02-23-2010, 11:05 AM | #1 | ||
Grizzled Veteran
Join Date: Nov 2006
Location: Minnesota
|
Fake Alert Virus(Antivirus 2010)
I just spent around the past 14 hours getting this crap removed from my computer. I was looking at this forum when it decided to install itself. I had other windows open so I cant be certain that it came from here.
Anyway, the tricky virus did these things. 1. It disabled my registry editor 2. It disabled the use of .exe files 3. When I did finally get back on the internet it blocks you from searching for things such as Combofix, Malwarebytes, and Fake Alert. 4. It screws with the browser to if you type in www.malwarebytes.org it will send you to some advertisement screen 5. Disables system restore 6. Will not allow you to run programs to fix the problem such as combofix or malwarebytes What I had to do 1. I had to find this program that re-establishes the registry editor 2. Once I could get into the registry editor I had to edit the registry editor so I could use .exe files again 3. Luckily I had a previous version of combofix on my computer so I changed the name and was able to finally run it. Once I ran combofix I was able to download Malwarebytes by also changing the name of that file. 4. Now I have ran 2 complete system scans with CA and Malwarebytes and found around 45 infected files but it seems to be back to normal. 5. Redownload IE 8 6. Run CC Cleaner to fix everything the virus fucked up. Long story short, dont let that piece of shit get on your computer. Last edited by jbergey22 : 02-23-2010 at 11:08 AM. |
||
02-23-2010, 11:15 AM | #2 |
Hall Of Famer
Join Date: Dec 2002
Location: Mass.
|
Once you have antivirus 2010 on your system, you are correct, it is a pain to remove.
Sorry to hear that it happened to you. The best method for other users (or you in the future) to prevent against this type of attack is by use of an application similar to no-script (add on for firefox browser). For people who insist on using Internet explorer, they don't have a no-script type of add on to protect you, so you have to turn off a ton of java and scripting functionality in your Internet explorer settings and/or set your site security to be very strict. The biggest way this (and other similar attacks) get to you is not by infecting sites like FOFC, but instead they tend to hack into advertisement sites, and hack the advertisement banners which ends up being very difficult for sites to then track down. Blocking the ad banners from getting to your system would protect you roughly 60% at the least. Good luck in cleaning it up and hopefully it didn't effect you any financially (through access of bank account information or whatever you might have had stored on your computer) |
02-23-2010, 11:25 AM | #3 |
Grizzled Veteran
Join Date: Nov 2006
Location: Minnesota
|
Great advice Alan. Them banner ads do seem to cause a majority of my problems. I will download that additional browser. I may use Opera instead of Firefox. Ive always felt Firefox is just too slow(probably in my head)
I am hoping the financial information is safe. I only use secure websites for that so I am hoping that wont be a problem. Thanks for the heads up on that though. Last edited by jbergey22 : 02-23-2010 at 11:25 AM. |
02-23-2010, 11:27 AM | #4 |
Pro Rookie
Join Date: Dec 2001
Location: VA
|
I got the same thing viewing the winter olympics thread yesterday and have been dealing with it since. Just re-formatted, now going through the mind-numbing process of bringing everything back.
__________________
Chicago Eagles 2 time ZFL champions We're "rebuilding" |
02-23-2010, 11:29 AM | #5 |
Hall Of Famer
Join Date: Sep 2002
Location: Troy, Mo
|
Run superantispyware in conjuction with malwarebytes..
|
02-23-2010, 11:29 AM | #6 |
Head Coach
Join Date: Mar 2003
Location: Hometown of Canada
|
I bet it was that Dale Begg-Smith skier that installed it.
|
02-23-2010, 11:30 AM | #7 |
Hall Of Famer
Join Date: Oct 2002
Location: Massachusetts
|
prolly. fuckin asshole.
__________________
Get bent whoever hacked my pw and changed my signature. |
02-23-2010, 11:35 AM | #8 | |
Hall Of Famer
Join Date: Dec 2002
Location: Mass.
|
Quote:
No, I do too think Firefox feels sluggish and is not as fast, but the only reason I use it is for no-script which I haven't found much comparable out there. I am not familiar with Opera though, so not sure what you need to do in it to be secure. If it doesn't have some kind of protection though, simply using a different browser is not enough to protect you if it still allows through javascripting or iframe execution. |
|
02-23-2010, 11:41 AM | #9 |
Bonafide Seminole Fan
Join Date: Oct 2002
Location: Miami
|
I think the people who make that stuff should be sodomized with a huge cumbersome object.
__________________
Subby's favorite woman hater. |
02-23-2010, 02:12 PM | #10 |
SI Games
Join Date: Oct 2000
Location: Melbourne, FL
|
I had to spend an afternoon removing that from my sister in laws PC six months or so back - was a right sod to do, would have been much more awkward apart from the fact I had a laptop with me to 'cleanly' download stuff on and transfer across.
|
02-23-2010, 02:33 PM | #11 |
General Manager
Join Date: Oct 2000
Location: The Satellite of Love
|
My brother's computer got hit with something similar (Antivirus Plus). Spent a few days trying to get that shit removed but couldn't. He ended up just reformatting the hard drive.
|
02-23-2010, 06:36 PM | #12 |
High School Varsity
Join Date: Jan 2007
|
I got this fucker and had to have my computer remotely repaired by McAfee. What a friggin' pain. I agree with the cumbersome sodomy comment above.
|
02-23-2010, 06:48 PM | #13 |
College Starter
Join Date: Nov 2004
Location: Out of Grad School Hell :)
|
My wife got this on her computer last week, I ran malwarebytes, and did a system restore in safe mode, and it did the trick.
Last edited by cougarfreak : 02-23-2010 at 06:49 PM. |
02-23-2010, 07:38 PM | #14 |
Grizzled Veteran
Join Date: Nov 2006
Location: Minnesota
|
|
02-23-2010, 08:30 PM | #15 |
Coordinator
Join Date: Jun 2002
Location: The scorched Desert
|
RKILL wil stop it from disabling programs that can clean it as well. I dealt with this and because of some residual damage ended up dropping a couple of hundred bucks to get my system right, pain in the ass and Noop, plain sodomy is not enough. Flaming large cumbersome objects would be my choice.
|
02-23-2010, 08:41 PM | #16 |
assmaster
Join Date: Feb 2001
Location: Bloomington, IN
|
Purely objectively: from a coding standpoint, that's a pretty clever virus. It would make me want to hunt the programmer down and shit in the smoking bullet holes I had just pumped into his skull.
|
02-24-2010, 02:25 AM | #17 |
College Prospect
Join Date: Feb 2001
Location: Bryson Shitty, NC
|
This is what happened to me recently as well. Effin lame. Had to wipe after a restart and virus/malware scan in safe mode resulted in my windows not being able to load properly, causing a log on then immediately log off issue when I restarted the computer.. It also would only boot in safe mode for some reason, even when I asked it to boot in normal mode. Eventually tried reinstalling over the old windows install when recovery console failed to work, then wiping and reinstalling windows when that didnt work, but then said eff it, moved on to Ubuntu 9.10 and use WINE now. Much happier than I was.
__________________
Recklessly enthused, stubbornly amused. FUCK EA
Last edited by Julio Riddols : 02-24-2010 at 02:30 AM. |
02-24-2010, 11:18 AM | #18 |
College Benchwarmer
Join Date: Jan 2006
|
Yep, Malwarebytes/SuperAntiSpyware does the trick.
|
06-22-2010, 03:10 PM | #19 |
World Champion Mis-speller
Join Date: Nov 2000
Location: Covington, Ga.
|
Has anyone came up with anything better for this? Kids have the laptop in a bind, and when my wife's system did this I had to clean boot as nothing else worked.
|
06-22-2010, 05:27 PM | #20 |
Banned
Join Date: Mar 2008
|
I got that sob...that thing claws its way into everything and is a pain. Make sure you use combo-fix and make sure u check the mbr (master boot record). It likes to replace that with its own version. If im not mistaken rkill is useful also. It shuts down known viral processes so it can be semi-functional again.
Last edited by Saul Goode : 06-22-2010 at 05:40 PM. |
06-22-2010, 05:40 PM | #21 |
SI Games
Join Date: Oct 2000
Location: Melbourne, FL
|
Do a google search and there are tools for removing all of this sort of things out there:
How to remove Antivirus 2010 (Uninstall Instructions) Looks a reasonable starting place ... but do bear in mind I haven't used that approach myself. (I've had to fix this issue TWICE on my sister in laws computer in the past year or so .... and once on my wife's ... gotta love being known as a computer geek ) |
06-22-2010, 05:58 PM | #22 |
Pro Starter
Join Date: Jul 2007
|
i had it (or sth very similar, was called AV Security Suite) as well a couple days ago and ultimately all i needed to do luckily was to restore my system to an earlier date (2 days), so if you have that option on this should be your first bet.
One thing to get started is to access the taskmanager directly after startup, then you can disable itīs process (in doubt disable everything you canīt associate with sth you have installed normally) for the time being giving you a bit of time to run your programs, then this one helped me out a ton : Antispyware Soft (AntispywareSoft) Virus Removal Guide | Virus Removal Guru |
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
Thread Tools | |
|
|