So I got a virus...

gameover · 7 Jun 2011 at 09:23

Browsing a site in FF (latest version of 3.x), firefox crashes and windows firewall tells me all firewalls have been disabled. I unplugged pc from router, left pc to do a full scan... came back a few hours later and it had a virus (both microsoft security essentials confirmed it, and it had the fake anti virus programs trying to get me to register and buy their product.

How can i go about reinstalling windows and knowing that the files aren't comprismised? (i know how to reinstall windows, looking for advice regarding the virus)

I was thinking of running linux, doing an anti virus scan with that - but i don't know if there are any decent linux anti virus programs that'll search for windows viruses?

any ideas/tips? i've got about 2-3tb of data on there... don't want to lose it all but don't want to risk the virus still being there.

koolpc · 7 Jun 2011 at 09:27

MalwareBytes is what i would try to get rid of that fake virus program.

gameover · 7 Jun 2011 at 09:28

I'm planning on doing a full format (of the windows hard drive, not my data) and reinstall of windows anyway - think its worth running malwarebytes anyway?

koolpc · 7 Jun 2011 at 09:30

Yes. A very good program indeed

gameover · 7 Jun 2011 at 09:33

on http://www.malwarebytes.org/ theres an option to buy it - do i just need the free version?

and is there a way to download the updates and put it onto a usb drive or burn to a cd? im going to put it on the infected pc without connecting to the internet

kain666 · 7 Jun 2011 at 13:13

eset online scan? try buying a antivirus program to be safe.

deanolfc · 7 Jun 2011 at 13:19

u could get roguekiller , it opens up like a cmd windows and kills the process of the virus , then use malwarebytes

http://www.youtube.com/watch?v=aJVjjS4XCeI&feature=channel_video_title

Paul11 · 7 Jun 2011 at 13:21

just set windows back to an earlier date and time with system restore

theheyes · 7 Jun 2011 at 13:49

It might work in some instances but you can never trust System Restore for the purpose of getting rid of malware.

kain666 · 7 Jun 2011 at 14:49

theheyes said:
It might work in some instances but you can never trust System Restore for the purpose of getting rid of malware.

sometimes it works

Paul11 · 7 Jun 2011 at 16:07

theheyes said:
It might work in some instances but you can never trust System Restore for the purpose of getting rid of malware.

its worked every single time i have used it , to fix clients computers on many many occasions.

it would be the first thing i would try

koolpc · 8 Jun 2011 at 07:42

Paul11 said:
its worked every single time i have used it , to fix clients computers on many many occasions.

it would be the first thing i would try

Doesnt always work.

smogsy · 8 Jun 2011 at 08:16

depending on the anitivirus fake my nan had one. after researching spywaredoctor had a definftion to get rid of most of it which then allowed malwarebtyes to wipe the rest of it out.

just type in google " how to remove anitivirisname"

and it probably come up with the steps, like i say i did this on my nans vista laptop and worked like a charm.

Meekal · 8 Jun 2011 at 08:50

Boot into safe mode and run MSCONFIG, disable the process from running at start up and then have a scan in within the User Profiles Folder, Most Likely under 'All Users', this is were most of these Fake AntiVirus threats get stored. Once found, Delete the files and re-run a full scan of malware bytes.

JimAroo · 8 Jun 2011 at 08:57

"Hijackthis" scans your computer for services and running processes it allows you to remove anything, you just need to know what to remove.

This without a doubt is the best tool I've ever found for Viruses, never come across a Virus that it's been unable to remove yet.

If you are not sure how to use it, post up your log and I or someone else can check it for you.

edscdk · 8 Jun 2011 at 11:46

gameover said:
How can i go about reinstalling windows and knowing that the files aren't comprismised? (i know how to reinstall windows, looking for advice regarding the virus)

.

combofix.exe from malwarebytes in safe mode, then malwarebytes..

if you reinstall simply dont run anything exe files from your old install and make sure there is not an autorun on your c: /d: etc...

Joey1988 · 8 Jun 2011 at 12:37

System restore then MalwareBytes usually does the trick for me.

Hairybudda · 8 Jun 2011 at 13:50

I removed something like this yesterday for the girlfriends aunt, it hijacked the open command and was pretending to be MBAM/MSSE (it disabled the MSSE service, rendering it useless and was restarting itself through the hijacked open command). In the end I had to kill the process then delete the file before it restarted itself, a swift reboot to safemode, rkill, combofix and MBAM scan and I managed to root it out. Think it came in through a buffer overrun in a flash ad. It also replaced explorer.exe with a file that restarted itself and then called the renamed explorer.exe.

I've hardened windows as much as I can for her and it's the second time i've been up to clean it in just over a month, I think next time she's getting linux on her machine since all she uses it for is online banking, web browsing and office stuff!

treehouse786 · 8 Jun 2011 at 23:44

check www.ejaz.me/a for useful software's

fewfe3 · 8 Jun 2011 at 23:53

normally i wil try a system restore usually works to get rid of them messages, then backup my data and then do a full restore