windows Stupid Virus =/

[G!NG3R420]

Ok, so my backup laptop I was using, aka moms, got a stupid virus on the computer. I am now forced to use an old emachine desktop. The virus I beleive to be called "AntiVirPro" This infection has attacked all the .exe files (I cant open any programs at all) and has stopped me from connecting to the internet, except for the false website to order their so called protection, which I assume is to steal credit information. I cannot restore, reformat, or run malware protection or virus scan. Somehow the virus protection she had "avg" seemed to disappear and I everytime I open up task manager it automatically closes. The tech support wants to charge a fee of $150 dollars for support, which they say cant guarentee a fix. Which IMO is a bunch of bull. So here I turn to hopefully find help and support to fix this issue. the computer specs are as followed:

 

Acer Aspire

 

CPU- Intel Pentium processor SU2700 (1.3GHz, 800MHz FSB, 2MB L2 Cache)

 

Ram- 3GB DDR3 Memory

 

HDD- 320 GB

 

Softload- Vista Home Premium 32b SP1

 

If anyone has any knowledge of acer or how to get rid of this s***t I would greatly apreciate it. I have been looking on google for information but have not been succesfull. Thank you!

[Dan]

1. Go to http://www.malwarebytes.org/

2. Download free

If the file will not open rename it to iexplore.exe

After it installs go to C:\Program Files\Malwarebytes' Anti-Malware\ and rename the main program to iexplore.exe

3. Run the scan

4. Restart

 

I have done this several times if you dont know how to do this, PM me and I'll help you.

[casper]

Hello.

 

Dont try to fix it. Its useless imo. You cant be absolutely sure that you delete all the files from the trojan.

Your System is compromised. The best way is to format your pc and install all fresh operating system.

 

Trust me, i has the same or a similar trojan too and the best way was format my pc.

 

 

casper

Edited July 27, 2010 by casper

[Dan]

Hello.

 

Dont try to fix it. Its useless imo. You cant be absolutely sure that you delete all the files from the trojan.

Your System is compromised. The best way is to format your pc and install all fresh operating system.

 

Trust me, i has the same or a similar trojan too and the best way was format my pc.

 

 

casper

I have fixed this kind of virus several times and had no problems..

[gigabyte]

I would just reformat and reinstall a fresh OS, besides your OS will run better after a fresh install.

[NoGooD]

I have fixed this kind of virus several times and had no problems..

 

If you fixed it correctly in the first place..you may have not had to do it several times.

 

I'm not saying that it's impossible by any means, but you have no way to guarantee that every problem has been fixed besides doing a reformat. A clean virus scan doesn't mean your PC is clean. It just means an infection hasn't been found. Depending on the heuristic detection of your AV, it may or may not detect new variants.

 

Reformat is the only way to go IMO.

[AntiThought]

I have battled this enemy before. There are 3 forms of this virus that I have seen..... 2 are simply there to annoy you and 1 version has a keylogger in it (unless a newer better version of the 2 earlier ones has been unleashed). The 2 nuissance versions are easy to get rid of the third one is moderately difficult but does so much damage that reformatting is a good idea (not to mention to make sure you take the keylogger out with it). If you want to try to kill it without reformatting (though reformatting is advised) this is what to do.

 

What you need to do is restart the PC if your Hardware is slow enough right as Windows is starting up and you see your desktop press ctrl+alt+del and open task manager also try to open the internet. What you are doing here is activating the things you want to use before the virus starts up and stops all new activity in Taskmgr.exe (Task Manager) and explorer.exe. The Virus does not stop these programs from operating it just stops them from doing anything new once the virus activates.

 

First for the internet. If the above trick worked you have the internet open go to http://download.cnet.com/Security-Task-Manager/3000-2094_4-10246545.html and download Security Task Manager 1.7. If the above trick did not work then this virus has done one of its signature moves and stopped Internet Explorer from working by changing your Proxy Settings. Do the following. Click on Start and then run and a command box will show up (in later windows versions just click Start and there will be a command box on the bottom of that window) and type inetcpl.cpl and press enter. That should bring up your Internet Explorer settings box. Click on the Connections tab. Then click Lan Settings (ussually at the bottom). On that Pop-up you should see a box titled Proxy Server. Uncheck the use a proxy server box. Congratulations you should have the internet again. Download the Security Task Manager and Malwarebytes (I hear it can detect this virus as most anti virus programs can not yet detect its newer versions. Try to install those programs and run them. If the Virus will not allow you to do so go to the next step we will come back to this.

 

Try to take a screenshot of your TaskManager or Security Task Manager window and post the SS so I can see your applications or write down all the things running in Task Managers application tab and post them on this thread or PM me them and I will tell you which one is causing the problem in case Malwarebytes misses it. Once we disable the virus' .exe file we can go and kill it.

[gigabyte]

I have battled this enemy before. There are 3 forms of this virus that I have seen..... 2 are simply there to annoy you and 1 version has a keylogger in it (unless a newer better version of the 2 earlier ones has been unleashed). The 2 nuissance versions are easy to get rid of the third one is moderately difficult but does so much damage that reformatting is a good idea (not to mention to make sure you take the keylogger out with it). If you want to try to kill it without reformatting (though reformatting is advised) this is what to do.

 

What you need to do is restart the PC if your Hardware is slow enough right as Windows is starting up and you see your desktop press ctrl+alt+del and open task manager also try to open the internet. What you are doing here is activating the things you want to use before the virus starts up and stops all new activity in Taskmgr.exe (Task Manager) and explorer.exe. The Virus does not stop these programs from operating it just stops them from doing anything new once the virus activates.

 

First for the internet. If the above trick worked you have the internet open go to http://download.cnet...4-10246545.html and download Security Task Manager 1.7. If the above trick did not work then this virus has done one of its signature moves and stopped Internet Explorer from working by changing your Proxy Settings. Do the following. Click on Start and then run and a command box will show up (in later windows versions just click Start and there will be a command box on the bottom of that window) and type inetcpl.cpl and press enter. That should bring up your Internet Explorer settings box. Click on the Connections tab. Then click Lan Settings (ussually at the bottom). On that Pop-up you should see a box titled Proxy Server. Uncheck the use a proxy server box. Congratulations you should have the internet again. Download the Security Task Manager and Malwarebytes (I hear it can detect this virus as most anti virus programs can not yet detect its newer versions. Try to install those programs and run them. If the Virus will not allow you to do so go to the next step we will come back to this.

 

Try to take a screenshot of your TaskManager or Security Task Manager window and post the SS so I can see your applications or write down all the things running in Task Managers application tab and post them on this thread or PM me them and I will tell you which one is causing the problem in case Malwarebytes misses it. Once we disable the virus' .exe file we can go and kill it.

Dont make it complicated, just reformat...

[NoGooD]

I give you props Anti for doing it the hard way, but I'm wondering how much time you actually spend trying to fix the problem vs. a reformat. With a good backup a reformat should be painless and maybe a few hours, including OS updates.

 

Keep us updated whichever way you go Ginger. I'd be interested to see how you went about it, and your results man.

 

 

If all else fails, give this approach a try

[G!NG3R420]

I finally got my computer back up and running, so no more slow desktop. I appreciate all the good input, but if you read the original post, it is not letting me access any type of website to dl programs, nor is it allowing me reformat the computer. I am still in the process of DL all my original programs on my lap top like xfire, et, and vent, when I'm fully ready to attack this problem I will contact more for personal help. The infected laptop will not shut down on its own, I need to press and hold the power key, as well the task manager is non accessable as well no matter how soon I attempt to open it.

[AcidParadox]

Combofix is the answer my friend ,

[AntiThought]

I know it won't let you access the internet now but have you tried doing the proxy reset I described? It seems if it won't let you reformat that proxy reset may be your only chance to not end up with a giant boat anchor. Good luck to you what ever you decide. If I can be of any assistance please let me know.

 

Awesome picture NoGooD made me laugh hard. To answer your question 10 hrs the first time and 7 minutes the 2nd time and less than 4 minutes the third time because all I had to do is find the hidden folder it was hiding in and say DELETED! lol

[Papito]

check the tutorials.

[Dan]

After you remove a virus and no websites are loading do this: Problem is related to the proxy settings

 

1. Open Internet Explorer

2. Open Internet Options from the Tools menu

3. Select the Connections tab

4. Click on the LAN settings button on the bottom

5. Under proxy server, if it is selected (use a proxy server for your LAN) deselect it and click ok

[NoGooD]

I know it won't let you access the internet now but have you tried doing the proxy reset I described? It seems if it won't let you reformat that proxy reset may be your only chance to not end up with a giant boat anchor. Good luck to you what ever you decide. If I can be of any assistance please let me know.

 

Awesome picture NoGooD made me laugh hard. To answer your question 10 hrs the first time and 7 minutes the 2nd time and less than 4 minutes the third time because all I had to do is find the hidden folder it was hiding in and say DELETED! lol

 

 

lol, thanks man. Glad to pass some "lolz" around.

 

I have another question for you. If you'd had the same virus 3 times, then how are you getting reinfected?

 

@ Ginger: Whats the progress? Hopefully you've been having some success.

 

@Dan: Good post. I had forgotten about that.