Infection by fake AV virus

F5ing · 09 Apr 2012

How in the heck did it get so hot? Sounds like you might have to clear out CMOS. May have to use a bootable CD/DVD/UFD to recover the data.

Golden · 09 Apr 2012

Greg,

If you're still having trouble booting into Windows and need to recover data off the disk/s prior to clean install, I recommend this to a bootable CD/USB:

https://www.f-secure.com/en/web/labs...oval/rescue-cd

Regards,
Golden

gregrocker · 09 Apr 2012

The BIOS splash screen just sat there for minutes ignoring all hotkeys then would to boot into Vista.

I finally got GWScan (WD Diagnostics) to autostart to wipe the HD, thinking this would force autostart the 7 installer. But 7 DVD or stick wouldn't start so I popped in 8 DVD which did start, installed, then I installed 7 over it.

What was apparently needed was a BIOS update because as soon as I installed that from Windows the BIOS screen just zipped by. Seven runs great on it with every driver in installer and updated via Updates.. Just finishing it now.

boohbah · 09 Apr 2012

another notch in your bedpost greg ,well done

gregrocker · 09 Apr 2012

Thanks everyone.

I'm leaving him with MSE and strong warnings about looking for MS insignia on any pop-ups warning of infection.

Jacee · 09 Apr 2012

gregrocker said:

Isn't MS Standalone is now Windows Defender? Found nothing, lame as ever.

Can't get into Safe Mode or run mbam.exe from New Task in Task Mgr (Not Found).

Yeah inclined to copy out files using 7 DVD, wipe and install 7. With help from here a few weeks ago I cleaned up one of these but it took twice the time to reinstall and he wants 7 anyway and has ready cash.

Thats two friends in a month infected with Fake AV running MSE. Time to upgrade? What AV do you recommend to catch these, or can they be caught?

Thanks.

Greg, if you have the time to read this, you might find it interesting
https://community.qualys.com/blogs/s...s/tags/malware

In typical malware fashion it looks for common security software and disables their function, once it has successfully infiltrated the machine. Then it connects to its command & control server to wait for instructions and receive software updates.

Malicious code embedded on an unprotected website, is just waiting for the next computer with outdated software (java/ Adobe, etc) to land in it's trap.

gregrocker · 09 Apr 2012

So as Kegger said earlier, the first line defense is education to always look for MSE or Windows insignia on these Virus Scan popups? If none or even suspect, then shut down machine to close the internet connection?

Run the Secunia Software updater to make sure there are no holes? http://secunia.com/vulnerability_scanning/online/

This is what has worked for chronics like my Dad, my roommate and now hopefully this latest victim.