HELP, Think our lass has downloaded something nasty.

Mark M · 19 May 2011 at 12:46

Excellent, worked a treat thanks!

esK` · 19 May 2011 at 12:47

Not a problem, Glad to help

Doctor McNinja · 19 May 2011 at 19:03

Skii said:
Google image search is a common way to get the virus - many images are hijacked links.

I know what you mean. I was trying to find a picture of the Millennium Falcon's landing gear when I was infected... I blame George Lucas.

theheyes · 19 May 2011 at 19:50

Is it just me or is anybody else finding this sort of thing is reaching epidemic proportions? I've seen more of this crap in the last 3 months than I have in 3 years.

This fake AV stuff is even affecting OSX too, although don't call it a virus or else the pitch forks come out - "THERE ARE NO VIRUSES FOR OSX. IT'S A TROJAN." :rolleyes:

Rroff · 19 May 2011 at 19:54

There does seem to have been a spate of it recently - I think its because one variant manages to infect PCs running most of the major browsers except firefox even with precautions unless you use task manager to kill the whole browser task.

ron3003 · 19 May 2011 at 20:43

Rroff said:
There does seem to have been a spate of it recently - I think its because one variant manages to infect PCs running most of the major browsers except firefox even with precautions unless you use task manager to kill the whole browser task.

Spot on, if you get this jump up onscreen do not interact with the window at all. Clicking the x top right will result in getting screwed over just as surely as you'd clicked a big 'infect me' dialogue.
At the first sign of fake av ctrl-alt-del and end the browser task. Go into safe mode with networking and update & run malwarebytes, at most there'll be possibly a reg entry and something in temp internet files that'll be removed no probs but only as long as you didn't click anything before ending the browser task.
Facebook is full of pics infected with this carp as is google images, you certainly do not need to have been surfing anywhere dodgy to cop it.

Participant · 19 May 2011 at 20:51

Is this thread a euphemism?

Destination · 19 May 2011 at 22:07

VonClinkerhofen said:
It won't let me open it once I download it.

Had this on a work machine.
Step 1, turn off syste restore
Step 2, boot to safe mode with networking using f8 on boot
Step 3, run rkill when in safe mode
Step 4, full scan with an updated malwarebytes
Step 5, reboot normally, and second full scan with malwarebytes
Then turn system restore back on

Sylver123 · 20 May 2011 at 03:33

My mum got infected by this exact same virus.

She couldn't even get into safe mode and in the end, I had to reinstall Windows XP for her.

*Chris · 20 May 2011 at 04:59

Hehe, "our lass".

eXor · 20 May 2011 at 08:02

Scary stuff. :eek:

Which barriers can this type of malware get past?

1. Protected Mode IE?
2. Having the browser "Always ask" about downloads?
3. AppLocker / Software Restriction Policy?

Meatball · 20 May 2011 at 08:34

Adblock Plus for Firefox is one of the best antivirus/spyware programs without intending to be.

Ben Harrison · 20 May 2011 at 08:54

theheyes said:
Is it just me or is anybody else finding this sort of thing is reaching epidemic proportions? I've seen more of this crap in the last 3 months than I have in 3 years.

Does seem like it - my sister's laptop was affected by something like this recently as well. A simple reboot (following my sagely "try turning it off then on again" advice) seems to've fixed it for them, but chances are I'll be doing more tech support yet.

:rolleyes:

eddiemcgarrigle · 20 May 2011 at 14:18

Sounds exactly like the same one I got from one of my other forums that got hacked (another anti-Celtic escapade).

Anyhoo, it claimed to be Windows 7 Security and prompted the input of my serial key. Security Essentials (which is my anti-virus) would not open and neither would MalwareBytes, not even in safe mode but Windows Restore did open up and worked a treat. I ran Security Essentials and MalwareBytes immediately after the restore. Everything is back to working as it should.

gazzer_21 · 20 May 2011 at 14:50

Had to clear this or some thing like this from 3 PC's now. ( non of them mine )
Safe mode and malwarebytes works every time,
some times it takes a long time but gets there in the end.

sharingan_sasuk · 21 May 2011 at 00:10

I get this all the time from people. Run Malwarebytes in Safe Mode to get rid of the fake antivirus. Then download a file association fix as you may have issues running .exe files as they keep bring up an 'Open with...' window. Then finally check to see if any of your user files/folders are hidden, and unhide them via Properties.

kylew · 22 May 2011 at 04:10

I had this on my laptop, after ages of messing about with various anti malware applications I realised I could just delete the exe from the command prompt, I found out the exe name from task manager, and then used the command prompt to delete the exe with the force delete and hidden files command.

Cleared it right up and took about 30 seconds in the end.