  etc.? etc.? etc.?

This is very time consuming.  Usu., if I haven't solved this in 1 hour, I try to convince the user to reinstall.  

Whatever you do, just make sure you back up everything first.  The data may be getting more corrupted with each reboot.
0
 
LVL 23

Accepted Solution

by:
phototropic earned 2000 total points
ID: 35748071
Good removal instructions here:

http://www.bleepingcomputer.com/virus-removal/remove-windows-restore

Basically, run Rkill to kill the rogue processes, then run Mbam.  Please post the Mbam log here for review.
0
 
LVL 23

Expert Comment

by:phototropic
ID: 35748104
@rfportilla,

Take a look at the removal instructions I posted.  Grinler's instructions will get rid of this infection without any problems.  There should be no need to muck about with system restore, chkdsk (?), or safe mode booting.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 38

Expert Comment

by:younghv
ID: 35748467
[Not for points]
Just concurring completely with the recommendation from 'phototropic'.

I have personally used the instructions from "Grinler" to remove dozens of these types of infections.

Follow the instructions "step-by-step" and you will soon be clear of this.
0
 
LVL 23

Expert Comment

by:phototropic
ID: 35775011
Gentlee_nh,

What is your status?

Is your problem resolved, or do you need further assistance?
0
 
LVL 9

Expert Comment

by:rfportilla
ID: 35811842
Thanks, @phototropic.  I hope that works.  I have spent a lot of time doing antivirus/antimalware work.  The directions you provided do seem to match up with what the poster is saying.  I don't think I have seen this specific infection before, though.  I misunderstood from the poster that the installation was already trashed.  Sometimes the OS is just too far gone to fix.  
0
 
LVL 38

Expert Comment

by:younghv
ID: 36002942
The suggestion at http:#a35748071 is a known fix for this problem.
It has been an "Accepted Solution" many times here on EE and hundreds/thousands of users at the original site.
0
 
LVL 38

Expert Comment

by:younghv
ID: 36119898
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
What monsters are hiding in your child's room? In this article I will share with you a tech horror story that could happen to anyone, along with some tips on how you can prevent it from happening to you.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question