WTF is this(Virus)?

[demonix]

Considering the amount of garbage that was on the laptop, it'd be better to nuke the sucker from orbit and start from scratch.

 

[Adam_101]

Considering the amount of garbage that was on the laptop, it'd be better to nuke the sucker from orbit and start from scratch.

May be a good idea .

 

[bignev72]

You can remove this virus with a combination of Mawarebytes and Combofix.exe

Your only issue will be logging in with an account that lets you run the above. Most of the variations of this virus don't let you run anything once you have logged in.

You can create a new local admin account using a hirens disk and then just run the above. Voila! All Fixed

 

[Deehjay]

I had something similar to this where I couldn't access the internet at all because of a virus, it just kept blocking it out. Had to format unfortunately.

 

[oll3h]

I removed this today from a win 7 machine manually today. The payload was a randomly named .exe file sat in c:\programdata. There were also 3 or 4 other files by the same name bit with a different file extension. I have also seen it live in c:\users\<namehere>\appdata\local\temp. Its quite easy to remove once found and entries have been removed from the reg.

 

[AStaley]

If you've removed 7 Trojans and other rubbish and he got this take the safe route and format>install Windows. Then make sure it's fully patched, install only what he needs along with a good anti-virus. If he doesn't have one already get him to stump for Kaspersky or Eset, perhaps Malwarebytes Pro as well. Now he's been bitten he may appreciate the extra layer of defence.

 

[Toadem]

Tell him to stop visiting the free porn sites and be a little more selective where he gets his torrents from

 

[Duke]

I removed this today from a win 7 machine manually today. The payload was a randomly named .exe file sat in c:\programdata. There were also 3 or 4 other files by the same name bit with a different file extension. I have also seen it live in c:\users\<namehere>\appdata\local\temp. Its quite easy to remove once found and entries have been removed from the reg.

Yep it is easy to remove but would have formatted due to the amount of junk on there that he mentioned as well.

 

[zpos]

I got this when I mistakenly selected to OK on a Adobe Flash upgrade. Turns out it was a popup disguised as Adobe.

Managed to remove it but ever since then my windows 8 app store has never worked.