Getting rid of spyware

Macca19

Moderator
Jan 14, 2001
62,910
78,414
Albertr0n
AFL Club
Port Adelaide
Other Teams
MUFC, Orlando Magic
Right now, ive got an absolute b*tch of a virus called Antivirus XP 2008.

You've probably heard of it, its systematically dismantling my computer as we speak.

Its taken me hours to actually get on the bloody internet, since i'd have to restart and restart over and over again because it would freeze every time.

Im searching google, the problem is, the virus wont let me on any site that might help get rid of it.

Whenever i go to the "Search" function, it restarts the computer.

Im in a huge mess right now, i didnt even do anything, it just randomly installed about 3 hours ago.

Im running Malwarebytes right now, that apparantley does the trick, but im concerned it wont.

Could anybody help me with this? Its a royal pain in the ass.
I have a strain of this at the moment. Absolutely ludicrous virus. Ive run 4 different anti virus/anti spyware software and it cant get rid of it. I manually deleted some of the files which started the program (if the program started, it wouldnt let you open task manager, explorer, or any program that would help shut it down) but its still effecting the internet, changing any site I click on after a search in google to some shitty advert sites.

Im also trying malwarebytes as well to see if it fixes it. If it doesnt then I may have to re-format.
 

Macca19

Moderator
Jan 14, 2001
62,910
78,414
Albertr0n
AFL Club
Port Adelaide
Other Teams
MUFC, Orlando Magic
malwarebytes fixed the majority of it and deleted 32 infected files (others could only find 2-6 infected files and couldnt delete them), but I still have the issue of google search results being hijacked, which is most annoying.

Not sure how it spread or how I got it....it seems most likely that someone got into an open port, as I wasnt browsing or downloading at the time.
 

Cleavy

Hall of Famer
Nov 28, 2004
32,823
20,206
Melbourne
AFL Club
Hawthorn
malwarebytes fixed the majority of it and deleted 32 infected files (others could only find 2-6 infected files and couldnt delete them), but I still have the issue of google search results being hijacked, which is most annoying.
did you run malwarebytes in safe mode? failing that, have you tried 'hijack this' or ccleaner?
 

Geelong_Sicko

Brownlow Medallist
Jun 11, 2007
18,676
16,544
Melbourne
AFL Club
Geelong
Disconnect from the internet (unplug the modem), run msconfig and see if there's any unusual programs listed in the startup checklist. If any unusual sh*t pops up you may have to search for its name in the registry editor and delete the keys manually.
 

SammyFish25

All Australian
Feb 22, 2009
881
2
Melbourne
AFL Club
St Kilda
Other Teams
Bris Broncos, Raptors, Norwich City
Okay, Ive got a tricky one here..

AV Security Suite (Virus)

Ive tired everything and anything that Ive seen online, AVG/Malwarebytes etc.
and nothing has worked, PC is currently operating in safe mode, where I can access everything, however when back in normal mode, I can open anything with a box popping up saying

(*insert file name*).exe is corupted, download latest/full version of AV Security Suite to fix this problem..

Ive tried using RKill, before scanning with Malwarebytes, but as soon as I run that (RKill) I get a pop up box saying "pev.rkexe" is infected.

Im at a loss of what to do next, and some help would greatly be appreciated :)
 

Mobbs

A Large Portion, Yes
Nov 1, 2000
46,598
34,206
www.footypedia.com/qooty
Other Teams
Fitzroy FC
1. Get MalwareBytes (impossible if you are running your own infected computer in unsafe mode). Try to get it via safe mode, or using a diff computer, file on USB stick, try again (in safe mode).

Once its there and installed, I have found a handy trick for avoiding the safe mode tiresomeness.

When you reboot your computer, stand right over it and wait for the very second your desktop appears. Slam your mouse into malwarebytes as fast as you can ...

The AV Security Suite virus kicks in a bit further down the startup process. About a minute after desktop appears. So if you can beat it to your Malwarebytes files, before it tells you its corrupted, Malwarebytes will open and run perfectly fine, removing the virus.

Once its complete. Reboot again, wait for the complete booting. Note wether the virus returns. It shouldn't. Then just re-run Malwarebytes a second time, and let it clean out whatever else it can find.

Also ... the new MS little castley housey thing also seems to have AV Security Suite covered now, so make sure you're updated with that resource-guzzling prick of a thing :)
 

Mobbs

A Large Portion, Yes
Nov 1, 2000
46,598
34,206
www.footypedia.com/qooty
Other Teams
Fitzroy FC
If you already have RKill (dunno what that it, maybe it'll work), do what I suggested with that. hopefully you have a shortcut to it on the desktop.

Reboot, and dbl-click RKill as soon as you see it appear onthe deskptop. This should sneak it in before the AV Security Suite starts up.
 

SammyFish25

All Australian
Feb 22, 2009
881
2
Melbourne
AFL Club
St Kilda
Other Teams
Bris Broncos, Raptors, Norwich City
When you reboot your computer, stand right over it and wait for the very second your desktop appears. Slam your mouse into malwarebytes as fast as you can ...
Mobbenfuhrer = LEGEND! :thumbsu:

Took your advice, and went nuts when it loaded, opened up and ran the scan.

Virus = Gone

Thanks heaps buddy, I Owe you one. :)
 

sblack

Brownlow Medallist
Apr 23, 2007
21,377
4,753
Sydney
AFL Club
Brisbane Lions
Other Teams
Sixers, Eagles, Man Utd, Georgetown
I had this mofo.

MalwareBytes left a folder with a rogue file in it. Was not happy.

Did the same kinda thing as you explained though Mobbs. Opened up Task Manager before the ****er could load. Stopped the virus' service (pretty easy to recognise), which then allowed me full access to Explorer. Already new where he was hiding and deleted that b*tch.

All well again.

Annoying that Avast didn't pick it up.
 

Mobbs

A Large Portion, Yes
Nov 1, 2000
46,598
34,206
www.footypedia.com/qooty
Other Teams
Fitzroy FC
sblack, your brilliant concept of locating and ending the process is second only to the most entertaining use of Chopper terminology to describe a manual approach to virus threats. :thumbsu:

SammyFish you're welcome, but had I noticed you were a Saints man I'd have just sent you more viruses instead dammit :p Probably something rife with thumbs up if Ray sent you for free on kookica
 

Geelong_Sicko

Brownlow Medallist
Jun 11, 2007
18,676
16,544
Melbourne
AFL Club
Geelong
Also, after an infection it's wise to turn OFF the System Restore (for XP anyway, dunno about Linux, Windows 7 or Vista) of all your drives, as quite a few viruses hide themselves within the restore points and will just reboot themselves at their own leisure if you don't nail the bastards right there and then.

Right-click 'My Computer', select 'properties' at the bottom of the list, click the 'System Restore' tab then click the 'turn off System Restore on all drives'. This will delete all your restore points as well as any hidden viruses that may be lying in ambush.

Reboot your computer, then turn System Restore back ON and immediately create a new restore point.
 

sblack

Brownlow Medallist
Apr 23, 2007
21,377
4,753
Sydney
AFL Club
Brisbane Lions
Other Teams
Sixers, Eagles, Man Utd, Georgetown
Also, just remembered.

Check your Internet Options, as it usually sets you to connect through a proxy.

Go into Control Panel > Network and Connections, or whatever it is called, and find the 'Internet Options' option. Goto the Connections tab, then LAN Settings. Uncheck the box (if it is still checked) that says use a Proxy for LAN connections.
 

HSSB

Cancelled
Sep 24, 2008
6,474
19
Adelaide
AFL Club
Hawthorn
Other Teams
Boston Celtics - GWS Giants
Is it fine for me to have AVG Internet Security and MalwareByes both on my computer? Or do I only need one?
 

Caesar

Ex-Huckleberry
Mar 3, 2005
26,077
11,712
Tombstone, AZ
AFL Club
Western Bulldogs
Every week I run my virus-scanner, I get the same 3 threats pop up. I quarantine/delete them but the next week they are back again.

I don't visit any dodgy sites so I can only presume I picked up something nasty at some point and the virus scanner is only detecting/deleting part of it, and leaving something that keeps on reinstalling it. Any tips how to get rid of it?

FWIW I use AdAware Antivirus (free version), Microsoft Security Essentials and Spybot Search & Destroy.
 

Remove this Banner Ad