friend caught virus, need to know what it is called

[hclarkjr]

friend of mine recently went to site and clicked a bad link that downloaded a virus to his computer, it installed some security software that started scanning his computer for viruses and would not let anything else be done with the computer, i ended up just doing a clean install and loaded it back up for him.
i would like to know what kind of virus he got.

 

[JEDIYoda]

ah the old Security Virus!

 

[balloonshark]

Scareware? http://en.wikipedia.org/wiki/Scareware

Are you sure it installed or did it pretend to do a scan, give you a bunch of fake virus warnings and then proceed to tell you to download and/or buy and install their fake product to fix the problems?

 

[hclarkjr]

Scareware? http://en.wikipedia.org/wiki/Scareware

Are you sure it installed or did it pretend to do a scan, give you a bunch of fake virus warnings and then proceed to tell you to download and/or buy and install their fake product to fix the problems?

yes, that is exactly what it did. it wanted to click link to pay for the software, would not let you do anything else. at all

 

[bruceb]

Download and run Malwarebytes (in safe mode) .. you may need to rename it to something else, as some viruses know the names of most removal products. Last time a friend of mine caught something like this, that program got rid of it. Don't forget to clean out the temp files in safe mode, before you run the program, to be sure it is not still hiding.

 

[hclarkjr]

thanx for replying. i already took care of the problem i just wanted to know what the name of virus was.

 

[MrColin]

thanx for replying. i already took care of the problem i just wanted to know what the name of virus was.

There are a bunch of variants, you would have needed to scan the drive and locate the specific files to definitively know which one. Its too late now unless you go back to the source of the infection, not recommended.

You could call it by the product name that was "advertised" for sale, ie the "Security 4000 trojan."

 

[xgsound]

It's too late to get the name unless you would like to get reinfected. The most recent known viruses (?virii?) are usually listed at http://www.bleepingcomputer.com/ along with recommended fixes.

Of course you can't do better that a clean install.

Jim

 

[MustISO]

The current batch of fake AV products I've seen are variants of the ZeroAccess line of malware.
http://www.symantec.com/security_response/writeup.jsp?docid=2011-071314-0410-99

 

[Iron Woode]

yes, that is exactly what it did. it wanted to click link to pay for the software, would not let you do anything else. at all

next time this happens, and it will, try running rkill. It comes in various forms to run when a virus tries to stop exe's.

keep clicking it until it runs. You may have to run it as Administrator.

If you have never used it before, you should check it out.

it has saved me a lot of aggravation.