UKC

Anybody got any ideas on how to get rid of a virus my pc has got?

Clicked on a YOUTUBE link last night on Facebook and it put a virus on my pc. I didn't click on anything on the virus to make it open, it just appeared as soon as I clicked the Youtube link.

It's called XP Antivirus 2010 and as far as I can tell it's a nasty one! It mimics antivirus software and anytime I try and do something on my pc it makes different windows pop up telling me I'm infected and should buy it's software to get rid of the supposed 32 infections on my pc! Aye right!!!

I *did* have AVAST software, but it let the virus through. My brother recommended I get AVIRA and I stupidly uninstalled Avast so I could install Avira, but this bloody virus won't let me install any software.

I scanned my pc with Avast before uninstalling it but it didn't find anything dodgy. Have downloaded Windows Malicious Malware Tool but it didn't find anything. Tried to download various things that are recommended to get rid of it, but the damn virus won't let me run any of this software. Try to run it and nothing happens.

Have tried following instructions found to remove it manually which involve searching for av2010.exe in the task manager in processes and stopping it from running. But there is no av2010 in the processes bit.

Have also tried using the Search facility to find things called XP Antivirus.exe. It did find 2 things called shlwapi.dll and wininet.dll which I was supposed to delete, but a message comes up saying I can't delete them.

Aaaarg, every 2 fecking minutes this stupid window appears telling me I'm infected. How the feck do I get rid of it!

In reply to SonyaD:

Not sure if this will help (manual method) .. never had to remove a virus other than quite trivial one ...

http://www.spywareremove.com/removeAntivirusXP2010.html

In reply to episodit: Hmmm. I'm afraid I don't understand those instructions. It tells me to go to Task Manager then there is a whole heap of stuff to type in. But it doesn't say where you are supposed to type that. I've already tried to stop processes in Task Manager and it won't let me, it just makes my pc shutdown.

At the moment I'm running something called STOPzilla. Don't even know if it's legit or not, but I'm getting desperate!

YES!!! This Stopzilla thing is the only thing so far that has been able to detect the XP antivirus 2010 rogue software. It is still doing it's thing just now, but please, please, please may it get rid of it!

In reply to SonyaD:

It appears that av.exe is the proces to kill and possibly another one and then it requires in Step 2 to delete some entries from the registry .. are you comfortable doing that? Bit difficult to do this kind of thing on;ine and hopefully someone with better skills than myself will help?

In reply to SonyaD:

Hope it works!

In reply to episodit: Yes, but every time I try to get rid of the dodgy processes in task manager, a box appears saying my pc will shut down in 50 secs. And as it's waiting to shutdown, all the processes I have just ended all reappear again and then my pc shuts down. It's a jammy wee fecker!!

This STOPzilla is only 5% of the way through. It's going to be a long morning.

In reply to SonyaD:

You can probably install Avira in Safe Mode.

If you have a virus infection, you should not - if you can help it, be booting the computer in normal mode.

||-)

In reply to Dominion: I don't know how to install anything in Safe Mode.

Any chance of idiot proof instructions on how to do that, step by step?

In reply to SonyaD: you have my every sympathy!! i got this last week and am still suffering with the after shocks!

ok, first off, ignore all the delete these files websites... i couldnt find half the files anyway!

AVG anti virus and MalwareBites Anti Malware were the best thing recomemded to me and also backed up by my IT bod i had to call in the end as i just couldnt get my PC back on teh works network.

download and run both of these both avaliable from here for free,

http://www.filehippo.com/

good luck, i have my fingers crossed for you here!

In reply to SonyaD:

They are getting too clever these nasty little virii. Best thing I can advise is to do a system backup regularly using something like acronis or anything else and then just restore when this kind of thing occurs. Quite easy .. boot fron CD and restore backed-up image so virus vanishes .. unless it is a very nasty one. I do a backup every time I update my software and keep about half a dozen images. Although it is slated and admittedly uses quite a lot of resources I have found that Norton works for me if you tame it sufficiently. Never had an active virus or trojan whilst it has been on the system. Use many of the other tools too and usually check with Hijack This if I suspect something amiss. Good luck anyway.

Aaaaarrrrrrgggggg!!!!

This STOPzilla thing was a f*cking con!!! It's wanting me to buy something. Now I can't get it off my computer either

I can't open my ADD REMOVE programmes as the STOPzilla won't let me.

Seems Stopzilla is also a virus

Think my pc is utterly f*cked

bollocks!

In reply to SonyaD:

Not sure but ..

http://www.stopzilla.com/support/stopzilla/Question15.do

Did you try to exit the program before trying to use add/remove?

In reply to episodit: Yup, done all that. I can't actually get in to ADD/REMOVE PROGRAMS as whenever I try a message comes up saying Application not found. I can go to START/RUN and type in appwiz.cpl and that will open the ADD/REMOVE programs. But when you try to remove STOPzilla it won't let you.

In reply to SonyaD:

http://www.ehow.com/how_5043148_remove-stopzilla.html

Any help?

In reply to episodit:

It does appear to be a legitimate if annoying program though so it might have got rid of your initial problem,

In reply to episodit:

Perhaps not though ..

http://www.adwareremovaltool.net/stopzilla-review/

In reply to SonyaD:



GET AND RUN AVG!!!! it is free and it works!!!!!! IGNORE ALL OTHER PROGRAMS TILL YOU HAVE RUN THIS!!!!! IT HAS CLEARED 85% OF THE BUG FOR ME!!! this is from my experience with this bug LAST WEEK!!!

In reply to SonyaD:
Avast is rated as the best free anti virus product I use it no problems, none of them are perfect though.

In reply to SonyaD:
(bit of techy background first)
when you switch a PC on it first of all starts the BIOS (basic input output system)
this checks the mainboard / ram / cpu and sets the very basic settings on your computer.
once that's complete it'll start loading what ever operating system you have.
but very briefly there is usually a hidden count that allows you to do extra options that we want to make us of
so....
reboot your PC
the bios screen will either load as a big graphic covering your screen or a whole bunch of text. as soon as that screen disappears, tap the F8 key until you get this hidden menu
select the option to boot into "safe mode" and try and uninstall this stopzilla thing from safemode

HTH






reboot your PC

In reply to Little Brew: Sorry, I forgot to reply to you earlier, ooops! I tried to download AVG but it wouldn't let me. I then finally managed to download the Malwarebites Anti Malware thing you linked too (and someone else also recommended that one too)

Thanks ever so much for that link because that seemed to get rid of the XP antivirus thing. And it has now enabled me to download and install AVG. AVG is scanning my pc as I type, so fingers crossed everything is okay now re viruses.

Still having a problem with removing the STOPzilla though. Hoping AVG might help with that.

Steve, it was having Avast that let all this nastyness through in the first place. My brother works with pc's and he reckons it's pretty crap and I should use Avira. But I'll stick with AVG for a while and see how I find it.

In reply to rallymania: Ah brilliant thanks. I remember going into Safe Mode years ago on an old pc but had forgotten how to do it. But I remember now what it does. Cheers. Will try uninstalling Stopzilla from there once AVG has finished scanning.

In reply to SonyaD:

Along with starting your computer in Safe Mode, may I suggest that you get as many Anti Spyware products as possible to try and get rid of your problem?

You could find a few here that may prove helpful

http://download.cnet.com/1770-8022_4-0.html?query=spyware&searchtype=do...

In reply to SonyaD:

I got an identical one the other week - it was called Security Tool.
This got rid of it http://malwarebytes.co.uk/ very quickly and easily to understand.

By the way - I have the free version of AVG and it's let a few nasty things through.
Anyone got any recommendations other than AVG?

Enty

In reply to SonyaD:

Disconnect from the internet while you run a scan, some viruses re-install themselves immediately after they have been removed by the anti virus if you're still connected to the web.

In reply to Enty: There is no AV software that is 100% effective, they tend to catch different things. Also Malware in general is getting very good at hiding, on a recent course I was on we infected a machine and ran some tests, only 4 out of 46 anti-virus solutions found it and of the 4, 2 were free, so price is no guide.

One trick for the slightly more techno savvy is to boot from a boot disk into Linux and run the AV from there. Trinity Rescue Boot CD has 3 or 4 AV suites on it.

Steve D

In reply to Enty:



Microsoft do their own anti virus stuff now and I've been using it since last year


http://www.microsoft.com/Security_Essentials/

In reply to SonyaD:
Lots of comapanies rate Avast as the best free anti virus product on the market.

Its a shame it failed you, do you use a firewall?

Which magazine give AVG 70% adn Avast 69% and the extra 1% for AVG wasn't for protection - rather the interface

I also work in computers and Avast is very respected.

The point I was trying to make is when a well made new virus comes out if you are one of the unlucky ones that gets it before the (this apples to ALL of them) anti virus product come up with a solution then NOTHING will protect you.

In reply to CurlyStevo:
BTW I use the following:
Avast, Zone Alarm (the two work fine together on my PC BTW) and Ad Aware.

In reply to SonyaD:
more info
http://antivirus.about.com/od/antivirussoftwarereviews/a/freeav_2.htm

Avast comes out on top if viruses and adware/spyware are considered and above AVG if only viruses are considered.

I don't know how old the review is BTW.

In reply to SonyaD: Happy to be of help for once! =)

hope it all goes ok for you, as i am currently having to re-start my machine every 20-30 min as it locks up! still no idea what is causing that problem!

In reply to CurlyStevo: What exactly are Zone Alarm and Ad Aware? I'm not sure if I *do* have a Firewall on my pc.

In reply to CurlyStevo:

Can I just ask, is the anti-virus that comes with Tesco Broadband, think it's called F-Secure, one of the good ones?

In reply to SonyaD:

Presumably you have XP? If so then you have a firewall and it is OK I think but others are better. Zone Alarm is a free firewall but has mixed opinions if I recall. AdAware is mostly to do with spyware and such ..

http://www.pcworld.com/downloads/file/fid,7423-order,1-page,1-c,antispyware...

I have had this on my PC at times but removed it as I never used it. I also have Spybot S & D and keep this updated but likewise it gets no use. I have a-squared which also gets updated but never gets used. I have supperantispyware but I am getting fed up with updating this and again never really gets used. I have Hijack This and this does get used and is worth using in my opinion.

In reply to SonyaD:
Its a bitch that one.
Got it on kids PC's. Start in safe mode and 'run' msconfig, on the start up items you can kill it there. Then you can delete its files once re-started. Sure there is a better way but that worked for me. good luck.

In reply to SonyaD: Another option to bear in mind if you're having problems with your installed antivirus or can't install one is trend micro. They do a free housecall program that runs from their website and seems to be quite good. I run AVG on my home computer and periodically scan with Trendmicro Housecall which occasionally finds something that AVG has missed.

In reply to blanchie14c: Are you talking about the XP antivirus virus or the STOPzilla thing?

If it's Stopzilla, what do I do once I've 'run' msconfig? Can you talk it through with me, step by step as I'm pretty dim about these things?

In reply to Enty:


Comodo do a free combined Firewall and Anti-virus package.

http://personalfirewall.comodo.com/

I've used the firewall, because at the time of installing 64-bit vista ZoneAlarm did not support a 64-bit OS

It's "noisy" at the start, but can be configured to be less irritating.

There was a review in linux mags about various anti-virus programs, but I can't - off the top of my head - recall the results. But I think BitDefender came top, but it may not be "free" for Windows...

There is also ClamWin

See http://en.wikipedia.org/wiki/ClamAV#Microsoft_Windows

for info on that one...


||-)

NB Saw a computer at work today that someone brought in so I could have a quick look at to assess.

It logs in, even in Safe Mode, for about 0.3 seconds, then immediately kicks you straight back out. Didn't spend any more time looking at it, as my first assessment is tat I need to be authorized to spend at least 30minutes trying sort that out. (NB I know what to do, just haven't got authorization to spend the time yet...)

In reply to SonyaD:

Follow this http://forums.majorgeeks.com/showthread.php?t=35407
email me if you're still stuck and want to start a private conversation

In reply to SonyaD:
These people are very good and have saved my bacon in the past.
http://www.spywareinfoforum.com/index.php?showtopic=79038
Follow instructions, run Hijack this and post on the forums.
Incidently a really good pay to use program I had before getting a Mac was Vipre by sunbelt software.

In reply to Duncan Bourne:

Hijackthis is a powerful program. Use it wisely.

Run combofix first http://www.bleepingcomputer.com/combofix/how-to-use-combofix - download from here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe In most cases this will resolve a rootkit infection (which is what you have SonyaD). If you are unable to run combofix then you have a slightly sharper rootkit but nothing that an email or two to me won't fix.

In reply to EZ:
Hence why I said follow instructions on the site. It doesn't do to go wading through the registry without knowing what you are doing.

In reply to EZ: Umm. I don't really understand a lot of those instructions on that website you linked to.

Firstly, I don't have a clue what number of Firewalls I have and even if I have one at all.

Secondly, on step 3, where you have to download CCleaner, it tells you 'only use the default settings on the window tab'
I don't know what that means.

Thirdly, none of the given instructions work on my pc to determine whether it is 32 or 64bits.

Fourthly, I don't understand this Msconfig thing for set up.

Fithly, it tells me to uninstall known malware. Erm, I'm wanting help in the first place to uninstall the malware (STOPzilla, er assuming this is malware, as it's certainly dodgy!) So, that step makes no sense to me whatsoever.

6th - I've lost my patience with all these instructions now, far too complicated!

In reply to SonyaD:

Antivirus 2010 sounds almost identical to the Security Tool virus I got the other week.

I googled "getting rid of Security Tool" and found a really easy tutorial which talked me through it. I printed it off so I had it infront of me and it took a few minutes.

You could do the same - try starting here:
(just scroll down to the instructions)

http://www.bleepingcomputer.com/virus-removal/remove-antivirus-2010

This uses the same Malware Bytes programme - If I can do it anyone can.


Enty

In reply to SonyaD:

After reading this thread the other day I decided to do a complete virus scan using the installed Tesco anti-virus that checked hard drive, system and rootkit. It scanned 1.2 million+ files and took 13.3/4 hours, and found 5 viruses/trojans. One or two issues have disappeared and computer seems a bit better.

In reply to SonyaD:

Sorry to hear your woes continue ..

>

If you have XP or Vista then you will by default have the microsoft firewall. If you look in Control Panel then it will be there near the end.

>

It's actually the Windows tab after clicking the Cleaner one (think it opens in this by default) and means that mostly you will not do any harm if you stick with the defaults rather than ticking all the boxes.

>

If your computer is not really new then you probably have 32 bit.

>

If you type msconfig in the Run window then this opens up some options. I didn't read the post above but in the Services and Startup tabs you can disable any items that seem to be causing a problem.


STOPzilla appears to be a legitimate tool but you have to pay for clearing up the virus even though it is free to diagnose a problem. Many programs do this apparently.



Have any friends locally? Sorry, it is not easy to do this over the internet and especially not for me since I'm a novice at getting rid of the bleeders. Hoped that someone could help you.

In reply to Duncan Bourne:

I didn't mean to imply that you were being rash. Sry.

In reply to Enty: I've actually gotten rid of the Antivirus 2010 now (the Malware Bytes got rid of it) It's STOPzilla that I can't get rid of now.

In reply to episodit: Not sure it is legit. Some sources are saying it hijacks your computer to steal information. And it if won't let you get rid of it, then it's dodgy I reckon.

Sorry, I wasn't meaning I was losing patience with all the instructions from everyone off of here. Everyone is being VERY helpul and it's much appreciated folks. It's just that one link that told me to do all these steps, it was far too complicated for me to follow, so I gave up.

In reply to the crabbit man: 13 odd hours, jeeze! You're more patient than me! Tesco is a paying one though right?

In reply to EZ:
'sok didn't think you were

In reply to SonyaD:
sorry sonya, been away climbing! how you getting on with it?

In reply to blanchie14c: Well, I got rid of XP antivirus 2010 with the Malbytes doodah thing. But I stupidly downloaded STOPzilla believing it would help and now that's infected my computer and I can't get rid of the damn thing!

Have tried deleting it from ADD/REMOVE in control panel but it won't let me.
AVG does nothing to it, neither does the Malware Bytes thing, or Spybot, or Superantispyware (and the stupid superantispyware won't completely be gotten rid off from my pc either now!)
At the moment I'm running something called Dr.Web CureIt! which has so far dealt with 3 Trojans (hmmm, supposedly) I'm sure that anything called Dr Web can't possibly be legitimate though. And I'm dreading removing it from my pc once it's finished. Convinced that I'll have downloaded some other crappy nonsense onto my pc.

Ho hum.

In reply to SonyaD:

Sonya, FFS never download anything from the web you have just googled. Always ask for a reliable site to download stuff from that tries not to give you crap.

Here is one, see if there is any mention of Dr Web there, if not use one from here, plenty to choose from, without paying as well.
http://newswires.v3.co.uk/c/1CvsZkPllLBdJv96

In reply to SonyaD:

I don't think any of us thought that Sonya, sympathy for your problems .. have you thought about getting something like acronis to take images of your system? I have quite an old version that does the job and it is fairly straightforward to use, presumably the latest versions are better.

In reply to SonyaD: have you tried searching for it your self but first enable viewing of hidden files as it will probably be hidden. i searched once for a virus and it was not called what you think it was i eventually found it by searching for files introduced at a certain date that the problem started !! maybe i was lucky as i clicked to the name fairly quickly , sorry cant remember the name but i think it sounds like the virus that youve got . failing that there is always the complete wiping of your hard drive re format and reinstall your operating system takes about 3 hours to reinstall all your original programs including word and antivirus, internet options music players etc. worth it in the long run

In reply to SonyaD: laptop or tower? make and model? <it may have a hidden bit on the HHD that'll you be able to boot from and resore it to the day it was bought. Sounds like your best option>

In reply to SonyaD:


Well I started it the evening before and was surprised it was still doing it the next day, but luckily it can do the scan in the background. But 1.2 million plus files, no wonder it took so long. The Tesco anti-virus is 50p a month as part of the broadband.