Infected Again

[Graceheart the Leopard]

This time it's with Vista Home Security 2012. I've taken time to rename the application file (which disables its effects), but now I'm unable to start any program without having to right click and press start. I'm running two different virus scans now. What else should I do?

 

[warpus]

Try spybot maybe

 

[IglooDame]

http://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012

Scroll halfway down, to FixNCR.reg

This fake-AV malware is a royal pain in the netherbits...

 

[Graceheart the Leopard]

Don't worry, I managed to get rid of it. I should really invest in better anti-virus software, though.

 

[IglooDame]

Don't worry, I managed to get rid of it. I should really invest in better anti-virus software, though.

I know this particular virus (trojan, really) seems to infect AVG-protected machines with no apparent difficulties.

 

[aimeeandbeatles]

I know this particular virus (trojan, really) seems to infect AVG-protected machines with no apparent difficulties.

Roguewares they're known as, a real pain. My mom tends to get them a lot because she downloads screensavers or somethin' that include that junk. MalwareBytes has never failed for us to remove them though.

 

[wolfigor]

I know this particular virus (trojan, really) seems to infect AVG-protected machines with no apparent difficulties.

Yes, and not only AVG fails.
These fake-AV are really horrible and very nasty!
I had to cleanup 3 PC already (not mine)

Roguewares they're known as, a real pain. My mom tends to get them a lot because she downloads screensavers or somethin' that include that junk. MalwareBytes has never failed for us to remove them though.

MalwareBytes is really superb for it.

 

[Narnia]

You're lucky, Vista home security disabled my sister's computer a few months ago and the infection was so bad that we couldn't even run any programs/edit files/etc. The viurs was even active in safe mode. We had to reformat the hard-drive because I couldn't figure out how to disable the virus otherwise.

PS: It appears that my sister picked up the virus from a website call deviant art. From what I've read, their ads are notorious for having viruses in them.

 

[wolfigor]

You're lucky, Vista home security disabled my sister's computer a few months ago and the infection was so bad that we couldn't even run any programs/edit files/etc. The viurs was even active in safe mode.

in these cases you should use a tool like RKILL:

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then import a Registry file that removes incorrect file associations and fixes policies that stop us from using certain tools. When finished it will display a log file that shows the processes that were terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.

Below are a list of RKill download links using different filenames. We offer RKill under different filenames because some malware will not allow processes to run unless they have a certain filename. Therefore when attempting to run RKill, if a malware terminates it please try a different filename offered below.

In a nutshell this is a simple exe file that kills the running malware(s) giving you time to run a full antivirus scan.
Some viruses/malware try to prevent you from downloading/running Rkill.
In these cases you just need to rename rkill.exe (some websites offer it already renamed).
Keeping it on a USB stick is a good idea.

 

[aimeeandbeatles]

in these cases you should use a tool like RKILL:




In a nutshell this is a simple exe file that kills the running malware(s) giving you time to run a full antivirus scan.
Some viruses/malware try to prevent you from downloading/running Rkill.
In these cases you just need to rename rkill.exe (some websites offer it already renamed).
Keeping it on a USB stick is a good idea.

Thanks for that! I'll get it.

 

[Narnia]

in these cases you should use a tool like RKILL:




In a nutshell this is a simple exe file that kills the running malware(s) giving you time to run a full antivirus scan.
Some viruses/malware try to prevent you from downloading/running Rkill.
In these cases you just need to rename rkill.exe (some websites offer it already renamed).
Keeping it on a USB stick is a good idea.

As I said, it prevented me from running programs so I couldn't access the internet to download anything

 

[IglooDame]

As I said, it prevented me from running programs so I couldn't access the internet to download anything

Ideally you do the download on a working/clean computer to a USB or floppy or whatever then bring that to the problem computer.

And this Windows Security 2012 trojan or whatever the hell it is called just got on another work computer. Let's see if MalwareBytes can do its magic, AVG sure can't.

 

[BobDole]

Ideally you do the download on a working/clean computer to a USB or floppy or whatever then bring that to the problem computer.

And this Windows Security 2012 trojan or whatever the hell it is called just got on another work computer. Let's see if MalwareBytes can do its magic, AVG sure can't.

Malware's is what I used when one of my idiot relatives got it on the family computer. If all else fails, it typically gets rid of whatever the problem is. Pain in the ass to get rid of though, had to put Malware's on a USB drive and have it renamed (it may block it otherwise), and it took quite a few tries. I swear, I don't get how some people download this stuff.....

 

[aimeeandbeatles]

I swear, I don't get how some people download this stuff.....

My mom often gets it in these stupid screensavers she downloads. Or games. Or something.

Though recently they've been hitting Google Images. You click on a picture and it redirects to a site that tells you you've got a virus!!! And you must DOWNLOAD THE ROGUEWARE TO REMOVE IT!!!! Plays well on nervous newbies I guess. I got a redirect but killed the browser rightaway.

 

[IglooDame]

Malware's is what I used when one of my idiot relatives got it on the family computer. If all else fails, it typically gets rid of whatever the problem is. Pain in the ass to get rid of though, had to put Malware's on a USB drive and have it renamed (it may block it otherwise), and it took quite a few tries. I swear, I don't get how some people download this stuff.....

That's the odd thing. I got it myself a few weeks back, and I may be a lot of things but I'm not naive or stupid when it comes to the internet or malware.

And when I search for this sort of malware (search term 'Windows Security 2012 malware remove' and similar) the first page or so of sites seem to me to be suspicious in and of themselves. I looked at a couple and they offer downloads to cure/remove the malware and claim that it is a CNET top choice but don't point at CNET and I couldn't find any reference to them on CNET.