Anitvirus System Pro

[Woppy V]

I'm sick of this damn virus. My beloved sister fell for the dam scam, paid the freight, I had the CC cancel the payment, and fought the damn thing tooth and nail but every time I think it's gone it comes back! Recently I just formatted the computer only for it to reappear 3 days later. I run Avast and SuperAntimaleware and don't understand how this thing is infiltrating. The computer that it has infected won't allow me to access IE anymore which is the most damning aspect. I just printed off some manual instructions to remove registry, dll's, and other various files but does anyone know a sure fire way to Permanently kill this thing?!



I'm so freakkin heated right now it's unreal. One day I'm gonna meet a guy who does nothing but write viruses all day and make him watch me as I punch his mother in the mouth for all the aggravation he's caused. Argh! :angry::angry::angry::angry::angry::angry::angry:





But does anyone have a trick?

 

[Tom Schindler]

Which bug is it?





Tom

 

[Woppy V]

it's a maleware/virus that calls itself Antivirus Systems Pro and pops up as if it's detected a virus and indicates that if you pay for the complete version the problem will go away. Only problem is it's now highjacking my Internet Explorer even though my virus programs have deleted or quarantined most of it..

 

[Tom Schindler]

Have you tried the link below?





Tom

 

[Nelson Atwell]

This link may be helpful (see below).

 

[Roger Batts]

Woppy, what kind of computer is it? If you reformatted the hard drive, it should have blown it out unless there is a hidden partition like Dell uses. If there isn't a hidden partition, you might try running a low level format. That will reset the hard drive to like it just came out of the box. Maxtor and Western Digital usually include the disk to do that in the box with a new drive, so if you have recently purchased a hard drive or know someone who has, you might get the CD from them.

 

[Woppy V]

It's a Dell. How would I go about seeing if it's in the hidden partition?



looking into those websites now.

 

[Woppy V]

Hey Caymen thanks a ton! That link showed me how to get IE back up and running. Once I've got that I think I can handle the rest!

 

[Taylor Weicht]

I had the same problem on my mom's computer. Virus would pop up and tell you to pay for it and it would delete "viruses" on your computer. I downloaded 1. Malwarebytes Anti-Malware 2. Spybot -Search and Destroy and 3. Ad-Aware. All 3 ive been using on my laptop for a year or two and never had a problem with them or with getting a single virus. They're all free AND got rid of the virus that was on my moms computer. Just a thought

 

[Roger Batts]

I found out mine had hidden partitions when I went to reinstall Windows recently. The hidden partition will show up in the install, but nowhere else. It takes the first section of the hard drive for all the Dell diagnostics crap they stick in there. It works with your recovery partition (usually drive D.

 

[Jacob Dryer]

The hidden partition is not accessible by windows therefore unable to be infected by virii/malware.

 

[Gavin Allan]

If it isn't accessible to Windows, what good is it?

 

[Jacob Dryer]

They are used to store diag tools and recovery data, which must be loaded from their proprietary loaders prior to entering windows.



There are utilities that will allow you access them from windows, but by default you can't read or write to those partitions inside of windows.

 

[Thomas Rogers]

I may get some heat for posting this, but if you are tech savy, this approach works for me most all the time. Warning: Only try this if you are tech savy. Try at your own risk.







I've found that most all virus of this type install themselves as a DLL or EXE file on your system and can be found and dealt with rather easily. It's easy because the writers of this maleware are rather lazy and simply dump the offending program or library files into \windows\system32, and because the files will have the date/time of the infections.



So, if you know roughly when you were infected, and especially if you were JUST infected, you can do the following (at your own risk, a little technical, NOT for the faint of heart):



1) Boot your XP or Vista computer into "Safe Mode" (press F8 between the bios and the windows bootup screen).



2) Once in Safe Mode, open a command window.



3) From the command prompt execute: cd c:\windows\system32

This will change to the C:\Windows\System32



4) From the command prompt run: dir /o-d /p

This command will list the files in windows\system32, starting with the newest first, and

lists them a page at a time.



5) In the first few files of the listing look for very recently dated files, dated at the time you think you got infected, especially files with .dll extension.



6) Within the listing you are looking for a suspect file. Something with a longer than 8 character filename, or a very short, cryptic filename is typically a good contender. For example, we had the Anvir malware that also tried to sell us a virus removal tool, and that beast put the file UpdateCheck.dll in System32. If you find such a file, simply rename it's extension via the following command (change the name of the file as needed):



ren UpdateCheck.dll UpdateCheck.bak



The above step is all you need to do to essentially DISABLE suspect DLLs, or EXEs. But again, you have to know what are suspect files. Make sure to "jot down" the name of the file somewhere for reference in the step 9.



7) Once that is done, simply reboot as normal and see if that clears things up. It may take a couple of attempts at different suspect files. If something in your system STOPS running properly, repeat steps 1-3 above, and rename the .BAK file back to its original file extension and reboot.



8) If everything is back to normal, then you found the (or should I say, a) file that is causing issues and installing/running maleware. You CAN stop there, or, perform the next few step too for even further cleanup...



9) (optional and VERY dangerous if you aren't sure of what you are doing...) Run: REGEDIT (from the run command of the start menu), and once inside that app perform a search against keys, values and data, looking for the name of the file found in the previous step (e.g. UpdateCheck.dll). If you find any class items, or other items within regedit related to this file, simply DELETE those entries.





Good luck.



Tom

 

[Woppy V]

Thanks Tom.

 

[TrainTrac]

TJR,



As a precaution, wouldn't it be a good idea to create a Restore Point using System Restore prior to starting the process that you recommend? Perhaps the procedures for that should be listed prior to your step one of going to "Safe Mode"...

 

[Thomas Rogers]

TrainTrac,



That's a good idea too.



I never do create a restore point when performing those steps. I never remove anything vital, or installed as part of the OS or an update, so the liklihood that the system becomes unstable is very minimal, and if it does, safemode can take you back.



The key is to only rename the file extension, and then only for those files you are sure are not OS files....most you can tell simply by the date.



TJR

 

[Woppy V]

Tom





that www.bleepingcomputer.com site was a good send. I'm writing this from the computer that was infected!



:banana:

 

[Nelson Atwell]

TrainTrac,



The restore point would also save the malware.



Regards,

Nelson

 

[TrainTrac]

Roger that, Nelson. I knew that, but my point was that in the event that something was seriously screwed up when doing something as tricky as TJR suggested, you'd at least have a known, working configuration to which you could return the computer.