Urgent Virus Help

I have no idea what I've done but I've managed to get a rogue virus checker that's infected my computer.

Basically, whenever I go to security in Control Panel it goes onto something called 'Vista Anti-Spyware'. Searched on Google and apparently it's a common thing - don't really understand how to get rid of it though.

Not only that, I keep getting pop ups telling me of infections and virus problems, asking me to register up to it.

Anybody had this before / know how to sort it out.

Quite worried.

Not had this before but what i would recommend is a system restore, do you know how to do one of those ?

No idea mate.

Also, I used to have Panda antivirus but that stopped working a little while ago. Just downloaded another free one and running a scan now - 2 things have been detected. Hopefully that is it though I'm not keeping my hopes up.

I actually quite F***ing scared now - pretty much got everything on here.

Ross, your best bet would be system restore.

It just sends your PC back to a date you choose. Everything added from that date to the date you restore it would disappear, though.

Well basically System Restore would take your computer back to an earlier date, making sure the Virus you deleted was gone as you would not have had it say yesterday etc, if your free antivirus software does not work download spy bot and it will delete and malware or spyware that is harmful to your laptop/computer, hope this helps.

Spybot download link - http://download.cnet.com/Spybot-Search-amp-Destroy/3000-8022_4-10122137.html?tag=mncol

How do I perform a system restore?

How do I perform a system restore?

Try searching it in the search bar.

Have to like restore in 20 days back to make sure the virus is gone. At least I hope it will be gone.

If you are in vista press start and type in System Restore then pick one of the dates were you are sure you had no virus, if in windows xp press start, accessories, system tools, System Restore.

Try searching it in the search bar.

Have to like restore in 20 days back to make sure the virus is gone. At least I hope it will be gone.

20 days?!

Can't do that. I'd lose too many things.

I'm pretty sure I got the virus after 00:00 this morning.

If I restored it to say yesterday or the day before should it be gone?

If so I'll just put some files onto a pen that I need.

Then try yesterday when you did not have the virus, if you had the virus surely you would of downloaded it by mistake today but by setting the restore date to yesterday etc the virus would of never of been downloaded.

20 days?!

Can't do that. I'd lose too many things.

Yeah, I went back that far before. I guess 2 days could be enough or at least to the day before you had the virus on.

Ross that scan will probably take a hell of a long time but trust me if you downloaded a good virus scanner eg avg free it should delete the virus, if you do not have enough time do a system restore to yesterday.

The scan didn't do anything.

I'm restoring it to two days ago. Are you sure that rids the virus? I'm guessing restoring wipes things since on your comp therefore wiping the virus?

Loading up now. We will see. I hope.

Mate, it should do because its only a fake virus and you had to download it in the first place, tell us if it works.

PHEW OF DOOM.

It worked. Back to how it was. Also, I didn't lose any documents?!

Thanks for the help you two, really appreciated. In panic mode for a bit there!

PHEW OF DOOM.

It worked. Back to how it was. Also, I didn't lose any documents?!

Thanks for the help you two, really appreciated. In panic mode for a bit there!

No problem, pal. Glad you didn't have to "20 days". Don't even know why I went so far back!

No problem mate, glad to help .

Those are extremely common virus and "Pop up" software.  Basically the scans are nothing more than a program just running a fake scan.  It will ALWAYS say your Infected.  It never actually scans anything it just pretends to and then recreates an identitical screen shot of your computer status. Then when you click on their " Fix" it installs spyware and fucks your system.  Their all fake and all over the net now,

Go to the following:    http://download.cnet.com/windows/

Go to search and find Revo Uninstaller...download it.

You can do a few things. "Revo Uninstaller" will uninstall all the way into the registry and check very deep.  A system restore will take it back to an earlier date but 9 times out of 10 these viruses dig deep and it will remain on the hard drive and in the registry.

Run the Revo, delete EVERY file that comes up from the scan. Make sure you only delete the bold entries which show in the registry...Revo will prompt you too the files to delete.

Download Malwarebytes...#5 on the Download list.   Run Malwarebytes and then run a regular Virus scan. Surprisingly the new Windows Security essentials, free from Microsoft is a very good anti virus program.

If you want to pay for Anti-Virus get Norton.  The best in the business.

PHEW OF DOOM.

It worked. Back to how it was. Also, I didn't lose any documents?!

Thanks for the help you two, really appreciated. In panic mode for a bit there!

Now stay away from redtube, youporn pichunter and the like.

PHEW OF DOOM.

It worked. Back to how it was. Also, I didn't lose any documents?!

Thanks for the help you two, really appreciated. In panic mode for a bit there!

Make sure you do constant virus scans to make sure it isn't a trojan. Those hide in your registry files.

Bumping this as one of my mates at work seems to have a nasty bit of malware/virus that AVG/MalwareBytes and Spybot won't get rid of.

It basically makes this scanner pop up and lists a load of trojans and stuff that's supposed to be on her comp, yet it's the actual scanner that's the problem. It won't let you work on anything and it tries to get you to enter personal data. It's called "Internet Protection".

Her comp has been booted in safe mode and had some malware entries removed. But when you start it up in normal mode, this annoying scanner pops up again.

Anyone got any ideas how to get shut?

Did some googling, maybe this thread helps?
http://www.howtogeek.com/forum/topic/its-called-internet-protection-fake-anti-virus-pop-up
The last post might be the solution.

MBAM should rid you of the problem if it's just a simple rootkit and Cnet is a trusted site.  If MBAM doesn't rid it from the offset, could you specify what the operating system is and I could walk you through the steps to remove it manually.

He said they already tried MalwareBytes mate.

He said they already tried MalwareBytes mate.

True, should have noticed that.  Sounds like a more complex rootkit.

Two questions:
1) What OS are they using?
2) Does the person at work use the computer for anything "personal", if not would they object to having their computer scanned by HijackThis (the program is a little invasive, anyone reading the log could tell what browser/search engine/home page/programs they have installed)?  I could read the log and tell you how to remove the problem.

Did some googling, maybe this thread helps?
http://www.howtogeek.com/forum/topic/its-called-internet-protection-fake-anti-virus-pop-up
The last post might be the solution.

Dex is on the ball. I use SUPERAntispyware, I've cleared the exact same virus of my mates laptop just last week. No harm in doing a system retore aswell to make sure. Also use the "Run" command and type in %temp% and delete all the files you find. Empty the recycle bin and after all that if that doesn't get rid of it ill run around Dublin in a pink dress.

Anyone got any ideas how to get shut?

Bumping this as one of my mates at work seems to have a nasty bit of malware/virus that AVG/MalwareBytes and Spybot won't get rid of.

It basically makes this scanner pop up and lists a load of trojans and stuff that's supposed to be on her comp, yet it's the actual scanner that's the problem. It won't let you work on anything and it tries to get you to enter personal data. It's called "Internet Protection".

Her comp has been booted in safe mode and had some malware entries removed. But when you start it up in normal mode, this annoying scanner pops up again.

Anyone got any ideas how to get shut?

http://www.simplysup.com/

Free 30 day trial, good tool to get rid of trojans.

Thanks for the advice lads, you are all proper gents!

Vitez, I may take you up on that. It's definitely a more complex rootkit. I'll let you know how I get on chief.

I had a virus recently, did what redkenny mentioned, was called worm.blaster 32 or something like that, did a system restore and it was gone but it only went and came back, just sent my computer into chaos until it wouldn't boot up, just kept on looping around, typical of that type of malware. I was running XP so my dad tried the XP reinstall CD, no luck. So he thought F**k it, and tried a Vista reinstall CD, and it worked, so I'm running Vista now and just rushing through the hundreds of updates that I'm missing. Lost all my documents etc, might try getting them back but there was nothing of huge value, fortunately, for years I've used my brick of an ipofod as a hard disk r my music so I didn't lose that.

Those scanners are real common now and real hard to remove.   Spybot SD may work, you can also try Advanced System Care.

More than likely you will need a hardcore removal tool.  Try Sophos http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Its a very good Rootkit Removal tool.

If its something that happens alot. When you remove it install Antilogger. http://download.cnet.com/AntiLogger/3000-8022_4-10822444.html?tag=contentMain;contentBody;5d

Its an active tool that will stop any infections before they got on your system.

Got one of those virus pop ups On the work computer. Have downloaded Spybot to try and sort it.
If that doesn't work I'll try the 2010 Norton that the new laptop came with.

Got one of those virus pop ups On the work computer. Have downloaded Spybot to try and sort it.
If that doesn't work I'll try the 2010 Norton that the new laptop came with.

Just so you know, as paid subscription anti viruses go, Norton is complete cack. Personally I prefer to use free versions of anti-virus software over the likes of Norton/McAfee.

Found the little b***ard. I ran all kinds of scans that found nothing. The main symptoms were that Firefox was getting redirected to shopping sites and Windows update wouldn't work. Also when I tried to navigate directly to the Microsoft Update site, I got a 'Page cannot be displayed' message.
I used IE to search Google for 'Microsft update page cannot be displayed' and eventually found the cause of the problem. It's a nasty little f**ker called Rootkit Win32.TDSS.tdl4.
Fortunately Kaspersky have a piece of software called TDSKILLER that you can download for free and it seems to have killed it for me. I'm now updating Windows and Firefox seems to be working fine again  

I don't know if these are considered viruses but does anyone get weird links posted by your friends on your wall in Facebook or receive random emails that don't make sense? Like adverts kinda stuff in them emails and the 'Check out who's stalked you today!' and such on Facebook.

That's just spam Adryan, aren't viruses.

That's just spam Adryan, aren't viruses.

No, but clicking on those kinds of links and installing things on Facebook can add to problems you might be having with spyware. People don't realise just how dangerous those links can be, or how clicking certain ones can add you to all kinds of mailing lists.

It's best to steer clear of anything you find suspicious, or any posts/links on facebook that you can see have been repeated on others pages.

Latest one is windows oversight centre ( a complete fraud ) but looks like windows etc, it's a real pain as it stops you running anti virus spybot programs. Basically I had to rename AVG to GVA so it didn't recognise the little sucker it's now history.

Logged into my Hotmail account this morning to find a load of delivery status notification (failure) emails. It appears that emails have been sent from my address book that I haven't sent and when I look in my sent box there is nothing there to say that the messages were sent.

I'm running a scan on my computer but so far have found nothing.

Anyone else have this problem or any idea what's going on?

Logged into my Hotmail account this morning to find a load of delivery status notification (failure) emails. It appears that emails have been sent from my address book that I haven't sent and when I look in my sent box there is nothing there to say that the messages were sent.

I'm running a scan on my computer but so far have found nothing.

Anyone else have this problem or any idea what's going on?

It wouldn't have been anything on your computer doing that.

It's either the Hotmail servers, or someone has access to your account.

Change your password immediately.

Logged into my Hotmail account this morning to find a load of delivery status notification (failure) emails. It appears that emails have been sent from my address book that I haven't sent and when I look in my sent box there is nothing there to say that the messages were sent.

I'm running a scan on my computer but so far have found nothing.

Anyone else have this problem or any idea what's going on?

Had the same problem myself a few weeks back. Have you opened a email from a friend about some berrys that make you lose weight?? If so that could well be the problem. It turns out to be a virus that sends emails out without you knowing to friends. It can also slow you pc down.

It wouldn't have been anything on your computer doing that.

It's either the Hotmail servers, or someone has access to your account.

Change your password immediately.

Had the same problem myself a few weeks back. Have you opened a email from a friend about some berrys that make you lose weight?? If so that could well be the problem. It turns out to be a virus that sends emails out without you knowing to friends. It can also slow you pc down.

Thanks for the help guys.

Couldn't find ant virus or malware on my laptop.

Changed my password. No-one should have access to my account though as this is the only computer I open my hotmail account with and nobody else knows my password.

Is a strange one though. On closer inspection, it appears to have sent emails from my safe list rather then my address book and they all started with "enquires@"

Not had any emails about berries either.

Will wait and see if anything else happens. Hopefully it won't.

Dave, I know people don't like to change their email address/provider because you may have registered  for several sites and services using that address but I really would consider leaving Hotmail. From time to time I get spam emails from friends and they are always, without fail from Hotmail accounts. This is a very common problem.
If you prefer to use free web-based email services then I'd suggest Yahoo! or Gmail. I personally use Yahoo! Mail and never seem to have any problems with it.

Dave, I know people don't like to change their email address/provider because you may have registered  for several sites and services using that address but I really would consider leaving Hotmail. From time to time I get spam emails from friends and they are always, without fail from Hotmail accounts. This is a very common problem.
If you prefer to use free web-based email services then I'd suggest Yahoo! or Gmail. I personally use Yahoo! Mail and never seem to have any problems with it.

Cheers for that info Rep, had the account for years and this is the first time anything has happened.

Don't really want to change it though as it would be a real pain. Will stick with it for now but, if I have anymore problems I think I'll get rid of it.

Right i got a virus detection notice this afternoon and thought i had caught it but the way my pc slowed down and played up it must have slipped through or part of it , anyhow i have done a system restore  deleted chrome because it had attached to that , i have now re installed chrome but have lost all my bookmarks does anyone know if you can retrieve them and how .
                                   

Right i got a virus detection notice this afternoon and thought i had caught it but the way my pc slowed down and played up it must have slipped through or part of it , anyhow i have done a system restore  deleted chrome because it had attached to that , i have now re installed chrome but have lost all my bookmarks does anyone know if you can retrieve them and how .
                                   

To my Knowledge, I don't think you can.

Well my system restore didn,t work going to have to go back to an earlier date.

Using System Restore is often ineffective for removing virus', no matter how far back you take it. Many virus' actually embed themselves in a way that they are 'restored' along with the system.
Do you have any details about the virus warning, what it said specifically?

I got that fu**ed off with my good lady & Daughter infesting my P.C. with viruses that I went Linux on their ass and now operate on Unbuntu.

Even those two haven't been able to F**k that one up.

Using System Restore is often ineffective for removing virus', no matter how far back you take it. Many virus' actually embed themselves in a way that they are 'restored' along with the system.
Do you have any details about the virus warning, what it said specifically?

You may be right i went back to may 14th and i know its still there the way my pc is operating its slow and jumpy when i tried to run system restore the damn thing went haywire filled my screen up with messages about me being infected and to download new antivirus from xp and such like dont know what to do now i am a bit stuck ,i could wipe the lot and start again but i didnt really want to go down that road , also loading the internet has slowed right down took me ages to get on here ,any help would be appreciated .

What virus protection software do you use andy?

Been running avg the free version i ran a scan yesterday and below is a list of what it picked up i know there is still something there the way it is playing up pages are loading in sections parts missing and such like

trojan generic23 dsy dropper
unknown virus win32/dh.caff820 373
trojan dropper generic3 .cike
warning corrupted executable file
trojan agent3.nxa
malware win32/kryptic.pbm
   "        generic 22.bxud
   "        tr/crypt.xpack. gen2
i realize im in the sh*t but am i up to my ankles or drowning in it.   

It looks like your system has been seriously compromised, the "trojan dropper generic3.cike" is basically a virus that will open the door for all sorts of other malware, trojans, worms etc and problems you don't want to have to deal with.

I realise because of your current issues this might be a bit slow, but try and run BitDefender. It's a browser based virus scanner that might pick up someone AVG hasn't.

Just tried to run it and it asked to download an extension is this normal?

Yes, that's fine. If you don't want to use it after the scan you can easily remove it.

Do you use or have you used any anti malware scanners such as Malwarebytes, or Spybot?

No never used any of them before .ran that one you said results came back clear said there was no infection.

I highly recommend this one mate - http://www.superantispyware.com/download.html

Interesting that nothing is picked up. I'm afraid without a proper expert in these matters it's hard to tell whether what you're experiencing is down to malware or if AVG has detected false positives and there are other problems causing your computer to slow down.

I recommend you read this forum post here: (http://forums.majorgeeks.com/showthread.php?t=35407). I know there's a lot of steps and if you're not at all tech savvy some of them might cause a bit of a problem, but it's pretty concise, and gives you a lot of good advice, including the fact your problems may not even be caused by malware.

Thanks for the help and info will let you know what i find.

No problem mate, I'm sorry I could not be more definite in my help.

To go with Rep's Anti spyware, I can also recommend Malwarebytes "Anti Malware". Both of these programs are also recommended and required if you follow the malware removal steps in the forum post I've linked above.

Had some bad Trojans and sh*t like that and in the last fortnight ESET quarantined two sites and Stopzilla which is spot on by the way, notified me that some high risk sites had been detected on a scan - that's 4 or 5 high risk sites in a fortnight when previously it would be months between such alerts. Somebody is definitely having a go.  

I am running the one Kenny named above and so far it has detected two it says they are ,disabled security centre option, any clues anyone its still scanning at present .

Scrap that think i am in the crapper its gone up to 68 threats so far the latest being an adware tracking cookie.

To go with Rep's Anti spyware

I didn't say anything,

One program I would highly recommend is Combofix, it cures all manner of pc problems and it's worth a go even if you think the problem has gone. IF you're going to give it a bash though, 3 things you should know :

1 - Get it from here -> http://www.bleepingcomputer.com/combofix/how-to-use-combofix . There are sites such as combofix.org that have nothing to do with it and want you to either pay for it (it should be free) or download malicious software thinking it's Combofix.

2 - Anti-virus software has to be turned off to run this, it might not work properly otherwise.

3 - Once started, it should never be interrupted. It will bring up blue or black screens and possibly beep now and then, just don't panick, it's normal.

cheers rep its still scanning at the moment.

Think i have cracked it took me about five hours mind.

No i didnt have it beat, turned on this morning keep getting a security shield message asking me to register and telling me that i have all kind of infections going on argggggggggg  i know that it has something to do with it , was running like a dream last night so dont quite understand what has happened

Have you tried Combofix yet?

No I didnt have it beat, turned on this morning keep getting a security shield message asking me to register and telling me that I have all kind of infections going on argggggggggg  I know that it has something to do with it , was running like a dream last night so dont quite understand what has happened

Had the same on laptop, thought I had it beat with AVG alas I was force to do full reformat.

Scrap that think I am in the crapper its gone up to 68 threats so far the latest being an adware tracking cookie.

Tracking cookies are low risk. Most anti virus' should remove them.

Have you tried Combofix yet?

No but its my last resort will give it a bash now. thanks.

Have you tried Combofix yet?

Been trying to run it for over an hour now took me a long time to get shot of avg  because it was blocking it now when i try to run it i keep getting a message cannot rename combofik then it shuts down ,,, any ideas.

Reboot your system mate and start up in Safe mode, do a system restore back a week or so, start up again in Safe mode  and run the SUPERAntiSpyware again. That should sort it.

If you get to the point where it doesn't let you boot up the PC at all, you know the Virus has won, I had that and I ended up reinstalling my OS.

If you get to the point where it doesn't let you boot up the PC at all, you know the Virus has won, I had that and I ended up reinstalling my OS.

Not true, mate, I had that same issue a couple of months back. It was also redirecting Firefox so I couldn't search for a solution. I switched to IE instead, Googled the exact virus name and found out what it was. Managed to download a program called TDSSKiller that's a stinger for that specific virus. Job done.

Been trying to run it for over an hour now took me a long time to get shot of avg  because it was blocking it now when i try to run it i keep getting a message cannot rename combofik then it shuts down ,,, any ideas.

Rename it? Sorry mate, never seen that before, it's usually my fall-back program that I can rely on if things get screwy.
Make sure that the file you downloaded it called 'ComboFix.exe'. If not, right click and rename it to that then double click to run it.
Can't stand AVG by the way, never got on with it.

Andy, forget Combofox for a minute (thought it won't hurt to run it later). Here are specific instructions for removing that Trojan. It looks like a lot but just follow it step by step (print them if you have a printer).

  End Processes
        

        Press "Ctrl" + "Shift" + "Escape" to open the Task Manager.
        

        Click on the "Processes" tab of the Task Manager and then click on the "Show Processes From All Users" button at the bottom of the Task Manager.
        

        End the following processes. To end a process, right-click on the process and select "End Process." Note that the processes are listed under the "Image Name" heading.

        search[2].exe

        sysrtmvs.exe

        senh.exe

        wd7gi8nnew.exe

        visfx500new.exe

        OEM.exe

        numbsoftnew.exe

        Mendoza1.exe

        Mendoza.exe
        

        Close the Task Manager.
    Delete Registry Entries
        

        Click on the "Start" menu icon and type "regedit" into the "Search Programs and Files" box and press "Enter." The Registry Editor opens.
        

        Click on "Edit" and then "Find" and type "Microsoft\Windows\CurrentVersion\Emitt" into the "Find Box" and click "Find Next."
        

        Right-click on the highlighted registry entry and select "Delete."
        

        Close the Registry Editor.
    Delete Files
        

        Click on the "Start" menu icon and then click on the "Search Programs and Files" box.
        

        Search for and delete each of the following files. To delete a file, right-click on it and select "Delete."

        "search[2].exe"

        "sysrtmvs.exe"

        "aouei"

        "senh.exe"

        "wd7gi8nnew.exe"

        "visfx500new.exe"

        "OEM.exe"

        "numbsoftnew.exe"

        "Mendoza1.exe"

        "Mendoza.exe"
        

        Restart your computer.

Hi Andy, sorry to see your problems are ongoing, I think it's safe to assume that AVG wasn't picking up false positives and going ahead with the steps Reps posted (I know its you this time!    ) and trying to get rid of that trojan dropper is number one priority. That's the one that's letting all these other threats in and even if you manage to clear all the other adware, malware and infections, if the trojan dropper remains it'll just 'let in' more through a backdoor.

Following those steps, I'd recommend you start your computer in safe mode and run MalwareBytes and Super AntiSpyware to clear up some of the rest of the spyware that's been missed.

Did you get to follow all those steps in the forum link I posted?

Following your steps rep and get as far as edit but when clicking the edit button there is a drop down menu but no option to find and type just says cut /copy /copy to folder /or move to folder .

Scrap that ive got as far as the registry and searching.

Followed all that REP got to the end and each file i looked for it couldnt find. does that mean it is gone ? confused .com has set in now. 

Followed all that REP got to the end and each file I looked for it couldnt find. does that mean it is gone ? confused .com has set in now. 

No, it's unlikely that the virus is gone because it's actually the last step (deleting the files) that removes the trojan. I'm not sure why you can't find the files though, perhaps try using Windows Explorer instead of the start menu.

Followed all that REP got to the end and each file i looked for it couldnt find. does that mean it is gone ? confused .com has set in now. 

To be honest Anday, that probably does mean that the Tojan Dropper had been removed. Unfortunately as others have said, it will have allowed other sh*t into your system. Until you find out what those are, I'm afraid I can be of no more help. Sorry mate.

Big thanks to all you , been on it about 12 hours ,had to go out and have a pint with me mates , out tomorrow in a show but will set about it when i get home .

Download Microsoft Security Essentials.

AVG is absolute bollocks.

Is Microsoft Security Essentials worth downloading Res?

Is it better than Norton and the like?

Is Microsoft Security Essentials worth downloading Res?

Is it better than Norton and the like?

Yes, best one out there at the moment - and it's free.

Just have to download it off the Microsoft website.

Okay thanks, I have a trial of McAffee on atm but will get rid of that and put Microsoft on.

I use MSE as well and it's very unobtrusive, even on my slow pc. Less hassle than any others I've used (AVG, Avast, ESET, McAfee).