Help!

HankC · 28 Jun 2010

I bought an Acer Aspire 5532 laptop preloaded with Windows 7 a few months ago that just yesterday was infected with a trojan that no longer allows me to go online or access my Security Center until I enter my credit card information for some "virus software" called Defense Center License (clearly fraudulent with infection warnings in broken English). I would like to erase the hard drive and begin anew with the factory settings (since all software access is blocked and there is no way to introduce new anti-virus software) but all of the online tutorials seem to be based around upgrading previous versions of Windows with a Windows 7 CD, which I do not have.

Rebooting in Safe mode has no effect on the usability and I am not sure which options to select in the F2 menu or wherever I should go since I have never had to reformat Windows before, but I use this laptop for my work and not having it functioning represents a major concern that could conceivably lead to my dismissal, so any timely advice is greatly appreciated!

Thanks a bunch.

electrotune1200 · 28 Jun 2010

Your safest bet would be to just reinstall your system using the Recovery Partition.

The procedure for an Acer PC is to reboot, and hit ALT+F10 at Bios screen. This will delete all of your current data.

Backup what you can, just necessary files. Burn them to a disc. I would refrain from transferring the files to an external HDD cause this trojan can easily infect it.

When your PC is restored.. I would change every online password that you have. Online banking, email etc.

gregrocker · 28 Jun 2010

Download Avast 5 to flash stick or CD and install, immediately run the Boot-Time scan which is the deepest possible scan, followed by MSE and Spybot S&D in Safe Mode - Spybot has the ability to flush infection hiding in memory after requesting a restart.

What has also worked with this infection is to boot the Win7 Repair CD or DVD Repair console to System Restore to your earliest restore point. Files will not be affected. Then run the test regimen again. System Restore
System Repair Disc - Create

You can attempt to run the Acer Recovery function but it is possible the virus has spread into it or will do so so it needs to be included in all scans to be considered, then run the tests again after recovery.

If these give you a clean bill of health then you may still later need to clean the HD from DVD command line, then clean reinstall using either a Recovery Disk set you order from Acer (free within 90 days of purchase, shipping charged otherwise) or a Win7 DVD you borrow or obtain which will activate with the Product Key stickered to your computer. The latter is actually the desired course in the long run since it will overcome the factory bloatware corruption and give you much better performance. Disk - Clean and Clean All with Diskpart Command
Clean Install Windows 7

We can help you with any of the steps as you sort out your course.

bobkn · 28 Jun 2010

You ought to be able to remove the Defense Center malware without resorting to a Windows re-install.

A little web searching yields, for example,

Remove Defense Center fake antispyware | Guidelines to Remove Malware

I haven't used their advice, but it looks plausible. I'm not sure it's complete, though. Some months ago I removed the similar Total Security scareware from a PC (not mine), and I had to kill its process using Task Manager before I could delete its components manually. (Easy enough, if you know the name of the process.)

If that doesn't work for you, the system should have a recovery partition. That would restore the laptop to a factory condition. I'm not sure from what I find on the web, but for Acer that may be initiated by holding down alt+F10 at startup.

WARNING: when they say factory conditrion, that's what they mean. Any changes to the machine since it was delivered (files, programs, settings, etc.) will be lost. That's why it should be a last resort, unless there's nothing on the disk that you'd like to keep.

Good luck.

HankC · 29 Jun 2010

I doubt my programming acumen to the extent required to locate and eliminate every hiding place for the virus, which suspiciously echoes the poor English displayed by the fix-it site selling a solution program. Thanks for the idea though.

After reading electrotune's advice I followed it through, and then upon reading Greg's tips I downloaded the free version of Avast! I do not have any CDs or memory sticks, and it returns the message "boot-time scanner only available in 32 bit operating systems" when I attempt to perform boot-time scans. Fearing this not to be enough protection I purchased BitDefender but have yet to receieve a confirmation e-mail from the company. I know no one with a Windows 7 DVD but will try to find a good spysweeper program, and if problems persist I may just turn the entire thing into a paperweight. It was never my intention to spend $100 on software to guard a $300 system, and I have already lost all the data and files worth saving anyway past what was backed-up months ago.

Thank you for your sage advice however experts, my computer is now working again thanks to you and I do wish you- and anyone unfortunate enough to be reading this with similar problems- the best of luck in the future.

Cheers,

HC

Carl Lawrence · 29 Jun 2010

I am glad you fixed it quickly.

fishnbanjo · 29 Jun 2010

You should be able to get the disks through Acer since every OEM must supply them on request, you would be obligated for S&H though.

gregrocker · 29 Jun 2010

It isn't necessary to spend anything. The best AV is MS Essentials or Avast, the best one-time scanner is Malwarebytes - all are free and easily downloaded from the web to a CD to install for scanning. You can borrow or download a Win7 install DVD.