FUUUUUUUUUUUUUUUUU- Antivirus 2010 XP

[ChikenKannon]

So somehow (I think I know how) I managed to download the "Antivirus 2010 XP" virus in the process of downloading and installing Storm of Zehir. It's locked down my system pretty bad, it allows Hijackthis but I can't find the known corrupted files in the registry at all and all the ones that are recognized are safe.

Ontop of that the best advice I can find on the internet is "Run Malwarebyte" which is blocked by the virus and immedietly starts up the AV.exe in the taskmanager (which I can thankfully access so I can at least snipe that part of the virus).

Ontop of THAT it seems to have taken over my administrator since whenever I try to change something in MSconfig it tells me to log onto my admin account (the one I'm on)

I'll post more as it occurs.

[ChikenKannon]

Changed the name of malwarebyte and had to do some fiddling but it appears to be running. If anyone else has experienced this or has an ideas if this doesn't work. I'm all ears. Or... eyes...

(Let the waiting begin, usually takes an hour for MBAM)

[Vahene]

I hate to suggest it, but have you tried restoring?

K

[paladin89]

You probably already tried it - but booting into safe mode to run Malwarebyte is often more successful

[Mon-da-oth]

You probably already tried it - but booting into safe mode to run Malwarebyte is often more successful

X2---but use safe mode with networking so that you can get the updates for the program.

[Twist of Cain]

Right, safe mode with networking, rename any cleaner install file you download to either winlogon.exe or explorer.exe (right when you save it to your system), and system restore can be the simplest way to clear these problems out if it will do it. Oh, I also cleaned a computer with this type of malware out once (It was Antivirus Soft, a similar trojan) by opening the task manager as soon as the computer booted up, and closing the ransomware .exe file as soon as it popped up, then I could do the rest pretty easily. Also, some of these ransomware fake AV programs won't let you go anywhere online on that computer, which might be a fairly easy fix, just go Internet Options > Connections > Lan Settings and disable "Use Proxy Server," that usually fixes that. (And you might need to be in safe mode/networking so it won't change the setting back, unless you're able to kill the process in regular mode before it gets completely started up.)

[ChikenKannon]

Thanks for replying.

1) I did change the name of MBAM and got it working (hoorah!)
2) I am now attempting to get my internet back online. If I can't do that, I have no way to bring updates to MBAM to my system. So a system reformat would follow if I can't manage it (last resort of course).

Probably a stupid question: But does a formating of the system remove all trace of the virus from the system? Or is it possible that this could make it worse?

[Twist of Cain]

Probably a stupid question: But does a formating of the system remove all trace of the virus from the system? Or is it possible that this could make it worse?

A format of the system will remove all traces of everything from the system. Better have all your CDs handy.

[ChikenKannon]

@#$%. It ate my startup programs..... There are no internet connections it's wiped everything that ran in the background and the remaining files are all legitimate (when I check using MBAM hijackthis and google).

No system restore. Reformat looks like the only way. Time to take it out back? Right well..... There goes all my downloaded stuff, luckily I just recently legalized my collection so I'm not losing too much.

[Twist of Cain]

@#$%. It ate my startup programs..... There are no internet connections it's wiped everything that ran in the background and the remaining files are all legitimate (when I check using MBAM hijackthis and google).

No system restore. Reformat looks like the only way. Time to take it out back? Right well..... There goes all my downloaded stuff, luckily I just recently legalized my collection so I'm not losing too much.

While it's infecting a system, it probably just won't let you access the software, just like Antivirus Soft and other ransomwares often do. Are you sure it's been completely removed? Those types of malware programs usually don't mess up the other programs - they're just set not to allow anything to run while the malware itself is running, and pop up a fake message like "NWN2 is infected" etc when you try to start things.

[ChikenKannon]

Yeah. Thanks for the help everyone. Decided to just reformat (actually found out I was only using half my harddrive so.... bonus!).

once more for good measure, thank you for attempting to assist an inept should-know-better PC user.

[Mon-da-oth]

What I never got a chance to mention is that this type of Malware often sets you internet settings to use a proxy server that redirects it back to a 127.0.0.1 address which is a local loopback address for you system. This can be changed under the connections tab for IE. Firefox and other browsers will have similar settings located in different areas you would need to check each one if you have multiple browsers on your system.