Action Center Virus

book1245 · 15 May 2011

This morning I fell victim to the fake Action Center virus.
Googling showed me it's been resurfacing lately, and showed various ways to try and combat that.

The virus makes my mouse drag, and prevents me from accessing any website on my own computer.
I've transfered via flashdrive a free Kaspersky product that's said to be good at this specific virus, but it's been taking forever to install (I'm guessing because of the virus).

Oh, and I have Microsoft Security Essentials, which didn't detect any threat beforehand.

Is this Kaspersky freebie the best option for right now, and I should just wait for the entire thing to install, or does anyone have any better advice for this situation?

As always, thanks.

Xhi · 15 May 2011

The easiest thing to do here would be a system restore. If this happened lately try restoring to a previous date when you think the computer was working fine. Get into safe mode first to do this.

If it doesn't work in safe mode, then launch safe mode with command prompt. When you get the command prompt type this in: "c:\windows\system32\restore\rstrui.exe" and press enter. That is the command line for system restore. And just to be sure restore to a date maybe 2-3 days ago.

Once the restore is successful, download and run Malwarebytes : Free anti-malware, anti-virus and spyware removal download. Do a full scan. It should be able to detect anything that might have bypassed Microsoft Security Essentials.

You could always do those other steps suggested by other people like running (rkill, combofix, etc) but there are just too many steps to do. A system restore usually does the trick as I always do this for people at work who get fake anti-viruses and resolve them 90% of the time. Then I download and run Malwarebytes just to make sure there is nothing else on the system.

book1245 · 15 May 2011

Thanks Xhi!
I'm currently running the Kaspersky one, after having tried to do a system restore and it not working.
However, I wasn't in safe mode as I am now with the scan, so that's probably why.

I had heard conflicting things about system restore and viruses such as this (like how a system restore will reset the registry, but still have the virus files in tact).
But if this Kaspersky method doesn't work, then I'll do a system restore in safe mode.

Malwarebytes is a name I've seen on dozen of pages, so that will be the very next program I go to, haha.

After this ordeal, I'm considering ditching Microsoft Security Essentials and going to Best Buy to get a disc-based virus program (although I do love MSE)

I'll update once the scan finishes.

Xhi · 15 May 2011

Well, just to let you know, even "paid" and "disc-based" anti-viruses sometimes don't work. I've experienced some customers at work who's PC got taken over by a fake anti-malware thing (i.e. MS Removal Tool, Security Center 2011) even when they had paid versions of Norton and Mcafee installed.

Good luck with the removal though. Yeah, like I said, system restore is just a simple tool some people forget to do first. It does manage to work sometimes but not all the time. ^^

I be he · 15 May 2011

Sandboxie

book1245 · 15 May 2011

Xhi, that worked like a charm.
Computer's back to normal, and I'm running a scan via MSE now just to check :)

johnnya · 15 May 2011

Hi Book1245. Glad you got your problem solved. Just curious as to which suggestion XHI gave was it that solved your problem. The System Restore or the Kaspersky scan. Just as an aside, you are correct that you will find a ton of references were to the program Malwarebytes. Very popular malware remover, easy to run on demand and is FREE

. You can download via the link below. When you do run it, hit the UPDATE TAB to get the latest definitions and the run a FULL SCAN.
Download Malwarebytes Anti-Malware 1.50.1 - FileHippo.com
Cheers
JohnnyA

bigcitycat · 15 May 2011

Yeh I don't pay for antivirus. I have been infected with pay for versions as well. I use the Noscript addon with firefox, MSE and Malwarebytes. Keep flash and Java updated, and do not use adobe pdf. Then I use Linux for anything involving money.

book1245 · 15 May 2011

Well the Kaspersky free scan sadly didn't really seem to make much effect, so I went right to the system restore (to two days prior, just to be safe) and my computer booted fine, and I saw no sign of my fake anti-virus program.

Xhi · 15 May 2011

That's good to hear book! Just make sure you download Malwarebytes and do a full scan just to be on the safe side.