Posted on 2011-09-30
Last Modified: 2013-11-22
A friend clicked on a virus scanner alert saying he was infected, and click now to activate.  Unfortunately, his system is royally screwed now.  What would be the best way to remove this bug?
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 17

Assisted Solution

by:James H
James H earned 50 total points
ID: 36893823
Boot into safe mode with networking

Download ComboxFix

Allow this to run unimpeded.

Once back into desktop, test to see if virus has been completely removed.


Author Comment

ID: 36893926
Clicking on that link, only a FreeScan button, some ads, and "how to use combofix" but nothing else.  No instructions.  It wants me to join.

Do you know if Malwarebytes’ Anti-Malware would work?  Otherwise, I'll Bleepingcomputer and see if more info appears?
LVL 17

Expert Comment

by:James H
ID: 36893940
Depending on the type of virus, MalwareBytes may not be able to remove the infection completely.
Is there another PC you can go to the site and download the combofix.exe from?
You would only then have to copy it to your desktop with either a flash drive or external drive.
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 36893965
Got it.  Will give this a shot, will wait for call back if it is successful.

Assisted Solution

sevlar earned 50 total points
ID: 36893983
I also find that a lot of these Fake A/V infections also include a rootkit infection known as TDSS.MBR. You can download a tool to scan and cure from Kaspersky's site here.,,

After that I run Combofix and then follow up with malwarebytes. All of this being done in safemode.

Combofix may ask you to install the Windows Recovery Console. If so then make sure you do let combofix install it.

I deal with Fake A / V's all the time and I find that the above proceedures tend to take care of most issues.

Accepted Solution

hello_everybody earned 400 total points
ID: 36898104
Try Remove Fake Antivirus 1.80 at

It works well for supported fake A/Vs.

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

PREFACE The purpose of this guide is to explain how to manually move a SEP client to a different client group by performing steps on the client-side. These steps may prove particularly useful because they allow the client to move after it has alrea…
This article investigates the question of whether a computer can really be cleaned once it has been infected, and what the best ways of cleaning a computer might be (in this author's opinion).
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question