Virus attack

  • Thread starter Thread starter Michael W.
  • Start date Start date
M

Michael W.

Something called Antivirus System Pro has gotten into my PC. How can I remove
it.
I can't run my FREE AVG to get rid of it. It may have happened when a popup
from Quicktime asked me to upgrade. I'll never trust that again.
Thanks in advance.
 
Michael said:
Something called Antivirus System Pro has gotten into my PC. How
can I remove it.
I can't run my FREE AVG to get rid of it. It may have happened when
a popup from Quicktime asked me to upgrade. I'll never trust that
again.

Assuming Windows XP 32-bit...

Fix your file/registry permissions...

Ignore the title and follow the sub-section under "Advanced Troubleshooting"
titled, "Method 1: Reset the registry and the file permissions"
http://support.microsoft.com/kb/949377
*will take time
(** Ignore the last step - you should install SP3 if you don't have it
- but not at this point in the cleanup/repair.)

Reboot and ...

Search your registry for %fystem and replace the "f" with an "s". May be
three or four matches, may be none. You may even have to take ownership
(even after doing the above) of the keys in order to make the change.

Reboot and ...

Download/install this:
http://support.microsoft.com/kb/290301

After installing, do the following:

Start button --> RUN --> type in:
"%ProgramFiles%\Windows Installer Clean Up\msizap.exe" g!
--> Click OK.
(The quotation marks and percentage signs and spacing should be exact.)

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Download and run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

Reboot.

CHKDSK
How to scan your disks for errors
http://support.microsoft.com/kb/315265
* will take time and a reboot

Defragment
How to Defragment your hard drives
http://support.microsoft.com/kb/314848
* will take time

Ensure your hardware drivers are up to date (from the hardware
manufacturer's respective web pages.) Never get hardware drivers
for hardware that was not created/sold by Microsoft from Microsoft.
Installing the latest updates may have you rebooting several times,
which is fine - but after you are sure you are done - still...

Reboot.

Download/Install the latest Windows Installer (for your OS):
( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
http://www.microsoft.com/downloadS/...6F-60B6-4412-95B9-54D056D6F9F4&displaylang=en

Reboot.

and...

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
.... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Then follow the instructions here:

How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

Reboot.

Log on as an user with administrative rights and open Internet Explorer
and visit http://windowsupdate.microsoft.com/ and select to do a
CUSTOM scan...

Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time. Rebooting as needed.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one and any of the "Office Live" ones or
"Windows Live" ones for now. I would completely avoid the
Optional Hardware updates. Also - I do not see any urgent need to install
Internet Explorer 8 at this time.

Seriously - do all that. This is like antibiotics - don't skip a single
step, don't quit because you think things will be okay now - go through
until the end, until you have done everything given in the order given. If
you have a problem with a step come ask and let someone here get you
through that step. If you don't understand how to do a step, come back and
ask here about that step and let someone walk you through it.

In any case - no matter what - when you are done doing whatever you decide
to do - please - come back here and let everyone know what you did and
how things turned out.
 
Michael said:
Something called Antivirus System Pro has gotten into my PC. How can I remove
it.
I can't run my FREE AVG to get rid of it. It may have happened when a popup
from Quicktime asked me to upgrade. I'll never trust that again.
Thanks in advance.

Hello Michael:

The mathematical chances of QuickTime (Apple) itself downloading this
malware is rather infinitesimal.

This is /not/ a virus. It is a Trojan-Rogue installer that some call
scareware.

In your system's "Normal Mode" download, install, *update* & scan:

MBAM: <http://www.malwarebytes.org/>

After running MBAM, post a follow-up to this thread with your progress
and /all/ your antimalware applications and a complete/detailed
description of your computer's OS.
 
NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
• http://aumha.net/viewtopic.php?f=30&t=4075

• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
 
you should be able to remove it
via add/remove programs.

but if not, then sometimes initiating
the install for the program again will
provide the option to repair or
remove the program.

if neither of the above work, then
perhaps the program has taken your
system as hostage.

such programs are otherwise known
as hostage ware.

but before making any assumptions
you should try to use the usual methods
to uninstall the program and or look up
the faq's for it from its homesite.

--
db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- @Hotmail.com

"share the nirvana mann" - dbZen

~~~~~~~~~~~~~~~
 
Something called Antivirus System Pro has gotten into my PC. How can I remove
it.
I can't run my FREE AVG to get rid of it. It may have happened when a popup
from Quicktime asked me to upgrade. I'll never trust that again.
Thanks in advance.

If you perform a Google search for:

Antivirus System Pro

You will get information with specific instructions and removal guides
specific to this rouge application. This is such a common issue,
that nice people have composed guides and methods specific to removing
Antivirus System Pro (properly).

Here are some links that deal just with this specific problem.

http://www.bleepingcomputer.com/virus-removal/remove-antivirus-system-pro
http://www.geekpolice.net/malware-r...-antivirus-system-pro-removal-guide-t9270.htm
http://www.antivirussystempro.com/

Read through a few of them.

Some solutions have the common characteristic of using reputable free
tools (like MBAM), some sites want you to pay (don't - no need), some
use a manual removal method (why - when MBAM will generally do it)
and some solutions are totally ridiculous.

Beware of the quick and dirty fixes in places like Yahoo! Answers and
the "should be", might", "maybe" and "try this" solutions. There is
no quick and dirty fix, the removal process is a method.

What did your Google search reveal?
 
Back
Top