Register to reply

Virus Removal, New viruses acting as anti-virus scanners

by Q_Goest
Tags: acting, antivirus, removal, scanners, virus, viruses
Share this thread:
Q_Goest
#1
Jan3-10, 09:45 AM
Sci Advisor
HW Helper
PF Gold
Q_Goest's Avatar
P: 2,903
My daughter's computer was recently attacked by a virus called Malware Defense. After a few days of attempted removal, I finally got it off her machine. In doing so, I learned a lot about this new type of viral attack. A large number of new viruses get into a computer and:
1. Disable your existing Anti-virus software
2. Disable Spybot
3. Disable Windows Defender (part of your standard operating system)
4. Writes itself into your register to be started up when you turn the machine on.
5. Runs a program in the background such that if you are successful in removing the virus, it simply reinstalls itself. Not sure how.

Symptoms include the above and also it pops open what appears to be a scanner window that says you have a virus. It directs you to a web site which says you need to download stuff to remove the virus. If you pay for anything with a credit card, it's likely your number has been stolen. Other things happen such as error messages regarding programs that are running, errors with MS Internet Explorer, and other problems.

To eliminate it, I had to remove the computer from the internet and I found a program online that shuts down the program that runs in the background called rkill.com which can be found here (see step 7). I then got PC Tools, a program available on the internet, to scan the machine and remove all the viruses.

If you get things popping up on your computer that tell you there's a virus on your machine or find any of the symptoms above, that's a good sign your machine has a virus. If that's the case, you might try what I did.
1. Remove the computer from the web.
2. Run rkill.com or similar program to stop things running in the background.
3. Run an antivirus scan malware remover. I used PC Tools.

Additional instructions I found helpful here:
http://www.bleepingcomputer.com/virus-removal/
Phys.Org News Partner Science news on Phys.org
New model helps explain how provisions promote or reduce wildlife disease
Stress can make hard-working mongooses less likely to help in the future
Grammatical habits in written English reveal linguistic features of non-native speakers' languages
Borek
#2
Jan3-10, 10:05 AM
Admin
Borek's Avatar
P: 23,363
Eons ago in DOS times I wrote a virus that attached itself to .com files and - if they get infected later and the file size has changed - displayed message "file infected, do something about it". But I never let it spread in the wild.
rootX
#3
Jan3-10, 02:22 PM
rootX's Avatar
P: 1,294
I always went with reinstalling the os

Topher925
#4
Jan3-10, 03:47 PM
Topher925's Avatar
P: 1,672
Virus Removal, New viruses acting as anti-virus scanners

Registry cleaners can be very effective against such things but you have to know what you're doing.
BobG
#5
Jan25-10, 06:40 PM
Sci Advisor
HW Helper
BobG's Avatar
P: 2,278
I had the Internet Security 2010 malware. I semi-cleaned it off using MalwareBytes, but my browser would still redirect on searches (didn't matter whether I used google or yahoo, it would still redirect).

I tried Avast and it cleaned quite a bit of stuff that had either been missed by MalwareBytes or that had reinstalled itself.

I'd asked for help on the bleepingcomputer forum, but they never did get back to me. In the meantime, the Internet Security 2010 came back, with the even more fun twist that my computer would shut down due to supposed viruses on the system.

I ran MalwareBytes again and disconnected my computer from the Internet to at least get to the point where the computer wouldn't shut down on me.

Eventually, I tried to uninstall the Avast since I felt I was accumulating too many anti-virus programs. Thanks to the malware on my system, I couldn't even completely uninstall the Avast program. I was afraid that might cause me problems when running the next program I used. Fortunately, that wasn't the case and I was able to completely uninstall the program after fixing my system.

Just something to keep in mind, though. Throwing too many fixes at a problem is a little like pouring Drano down your drain and having it not work. Now you have a drain filled with acid that will be hazardous to you when you try to take the drain apart.

Running combofix finally cleaned the offending malware off my system (it finished the job that MalwareBytes partially solved). The malware had made a modification to the atapi.sys, plus another file was completely missing.

It appears that I've managed to clean everything off of my computer and everything is functioning normally, again.

Life is kind of boring now.
turbo
#6
Jan25-10, 07:27 PM
PF Gold
turbo's Avatar
P: 7,363
Once your system is clean, install Avast and give it high priority. It will update the threat database at least once a day. I have been running it for several years now, and am VERY happy. No infections, which is something I cannot claim for McAfee, Norton, or AVG.
Borek
#7
Jan26-10, 02:21 AM
Admin
Borek's Avatar
P: 23,363
While I have Avast here and I am mostly happy with it, about a year ago Marzena's computer has been infected with some virus that Avast was not able to clean. Honestly, I don't remember how I have removed it.
waht
#8
Jan26-10, 08:31 PM
P: 1,636
I never play around with anti-viruses, and spam removal. All my files are backed up to an external hard drive. If I have a virus, I reinstall the OS in 30 minutes. All software and drivers I had previously installed is also backed up and organized on an external hard drive. It takes another 15 minutes to install everything back.

Often I'm running a web browser in a virtual machine. If the virtual machine gets infected I delete it and copy-paste a new machine from back up.
Borek
#9
Jan27-10, 02:56 AM
Admin
Borek's Avatar
P: 23,363
Quote Quote by waht View Post
All my files are backed up to an external hard drive.
Including those infected?
mathman
#10
Jan27-10, 03:39 PM
Sci Advisor
P: 6,027
Quote Quote by Borek View Post
While I have Avast here and I am mostly happy with it, about a year ago Marzena's computer has been infected with some virus that Avast was not able to clean. Honestly, I don't remember how I have removed it.
Have you looked at Avira? I saw a study recently which indicated that it had a better score on virus removal than Avast (or AVG). It has two drawbacks - the free version does not scan e-mail (I keep Avast around for that) and it does have a tendency to give false positives.
moonman239
#11
Jan16-11, 07:51 PM
P: 300
My laptop got infected by a virus because someone downloaded a file and ignored constant virus alerts from my anti-virus scanner (Avast; a pretty popular anti-virus solution in this thread, it seems). For us, too, it took a while to remove the virus.
Pattonias
#12
Jan19-11, 05:05 PM
Pattonias's Avatar
P: 378
I've removed several of the fake virus software viruses from friends computers. They are definitely popular right now. Every time I do it, I feel like I am doing battle with an old enemy. Recently combo fix has been the most successful. I've also been encouraging those I have been helping to only use one virus protection program at a time unless you verify that they do not conflict. My girlfriend must have had five that had been installed by different people to help her out over the years. They all were blocking each other from updating and I had to use special removal software just to uninstall them.

I love combo-fix. It was the most consistently successful program, and I only needed to boot up in safe-mode with networking to get it to work. It is a tad nastier if the virus invades even in safe-mode. I've only seen that happen once though.
Studiot
#13
Feb2-11, 01:14 PM
P: 5,462
A few comments.

The nastiest viruses include preventing safe mode running, access to CMD, REGEDIT etc.

Rkill can be quite good in this situation, though it is not perfect.
Users need to be aware that there are 5 versions, with different executable ectensions. They should download them all and try each in sequence in case the virus blocks certain extension types.

Combofix can be good, you can also run it in reduced mode offline, where a well establish virus cannot phone home for defensive help.
But CF can also damage your system so only use as a last resort.

Many recent viruses are also redirectors. This means they reset your browser to some proxy.
This is especially true of those which disbar access to certain sites, particularly M/Soft and AV yet allow access to Google.
After cleaning your internet may then show a cannot connect notice.
If this happens you need to go into the browser settings and untick the proxy. AV software doesn't do this for you.

Finally for those who like Avast, the paid for version has a 'sandbox' which is pretty secure.

go well
Pattonias
#14
Feb3-11, 10:49 AM
Pattonias's Avatar
P: 378
Quote Quote by Studiot View Post

Many recent viruses are also redirectors. This means they reset your browser to some proxy.
This is especially true of those which disbar access to certain sites, particularly M/Soft and AV yet allow access to Google.
After cleaning your internet may then show a cannot connect notice.
If this happens you need to go into the browser settings and untick the proxy. AV software doesn't do this for you.
ComboFix is the same way, if the virus sets up a proxy, combo fix will disable the redirect, but you will have to go to proxy settings and return to default/disable in order to get back online.

Also if you have a virus that is intruding into safe mode, you will need to update combo fix on a thumb drive on another computer, then run it on the infected pc while it is not connected to the internet. It seems that if the virus does get into safe mode you are really looking at the worst case scenario and may find it easier to reformat. It depends on how tech savy your are and how much data you need to save. Pick the easier solution of he two.
pallidin
#15
Feb4-11, 06:31 PM
P: 2,292
And don't forget to DISABLE "System Restore" before cleaning. When satisfied that your system is clean, re-enable System Restore.
Note: some viruses will not allow you to disable System Restore as the virus often copies itself to there.
There are "work-arounds" for that, but it would be a long post.
Studiot
#16
Feb5-11, 03:57 AM
P: 5,462
I would not recommend disabling system restore until the last step of cleaning.

Once you turn your pc off all restore points will be deleted, and they could be needed. Better a tainted rp than none at all. All viruses are inactive in SR unless called by the user so are quite safe there.

The better procedure is to

clean
when the system is running again turn off SR
restart
re-enable SR
create a new now clean restore point

Incidentally, many AV programs place the little varmints in "quarantine". For most users it is better to delete them entirely, so remember to empty the quarantine box.
pallidin
#17
Feb5-11, 04:43 PM
P: 2,292
Yeah, that's a good point, Studiot.
My thrust of my comment was to warn users of infected systems to deal with SR, as some system have inadvertently been re-infected after "full" cleaning and then at some point in the future activating SR.
So, I agree that SR should be turned off, then re-enabled AFTER cleaning.
Chronos
#18
Feb12-11, 03:43 PM
Sci Advisor
PF Gold
Chronos's Avatar
P: 9,359
I use two hard drives and keep a clean system restore on the inactive drive. I have used the system restore off that drive to resurrect my 'main' drive. No ill effects noticed thus far [knock on wood]. The backup drive is also handy if your main drive unexpectedly dies. Yes, you lose some files, but, it is less painful than starting from scratch.


Register to reply

Related Discussions
What is the best 100% free Anti-Virus? Computers 47
The Best Free Anti-Virus Programme Computing & Technology 6
Cable modem so im always connected to the internet Computing & Technology 3
Which Anti virus software is the best ? Computing & Technology 11