Solved

VIRUS ALERT TURNS OUT TO BE A TROJAN

Posted on 2011-09-30
6
451 Views
Last Modified: 2013-11-22
A friend clicked on a virus scanner alert saying he was infected, and click now to activate.  Unfortunately, his system is royally screwed now.  What would be the best way to remove this bug?
0
Comment
Question by:LEECHIPTURNER
6 Comments
 
LVL 17

Assisted Solution

by:Spartan_1337
Spartan_1337 earned 50 total points
ID: 36893823
Boot into safe mode with networking

Download ComboxFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Allow this to run unimpeded.

Once back into desktop, test to see if virus has been completely removed.

0
 

Author Comment

by:LEECHIPTURNER
ID: 36893926
Clicking on that link, only a FreeScan button, some ads, and "how to use combofix" but nothing else.  No instructions.  It wants me to join.

Do you know if Malwarebytes’ Anti-Malware would work?  Otherwise, I'll Bleepingcomputer and see if more info appears?
0
 
LVL 17

Expert Comment

by:Spartan_1337
ID: 36893940
Depending on the type of virus, MalwareBytes may not be able to remove the infection completely.
Is there another PC you can go to the site and download the combofix.exe from?
You would only then have to copy it to your desktop with either a flash drive or external drive.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 

Author Comment

by:LEECHIPTURNER
ID: 36893965
Got it.  Will give this a shot, will wait for call back if it is successful.
0
 

Assisted Solution

by:sevlar
sevlar earned 50 total points
ID: 36893983
I also find that a lot of these Fake A/V infections also include a rootkit infection known as TDSS.MBR. You can download a tool to scan and cure from Kaspersky's site here.,,

http://support.kaspersky.com/faq/?qid=208280684

After that I run Combofix and then follow up with malwarebytes. All of this being done in safemode.

Combofix may ask you to install the Windows Recovery Console. If so then make sure you do let combofix install it.

I deal with Fake A / V's all the time and I find that the above proceedures tend to take care of most issues.
0
 
LVL 8

Accepted Solution

by:
hello_everybody earned 400 total points
ID: 36898104
Try Remove Fake Antivirus 1.80 at http://majorgeeks.com/Remove_Fake_Antivirus_d6323.html

It works well for supported fake A/Vs.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Have you ever tried to find someone you know on Facebook and searched to find more than one result with the same picture? Perhaps someone you know has told you that they have a 'facebook stalker' or someone who is 'posing as them' online and ta…
By the time you finish reading this article, you may have already lost all your money because you don't know the simple steps to securing your BitCoin wallet. BitCoin is an incredible invention. It is a decentralized currency system, which is the…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now