Solved

VIRUS ALERT TURNS OUT TO BE A TROJAN

Posted on 2011-09-30
6
453 Views
Last Modified: 2013-11-22
A friend clicked on a virus scanner alert saying he was infected, and click now to activate.  Unfortunately, his system is royally screwed now.  What would be the best way to remove this bug?
0
Comment
Question by:LEECHIPTURNER
6 Comments
 
LVL 17

Assisted Solution

by:Spartan_1337
Spartan_1337 earned 50 total points
ID: 36893823
Boot into safe mode with networking

Download ComboxFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Allow this to run unimpeded.

Once back into desktop, test to see if virus has been completely removed.

0
 

Author Comment

by:LEECHIPTURNER
ID: 36893926
Clicking on that link, only a FreeScan button, some ads, and "how to use combofix" but nothing else.  No instructions.  It wants me to join.

Do you know if Malwarebytes’ Anti-Malware would work?  Otherwise, I'll Bleepingcomputer and see if more info appears?
0
 
LVL 17

Expert Comment

by:Spartan_1337
ID: 36893940
Depending on the type of virus, MalwareBytes may not be able to remove the infection completely.
Is there another PC you can go to the site and download the combofix.exe from?
You would only then have to copy it to your desktop with either a flash drive or external drive.
0
Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

 

Author Comment

by:LEECHIPTURNER
ID: 36893965
Got it.  Will give this a shot, will wait for call back if it is successful.
0
 

Assisted Solution

by:sevlar
sevlar earned 50 total points
ID: 36893983
I also find that a lot of these Fake A/V infections also include a rootkit infection known as TDSS.MBR. You can download a tool to scan and cure from Kaspersky's site here.,,

http://support.kaspersky.com/faq/?qid=208280684

After that I run Combofix and then follow up with malwarebytes. All of this being done in safemode.

Combofix may ask you to install the Windows Recovery Console. If so then make sure you do let combofix install it.

I deal with Fake A / V's all the time and I find that the above proceedures tend to take care of most issues.
0
 
LVL 8

Accepted Solution

by:
hello_everybody earned 400 total points
ID: 36898104
Try Remove Fake Antivirus 1.80 at http://majorgeeks.com/Remove_Fake_Antivirus_d6323.html

It works well for supported fake A/Vs.
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

PREFACE The purpose of this guide is to explain how to manually move a SEP client to a different client group by performing steps on the client-side. These steps may prove particularly useful because they allow the client to move after it has alrea…
The purpose of this Article is to provide information for a newly released variant of malware – with the assumption that many EE Members will have need of the information. According to “Computerworld”, well over one million web sites have been co…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question