Struck by Live Security platinum

masplin · 13 Aug 2012

My wife was browsing and got struck by this thing. hopefully I can remove it with Superantispyware free version that seems to have detected it.

my question is to understand how it got on givne I think I'm reasonably security conscious. This is the 2nd time as one of my daughters had simialr a few months ago. Both were runnig MSE and spybot teatimer. Both are set up as non-adminstrative users to stop things installing themselves. so 2 questions:

1. do any anti-virus or anti-spyware programs prevent these types of programs infecting you?
2. how has it managed to install when you need an administrators password to change anything else critical on the system?

thanks for some education

Mike

C-11 · 13 Aug 2012

I'd follow the instructions here.

Remove Live Security Platinum (Uninstall Guide)

shawn77 · 13 Aug 2012

Platinum rogue usually comes with Zero access.This instruction may not be sufficient to eradicate malware.

masplin · 14 Aug 2012

Well Superantispyware seems to have done the job and don't seem to have any issues

i was more interested in why it happens and how to prevent it as it quite irritating?

Borg 386 · 14 Aug 2012

Viruses generally have a bad habit of introducing more viruses to your system. In addition to keeping a close watch on your PC's behavior, you should also run the following scanners to make sure it is indeed "all clean."

Windows Defender Offline

Malwarebytes : Malwarebytes Anti-Malware PRO removes malware including viruses, spyware, worms and trojans, plus it protects your computer

Anti-rootkit utility TDSSKiller.

No AV gets every virus, so when a new variant comes out, it slips under the radar. One of the more common ways a virus is caught is called "drive-by", you visit a web page that has malicious code embedded, it silently loads into your PC and installs itself without your knowledge. Some viruses will circumvent the safety systems and install, regardless of what your setup is.

If you are using Firefox, there is a plug in called NoScript, this stops most malicious code from running in the background of a compromised web page.

https://addons.mozilla.org/en-US/fir...pt/?src=search

masplin · 14 Aug 2012

perfect thanks for the advice.

Borg 386 · 14 Aug 2012

Something else you should consider, make a system image. This can be invaluable when something really bad happens. If you get a rootkit, the best/safest course is a clean reinstall. This will save you a lot of time. Here is a link to the tutorial. This forum also has many excellent tutorials on securing/setting up your system.

Backup Complete Computer - Create an Image Backup

Tutorials - Windows 7 Forums

chris1neji · 14 Aug 2012

That's the whole point of viruses and malware. They go around all security measures or attemp to anyways. The only thing we can do is be ready.
Obviously the likehood of getting a virus is reduced substantially with the aid of anti virus and anti malware protectiong to help defend against malicious coding.

Spybot in my opinion has slowed down and is not as reliable as it once was a long time ago. I would recommend Malwarebytes.
User Account Control enabled with IE8 or 9 works well too, this enables IE protected mode.
All you can do is have a real time anti virus, firewall, and spyware protection and hope for the best. The sites you visit also increase/decrease the likelyhood of getting an infection. Now that you mention it it's been almost 3 years since i gotten a single infection.

masplin · 14 Aug 2012

I do have a system image and take them every month and daily overnight backups so should be prepared ofr the worst!!!

masplin · 15 Aug 2012

So maybe not so good. I can access the internet but can no longer access any other pc on the network. Error is diagnostic Policy Server not running. If I go to services it is set to automatic but stopped. If I try start it it tries to and then stops again saying "some servcies stop if not in use by other services or programs"

I have run Malware, Rootkiller, Windows Defender offline (which found some things to remove). I have also run sfc /scannow and checked msconfig set to normal as saw that on another post about Diagnostic server. I have rebooted.

I went to system restore and oddly the last restore point is the night after I got infected. Previous to that there is one in Feb. Not sure if that lack of restore points is related. I have a system image of my C drive (all user profiles are on a partitioned U drive) from 9th July.

Before doing something as drastic as an image restore are there any other steps I can take as seems a bit odd I can access the internet but not my network as same adapter.

Thanks Mike