8 replies to this topic

[Vegas]

Posted this on a couple of forums.

Antivirus soft rogue virus.
Somehow I contracted this piece of sh*t even with nod32 and outpost firewall. After experimenting a bit with the recommended procedures from sites I found from google, I thought I had fixed it all. Basically ran Malwarebytes antimalware and was able to find and delete all the malware. Or so I thought. After a restart, this pos is back again. Ran in safe mode and msconfiged it so that it wouldnt start at startup.

Computer helps sites have stated that these files/keys are usually the ones related to it.

%UserProfile%\Local Settings\Application Data\<random>\
%UserProfile%\Local Settings\Application Data\<random>\<random>sysguard.exe
%UserProfile%\Local Settings\Application Data\<random>\<random>sftav.exe

    * C:\Program Files\Antivirus Soft\
    * %UserProfile%\Local Settings\Application Data\[random]\ 


    * HKEY_CURRENT_USER\Software\AvScan
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""
    * HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Associations "Files" = ".exe"
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Attachments �SaveZoneInformation� = "1"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run "[random]"
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run "[random]"
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run "Antivirus Soft"
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run "Antivirus Soft"

I have searched and hopefully deleted all the files. What can I do with the reg keys? Are any of them safe to delete without messing up my computer? I've ran full system scans today and they've all come clean, yet after searching my computer for the files, they were found. This thing really likes to hide and revive itself.

[jonnykun]

you can backup your registry , delete the entries, and then try that. if it doesnt work out just reload your registry. but something tells me that something else is creating those registry entries, so deleting them won't do much

[iargue]

Nod32 targets virus's. What you have is not a virus. You have a rogue anti-virus .





The first step you want to do is follow this guide.

http://www.bleepingc...to-use-combofix

After your done. Run malwarebytes again with a full scan (And updated deffinitions) And you will be good to go.

[Vegas]

you can backup your registry , delete the entries, and then try that. if it doesnt work out just reload your registry. but something tells me that something else is creating those registry entries, so deleting them won't do much

Yeah I think there definitely else something at play. I downloaded TrojanRemover and I think it found some more stuff. After restart though ran MBAM again and it found stuff that was previously found and deleted before. After restart, everything seems clear

Nod32 targets virus's. What you have is not a virus. You have a rogue anti-virus .



The first step you want to do is follow this guide.

http://www.bleepingc...to-use-combofix

After your done. Run malwarebytes again with a full scan (And updated deffinitions) And you will be good to go.

ComboFix is a program, created by sUBs, that scans your computer for known malware, and when found, attempts to clean these infections automatically. In addition to being able to remove a large amount of the most common and current malware, ComboFix also displays a report that can be used by trained helpers to remove malware that is not automatically removed by the program.

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

Should I be worried?
And how much truth is there to this statement. Just from a random, non computer specialized forum.

Honestly... it's just easier to format.

If you can't do that, the safest thing is to remove your HDD and run scans from a different computer.
A compromised machine will have stuff loaded into memory preventing AV from doing it's job.

[iargue]

Yeah I think there definitely else something at play. I downloaded TrojanRemover and I think it found some more stuff. After restart though ran MBAM again and it found stuff that was previously found and deleted before. After restart, everything seems clear

ComboFix is a program, created by sUBs, that scans your computer for known malware, and when found, attempts to clean these infections automatically. In addition to being able to remove a large amount of the most common and current malware, ComboFix also displays a report that can be used by trained helpers to remove malware that is not automatically removed by the program.

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

Should I be worried?
And how much truth is there to this statement. Just from a random, non computer specialized forum.

No. Its not fucking easier to re-format. Trojan remover is bullshit. I'm a computer repair specialist for 8 years now, and I've clean out over a million virus's.

I am your helper, and I told you to run combofix . Follow the guide and run it all the way though. The warning is there just because the tool is the most powerful in existence (Honestly). Then run Malwarebytes.


User-error tends to make these things much much worse then they normally all. Dont do anything else then what I have told you to.

[Vegas]

No. Its not fucking easier to re-format. Trojan remover is bullshit. I'm a computer repair specialist for 8 years now, and I've clean out over a million virus's.

I am your helper, and I told you to run combofix . Follow the guide and run it all the way though. The warning is there just because the tool is the most powerful in existence (Honestly). Then run Malwarebytes.


User-error tends to make these things much much worse then they normally all. Dont do anything else then what I have told you to.

LOL will do in morning boss.

In general, most "viruses" these days are so simplistic that they put themselves into the Run or RunOnce registry key and you can simply disable them by going into Safe Mode and removing all the appropriate entries. Of course, that requires prior knowledge of what is supposed to be there in the first place.

BUT, some viruses hook into the system in some rather "creative" ways and are extremely difficult to remove (ex: if it installs as a service, or has a task that is watching itself, or hooks into another program to hide itself).

Without knowing which virus it is and where it might be hiding in the system, you'd *seriously* be better off doing a full, clean reinstall.

But we do know which virus it is right? Fuuuu first virus since like win 95 days.......And I think I have an idea where this pos came from too. ><

[artificial]

Lmao are you talking about Antivirus 2010? I've had three customers bring in their laptops because of that

[Noitidart]

Post your issue here:
http://www.bleepingcomputer.com/forums

they help like to perfection. they take awhile to find you. but when they find you its like instant help step by step.

[iargue]

Post your issue here:
http://www.bleepingcomputer.com/forums

they help like to perfection. they take awhile to find you. but when they find you its like instant help step by step.

I already gave him all the help he needs. Step by step too :|