Virus Removal, New viruses acting as anti-virus scanners

  • Calculators
  • Thread starter Q_Goest
  • Start date
  • Tags
    Virus
In summary, My daughter's computer was recently attacked by a virus called Malware Defense. After a few days of attempted removal, I finally got it off her machine. In doing so, I learned a lot about this new type of viral attack. A large number of new viruses get into a computer and:1. Disable your existing Anti-virus software2. Disable Spybot3. Disable Windows Defender (part of your standard operating system)4. Writes itself into your register to be started up when you turn the machine on.5. Runs a program in the background such that if you are successful in removing the virus, it simply reinstalls itself.
  • #1
Q_Goest
Science Advisor
Homework Helper
Gold Member
3,012
42
My daughter's computer was recently attacked by a virus called Malware Defense. After a few days of attempted removal, I finally got it off her machine. In doing so, I learned a lot about this new type of viral attack. A large number of new viruses get into a computer and:
1. Disable your existing Anti-virus software
2. Disable Spybot
3. Disable Windows Defender (part of your standard operating system)
4. Writes itself into your register to be started up when you turn the machine on.
5. Runs a program in the background such that if you are successful in removing the virus, it simply reinstalls itself. Not sure how.

Symptoms include the above and also it pops open what appears to be a scanner window that says you have a virus. It directs you to a website which says you need to download stuff to remove the virus. If you pay for anything with a credit card, it's likely your number has been stolen. Other things happen such as error messages regarding programs that are running, errors with MS Internet Explorer, and other problems.

To eliminate it, I had to remove the computer from the internet and I found a program online that shuts down the program that runs in the background called rkill.com which can be found http://www.bleepingcomputer.com/virus-removal/remove-malware-defense" [Broken] (see step 7). I then got PC Tools, a program available on the internet, to scan the machine and remove all the viruses.

If you get things popping up on your computer that tell you there's a virus on your machine or find any of the symptoms above, that's a good sign your machine has a virus. If that's the case, you might try what I did.
1. Remove the computer from the web.
2. Run rkill.com or similar program to stop things running in the background.
3. Run an antivirus scan malware remover. I used PC Tools.

Additional instructions I found helpful here:
http://www.bleepingcomputer.com/virus-removal/
 
Last edited by a moderator:
Computer science news on Phys.org
  • #2
Eons ago in DOS times I wrote a virus that attached itself to .com files and - if they get infected later and the file size has changed - displayed message "file infected, do something about it". But I never let it spread in the wild.
 
  • #3
I always went with reinstalling the os
 
  • #4
Registry cleaners can be very effective against such things but you have to know what you're doing.
 
  • #5
I had the Internet Security 2010 malware. I semi-cleaned it off using MalwareBytes, but my browser would still redirect on searches (didn't matter whether I used google or yahoo, it would still redirect).

I tried Avast and it cleaned quite a bit of stuff that had either been missed by MalwareBytes or that had reinstalled itself.

I'd asked for help on the bleepingcomputer forum, but they never did get back to me. In the meantime, the Internet Security 2010 came back, with the even more fun twist that my computer would shut down due to supposed viruses on the system.

I ran MalwareBytes again and disconnected my computer from the Internet to at least get to the point where the computer wouldn't shut down on me.

Eventually, I tried to uninstall the Avast since I felt I was accumulating too many anti-virus programs. Thanks to the malware on my system, I couldn't even completely uninstall the Avast program. I was afraid that might cause me problems when running the next program I used. Fortunately, that wasn't the case and I was able to completely uninstall the program after fixing my system.

Just something to keep in mind, though. Throwing too many fixes at a problem is a little like pouring Drano down your drain and having it not work. Now you have a drain filled with acid that will be hazardous to you when you try to take the drain apart.

Running combofix finally cleaned the offending malware off my system (it finished the job that MalwareBytes partially solved). The malware had made a modification to the atapi.sys, plus another file was completely missing.

It appears that I've managed to clean everything off of my computer and everything is functioning normally, again.

Life is kind of boring now.
 
  • #6
Once your system is clean, install Avast and give it high priority. It will update the threat database at least once a day. I have been running it for several years now, and am VERY happy. No infections, which is something I cannot claim for McAfee, Norton, or AVG.
 
  • #7
While I have Avast here and I am mostly happy with it, about a year ago Marzena's computer has been infected with some virus that Avast was not able to clean. Honestly, I don't remember how I have removed it.
 
  • #8
I never play around with anti-viruses, and spam removal. All my files are backed up to an external hard drive. If I have a virus, I reinstall the OS in 30 minutes. All software and drivers I had previously installed is also backed up and organized on an external hard drive. It takes another 15 minutes to install everything back.

Often I'm running a web browser in a virtual machine. If the virtual machine gets infected I delete it and copy-paste a new machine from back up.
 
  • #9
waht said:
All my files are backed up to an external hard drive.

Including those infected? :biggrin:
 
  • #10
Borek said:
While I have Avast here and I am mostly happy with it, about a year ago Marzena's computer has been infected with some virus that Avast was not able to clean. Honestly, I don't remember how I have removed it.

Have you looked at Avira? I saw a study recently which indicated that it had a better score on virus removal than Avast (or AVG). It has two drawbacks - the free version does not scan e-mail (I keep Avast around for that) and it does have a tendency to give false positives.
 
  • #11
My laptop got infected by a virus because someone downloaded a file and ignored constant virus alerts from my anti-virus scanner (Avast; a pretty popular anti-virus solution in this thread, it seems). For us, too, it took a while to remove the virus.
 
  • #12
I've removed several of the fake virus software viruses from friends computers. They are definitely popular right now. Every time I do it, I feel like I am doing battle with an old enemy. Recently combo fix has been the most successful. I've also been encouraging those I have been helping to only use one virus protection program at a time unless you verify that they do not conflict. My girlfriend must have had five that had been installed by different people to help her out over the years. They all were blocking each other from updating and I had to use special removal software just to uninstall them.

I love combo-fix. It was the most consistently successful program, and I only needed to boot up in safe-mode with networking to get it to work. It is a tad nastier if the virus invades even in safe-mode. I've only seen that happen once though.
 
  • #13
A few comments.

The nastiest viruses include preventing safe mode running, access to CMD, REGEDIT etc.

Rkill can be quite good in this situation, though it is not perfect.
Users need to be aware that there are 5 versions, with different executable ectensions. They should download them all and try each in sequence in case the virus blocks certain extension types.

Combofix can be good, you can also run it in reduced mode offline, where a well establish virus cannot phone home for defensive help.
But CF can also damage your system so only use as a last resort.

Many recent viruses are also redirectors. This means they reset your browser to some proxy.
This is especially true of those which disbar access to certain sites, particularly M/Soft and AV yet allow access to Google.
After cleaning your internet may then show a cannot connect notice.
If this happens you need to go into the browser settings and untick the proxy. AV software doesn't do this for you.

Finally for those who like Avast, the paid for version has a 'sandbox' which is pretty secure.

go well
 
  • #14
Studiot said:
Many recent viruses are also redirectors. This means they reset your browser to some proxy.
This is especially true of those which disbar access to certain sites, particularly M/Soft and AV yet allow access to Google.
After cleaning your internet may then show a cannot connect notice.
If this happens you need to go into the browser settings and untick the proxy. AV software doesn't do this for you.

ComboFix is the same way, if the virus sets up a proxy, combo fix will disable the redirect, but you will have to go to proxy settings and return to default/disable in order to get back online.

Also if you have a virus that is intruding into safe mode, you will need to update combo fix on a thumb drive on another computer, then run it on the infected pc while it is not connected to the internet. It seems that if the virus does get into safe mode you are really looking at the worst case scenario and may find it easier to reformat. It depends on how tech savy your are and how much data you need to save. Pick the easier solution of he two.
 
  • #15
And don't forget to DISABLE "System Restore" before cleaning. When satisfied that your system is clean, re-enable System Restore.
Note: some viruses will not allow you to disable System Restore as the virus often copies itself to there.
There are "work-arounds" for that, but it would be a long post.
 
  • #16
I would not recommend disabling system restore until the last step of cleaning.

Once you turn your pc off all restore points will be deleted, and they could be needed. Better a tainted rp than none at all. All viruses are inactive in SR unless called by the user so are quite safe there.

The better procedure is to

clean
when the system is running again turn off SR
restart
re-enable SR
create a new now clean restore point

Incidentally, many AV programs place the little varmints in "quarantine". For most users it is better to delete them entirely, so remember to empty the quarantine box.
 
  • #17
Yeah, that's a good point, Studiot.
My thrust of my comment was to warn users of infected systems to deal with SR, as some system have inadvertently been re-infected after "full" cleaning and then at some point in the future activating SR.
So, I agree that SR should be turned off, then re-enabled AFTER cleaning.
 
  • #18
I use two hard drives and keep a clean system restore on the inactive drive. I have used the system restore off that drive to resurrect my 'main' drive. No ill effects noticed thus far [knock on wood]. The backup drive is also handy if your main drive unexpectedly dies. Yes, you lose some files, but, it is less painful than starting from scratch.
 

1. What are viruses and why do we need to remove them?

Viruses are malicious software programs designed to harm computer systems and steal personal information. They can cause slow computer performance, crashes, and data loss. It is important to remove viruses to protect your computer and personal information.

2. How do viruses act as anti-virus scanners?

New viruses may pretend to be legitimate anti-virus software in order to trick users into downloading and installing them. They may also use names and logos of well-known anti-virus software to appear trustworthy. However, these viruses do not actually remove other viruses and may even cause more harm to your computer.

3. How do we identify and remove these new viruses acting as anti-virus scanners?

To identify and remove these viruses, it is important to have legitimate anti-virus software installed on your computer. Run a full system scan and follow the instructions to remove any identified threats. Additionally, be cautious of pop-ups or unsolicited emails claiming to offer free anti-virus software.

4. How can we prevent new viruses from acting as anti-virus scanners?

The best way to prevent new viruses from acting as anti-virus scanners is to be cautious when downloading and installing software. Only download from reputable sources and be wary of any red flags such as misspellings, suspicious website URLs, or requests for personal information.

5. Are there any other measures we can take to protect against viruses?

In addition to having anti-virus software, it is important to keep your operating system and software programs up to date with the latest security patches. Be cautious when clicking on links or opening attachments from unknown sources, and regularly back up important files to prevent data loss in case of a virus attack.

Similar threads

  • Computing and Technology
Replies
34
Views
4K
Replies
17
Views
651
  • Computing and Technology
Replies
4
Views
1K
  • Computing and Technology
Replies
8
Views
2K
  • Computing and Technology
Replies
4
Views
7K
  • Computing and Technology
Replies
21
Views
6K
  • Computing and Technology
Replies
5
Views
2K
  • Computing and Technology
Replies
22
Views
4K
  • Computing and Technology
Replies
7
Views
3K
Replies
23
Views
50K
Back
Top