Nasty virus on mum's system !

Neil79 · 13 Apr 2011 at 15:57

Basically she got a popup called " Xp internet security 2011 " your system is infected!. Instead of closing it she clicked ok now her system is screwed. On every boot up it loads up Windows Security Center and XP internet security 2011. It wont let you open any file just opens up SMW.EXE. At first it made every single file hidden and so far i've been unable to remove it!

Notebook - Advent
Windows XP

Any ideas?

Philtor · 13 Apr 2011 at 16:04

Try booting into safemode and running Malware bytes.

Raven8472 · 13 Apr 2011 at 16:10

Got this at work and have cleaned a few machines, use another machine to put on a memory stick , CCcleaner, Malware bytes and Spybot.

Log into the machine in safemode and install the programs via the memory stick you put the files on, run cc cleaner first, then malware bytes then spybot, if you can try to update malware bytes and spybot. You can find the programs at http://www.filehippo.com/

On some of the machines logging into Safemode allowed the machine to boot up without the fake programs taking over so allowed the download of the files needed to cleaned ( via lan cable). There may be other programs and methods available but this is the one i have used and works.

Neil79 · 13 Apr 2011 at 16:14

Using safemode now and doing a fullscan!

Luckly i have a safe pc to get the files from and upload to a usb stick as any web url via google on her system ends up on an advert page. It also tries to run scripts

Cheers Raven will use those, on my system it's highly protected but her's well

Neil79 · 13 Apr 2011 at 16:18

http://www.2-spyware.com/remove-xp-internet-security-2011.html

Nasty!

I've seen this popup before though i've never accepted it or clicked ok, aparantly it appeared on her AOL page

Deleted member 77746 · 13 Apr 2011 at 16:27

I'm afraid you can never be 100% sure that everything is clean. The only way is to format the workstation to be on the safe side.

Stelly · 13 Apr 2011 at 16:28

tell your mum to stop looking at porn, and then use combofix to clear the problem, best out there

Stelly

SHEDDER1uk · 13 Apr 2011 at 16:46

Had to get rid of this on a friends laptop real pain in the ass.

Neil79 · 13 Apr 2011 at 16:51

Stelly said:
tell your mum to stop looking at porn, and then use combofix to clear the problem, best out there

Stelly

That's what i tell my brother when he gets virus's

wannabedamned · 13 Apr 2011 at 16:51

Ah this one.

Use malwarebytes. But get the standalone definitions too. Install both, And do a full scan in Safe mode.

Duke · 13 Apr 2011 at 17:13

As above, MBAM will clear it. Some of these will hide your User folder as well, so need to unhide it to get your desktop, docs, etc showing again.

You get it by visiting an infected site. A popup will appear and if you click it, it will install the malware.

Neil79 · 13 Apr 2011 at 17:17

Duke said:
As above, MBAM will clear it. Some of these will hide your User folder as well, so need to unhide it to get your desktop, docs, etc showing again.

You get it by visiting an infected site. A popup will appear and if you click it, it will install the malware.

She said she got it from aol... Wonder what site she went to

Anyway thanks for all your help, i'm not far off finishing this up

Neil79 · 13 Apr 2011 at 17:22

Malware.Ramnit

Seems she has this aswell...

Neil79 · 13 Apr 2011 at 17:49

Going to format the notebook, the entire system is infected!