Wife's computer got malware

[MossRoad]

At my employer, we have a PC that is connected to a 50" monitor. On that PC all that runs is one instance of Firefox with 5 tabs open. We have an add-on that scrolls through the tabs, one every 30 seconds. Each tab has a different news website in it. That way, we can see all of the top news stories from those 5 sites. Anyhow, I walk in there one day last week and the thing is infected with the Anti-Virus 2010. Theses are national and local news gathering sites with high reputations and even one of them managed to get this garbage on their website and pass it on to who knows how many hundreds of thousands of folks. I tell ya, the first one to figure out how to block everything all the time while still allowing you to see what you want to see will be king!

 

[aczlan]

I tell ya, the first one to figure out how to block everything all the time while still allowing you to see what you want to see will be king!

AdBlock Plus and NoScript

Aaron Z

 

[buckeyefarmer]

AVG is a very good anti-virus program. I think you might mean you got the fake anti-virus program because someone clicked on it.

sorry, typed the wrong thing. I got the greenAV virus when someone clicked on one of the popups. It put links to start in several different registry locations, mostly HP and acrobat related. I had to kill the dll's, purge the executable directory, and remove from the registry.

edit: I just read that antivirus 2010 is an update or rename of the greenAV virus. As I recall it replicates dll's. You can kill one and it would create more. I used one of the sysinternal tools like procmon to freeze the process and then you can delete it.

 

[radioman]

I was hit yesterday with it too. Everything I did to kill process, it would come back for more. rebooting would have 2-6 more running in processes. This is the new variant of AV.exe I have never seen before. I been able to clean out from others pcs in registry, but not this one. I thinking a fresh install will solve it.

 

[/pine]

I thinking a fresh install will solve it.

Before going to the extreme...have you tried starting in safe mode?

whenever you use the task manager to stop a running process you have to remove the executable (search for it) or it will always return on re-boot...

try starting in "safe mode with networking" and stop any illicit processes that might be running... seeif you can visit the links previously posted in this thread and download the the appropiate applications...it may require multiple programs...

or download the programs onto a thumb drive from a working system...then start the infected system in safe mode and run the programs...

 

[Alan L.]

I've had good luck with Malwarebytes too.

 

[Barton]

My pc was infected with "Antivirus Soft" malware this afternoon while I was reading the news. Thanks to this thread I knew not to click on anything on its poisoned screen. I saw the new 'window' open up in the task bar when it started the download. It had completed and closed before I could even read the window name.

I powered down the pc, rebooted in safe mode, and executed System Restore to restore the pc to yesterday.

To play it safe, I decided to execute Rkill and Malwarebytes. So I rebooted, downloaded and executed Rkill which didn't find anything. Then I downloaded and executed Malwarebytes. It, also, did not find anything.

So I guess I stumbled on to a quick way of getting rid of "Antivirus Soft" or I just got lucky.

 

[Mousefield]

Got hit about 2 weeks ago. Turned the power off to the computer. Went to restart, tried the safe mode etc but no go. The hard drive was shot. Had to take it in and get the hard drive replaced. Had been using AVG antivirus but guess it can't keep up with the new viruses.

 

[Barton]

Dang, Mousefield, that's terrible.

Double dang, so in my case, it was just luck and not my superior pc skills. :laughing:

 

[MossRoad]

My pc was infected with "Antivirus Soft" malware this afternoon while I was reading the news. Thanks to this thread I knew not to click on anything on its poisoned screen. I saw the new 'window' open up in the task bar when it started the download. It had completed and closed before I could even read the window name.

I powered down the pc, rebooted in safe mode, and executed System Restore to restore the pc to yesterday.

To play it safe, I decided to execute Rkill and Malwarebytes. So I rebooted, downloaded and executed Rkill which didn't find anything. Then I downloaded and executed Malwarebytes. It, also, did not find anything.

So I guess I stumbled on to a quick way of getting rid of "Antivirus Soft" or I just got lucky.

You are lucky. Some of that stuff infects the system restore so when you run a restore, it installs itself again. Insidious!

 

[JB4310]

Was a storey in the paper today about a global "botnet ring broken up, described as a data vaccume that comprimised 12.7 million computors including the networks of over half of the Fortune 1000 companies. Stockpiling identity and credit info.

The Mariposa Botnet from spain.

Spanish police take down massive Mariposa botnet

.

 

[arrow]

This past month, my computer was hit 3 times with a fake security anti virus trojan. Somehow, when I uesed Malwarebytes to clean it out each time, my calculator in "Accessories" is no longer there. Anyone know how to get it back?

 

[MossRoad]

Go to START
SETTINGS
CONTROL PANEL
ADD or REMOVE PROGRAMS
Select Windows Components
ACCESSORIES and UTILITIES
ACCESSORIES
Check the calculator box.

If it is already checked, un-check it and O.K. it. Then repeat the above and re-check it and O.K.
That should do it.

 

[tommu56]

Search in windows explorer for calc.exe and see if its still there and just shortcut is missing.
If you find it make a short cut for it.

If its gone altogether you can install it from windows recovery disk don't do a reinstall you want to only add the missing accessorys.

tom

 

[MossRoad]

You don't need the windows recovery disk.

 

[arrow]

Thanks Moss. Unless I have to reboot, it did not reappear in accessories with the instructions you gave me.
Tom... I found it. How do I access it back to "programs" If I make a short cut of it, then I lose the screen I'm on to access it from the desktop

 

[tommu56]

I want to make it clear I am an amateur geek:laughing: my kids are better than I.


put short cut in this folder if you are on XP

C:\Documents and Settings\(insert user name here)\Start Menu\Programs\Accessories

and it should work

tom

 

[arrow]

Thanks Tom
That did work except it says "calc.exe." When I went to rename to "calculator" the file became unuseable

 

[aczlan]

Thanks Tom
That did work except it says "calc.exe." When I went to rename to "calculator" the file became unuseable

Put it back, right click on it, click "Send To Desktop (Create shortcut)", rename the shortcut on the desktop "Calculator" and move it to C:\Documents and Settings\All Users\Start Menu\Programs\Accessories.

What you did was move or copy it, not create a shortcut which is why it didnt work like tommu56 said.


Aaron Z

 

[arrow]

I did create the short cut originally. I'll try again...thanks

Well, I just tried that and it worked. I think the first time after I pasted the short cut, I attempted to rename it within the program which didn't work. Thanks for the tip.