wow nasty virus infecting my wifes computer.

[MadAmos]

Originally posted by: RebateMonger

Originally posted by: QuixoticOne
BTW any clue where this "comes from" or what it "does" on your PC besides being rogue anti-spyware trying to get you to order non-needed removal tools? Is it often "also" a rootkit or remote exploit backdoor or botnet host or what?

The problem with most any malware is that it almost always gets installed with Administrator rights. At that point, it can do ANYTHING to the PC (unless limited by another AV or AS program). It can install more software at will. A friend's PC with malware had a "fill me up" directory that was full of additional malware that got downloaded and installed every time the PC booted and went on the Internet.

That's why I won't trust any PC that's had malware installed. You can't be sure what else has been installed besides the "obvious" stuff.

+1

Amos

 

[mechBgon]

It's not a removal tool, but I suggest the Secunia Personal Software Inspector as a prevention aide. Because it sounds like some of this fraudware is installed using common vulnerabilities in stuff like Flash Player. Use the Secunia utility to check your system for exploitable stuff, and the utility will link you to patches that you need.

Also, if you want a blanket defense against such stuff, see if a non-Admin user account will work for your daily-driver needs.

 

[QuixoticOne]

Thanks for the help / tips, all.

I'm mostly done removing AntiVirusXP 2008 and seven or so other spyware / adware types of programs that were also detected on his PC.

I was just trying to figure out what the likely indirect consequences had been in terms of indirect disclosures of sensitive files / information, corollary infections of more insidious natures, or whatever. I don't want to find that I've cured the cold and ignored the cancer. But as several of you have said, I guess it could really have done anything it wanted to the PC and there's no sure way to tell since the infections often install/correlate with other infections of different natures et. al. I've checked out the commended sites / tools and some of them do have good information on the removal / nature of this.

I suppose if I want to be totally sure to eradicate all malware that could conceivably have rootkited the PC, I'll have to format the drive, reflash the BIOS, reinstall the system from scratch, etc. since there's always a slight possibility that there's some infection that has missed detection by the various scanners / removal tools. The "obvious" ones worry me less than the insidious "invisible to normal operations" ones.

I wish there was more of a comprehensive "DON'T DO THIS" list I could give him since it could've been something intentional he did (install a malware utility intentionally, visit a malware host web site, whatever), or it could've been a drive-by attack on a vulnerable S/W item on the PC. I suppose to be really careful I'd have to sterilize questionable bookmarked sites and email messages with links / payloads too to the extent that the removal tools may miss such things.

Of course I'll update to SP3 / the latest security patch updates etc.

Thanks again!

 

[wayliff]

I just removed one yesterday.

The program/virus lives in the program files folder with a very strange name - like gibberish. If you dont get rid of that folder the thing keeps coming back.
Delete the folder then run spybot search and destroy in safe mode...you can also scan your computer with an online tool after that to be sure.
Finally remove all the shortcuts to that pest.

That is what did it.

 

[sonoma1993]

my cousin computer is infected with this virus/malware, it's a nasty one. was finally able to get malwarebytes installed on there and currently running it in safe mode. 10 seconds into the scan, it already found like 30 infections

 

[Vehemence]

Just removed this from one of our laptops at work here - NOD32 apparently missed it in real-time.

Usual removal worked fine on it, back in action.

Obnoxious little virus.

 

[SagaLore]

I'm embarrassed to say that I briefly had that as well. But it was easy to kill. Make sure the computer has SP3 and is up to date on patches!

 

[VirtualLarry]

My friend just got this. Thanks for all the info in this thread, perhaps I can get MalwareBytes on there to scan and remove it. If not, reformat is the next step.

The funny thing is, they use Firefox as a browser, and use (most of the time, I wish it were all of the time), Limited User accounts.

Edit: Fixed it with the free version of MalwareBytes scanner.

 

[theGlove]

+1 for malwarebytes, that one removed it for me.

 

[NetGuySC]

Will a limited account stop this virus from delivering its payload?

 

[law9933]

MalwareBytes is free & does a great job, as MadScientist stated.

 

[imported_mackintire]

MalwareBytes is the recomended cure

http://www.majorgeeks.com/Malw...nti-Malware_d5756.html