another virus infiltrated my security essentials

[serpentracer]

boy this thing has now let 3 viruses over take it. pretty much any virus I've gotten (can't even tell you how on the last one. was doing a search with bing and bam it took over my computer)
this time it was one that is supposed to be already known about.

at first it stopped it from installing but then while it was trying to stop it another instance was allowed to install.

it was easy to remove by doing a system restore and then the security essentials removed it for good. except it hid all of my libraries (videos pics and documents) I thought they were deleted so I started to do run my backup restore and I noticed that the originals were only hidden.

but come on...this is the 3rd time security essentials has let me down. and I never visit porn sites or any of that stuff.

 

[C-11]

No antivirus program is 100% immune against Trojans, viruses etc.

With that said it's best to have a recent Image to fall back on.

Backup Complete Computer - Create an Image Backup - Windows 7 Forums

Imaging with free Macrium - Windows 7 Forums

Also, install WOT or McAfee SiteAdvisor to what ever browser your using.
Safe Browsing Tool | WOT (Web of Trust)

McAfee SiteAdvisor Software – Website Safety Ratings and Secure Search

 

[whs]

Yeah, I had similar problems with MSE. That is why I went back to Norton. MSE is for 'light use'. My wife uses it and never had any problem.

Do what Flatiron says. Images are a much better protection than any AV program. I know guys that do not run any AV program but image every day. That may be a bit steep, but it works for them. Take an image 2 or 3 times per week. Then you are not liable to lose a lot when you set the system back.

 

[M1GU31]

but come on...this is the 3rd time security essentials has let me down. and I never visit porn sites or any of that stuff.

Do you or someone else go on sites and download stuff. The ads,site or the files you download yourself can give you a virus. Need to cautious when going to those type of sites.

 

[C-11]

Yeah, I had similar problems with MSE. That is why I went back to Norton. MSE is for 'light use'.

Same thing happened to me about 9 months ago.

Trying to find Vipre or Norton at a good price before Norton expires in 3 months.

 

[Golden]

Hi,

This trojan is usually installed via download of some rogueware. Its extremely malicious and known to mine your system for personally identifiable information.

Download and run TDSSKiller from here:

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Post back what it finds.

Regards,
Golden

 

[serpentracer]

but come on...this is the 3rd time security essentials has let me down. and I never visit porn sites or any of that stuff.

Do you or someone else go on sites and download stuff. The ads,site or the files you download yourself can give you a virus. Need to cautious when going to those type of sites.

nope this is my computer no one else uses. it happened as I was using it. I wasn't even on any crazy website when the attack happened. I was litterally in the bing search results when I got the popup of an attack. this stuff is getting dirty and the a holes making them are getting more and more clever.
you don't even have to click on anything to get one now. they start downloading and installing in teh background without you even knowing. all of windows defenses are useless. none of them work. my system is set on max security after the last attack but that clearly doesn't work. as this one even allowed itself to do everything without interference from windows

 

[serpentracer]

Hi,

This trojan is usually installed via download of some rogueware. Its extremely malicious and known to mine your system for personally identifiable information.

Download and run TDSSKiller from here:

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Post back what it finds.

Regards,
Golden

it returned no threats found. security essentials was able to remove it but it also "allowed" it to install as it was also removing one instance of it. it was crazy how it did it.

I might look into the kapersky stuff. I keep hearing a lot of people say it's the best out there.

 

[Golden]

Hi,

If that was the case, we would all have this infection, and no-one would use MSE.

One reason you may continue to have problems is because you haven't been able to clean out the original infection, and it self-replicates. Rootkits are notorius for this. Often, the only fix is to format and do a complete reinstallation.

Run TDSSKiller, and lets see how deep this infection has run.

Regards,
Golden

 

[serpentracer]

Hi,

If that was the case, we would all have this infection, and no-one would use MSE.

One reason you may continue to have problems is because you haven't been able to clean out the original infection, and it self-replicates. Rootkits are notorius for this. Often, the only fix is to format and do a complete reinstallation.

Run TDSSKiller, and lets see how deep this infection has run.

Regards,
Golden

I did run it. it said no threats found. (i'd make a screenshot but the tdsskiller doesn't show up or with the snipping tool) I'm not having any issues anymore. this was easy to fix. system restore has me all working like new. no issues since and no processes running that are suspicious. (all of them are legit)

 

[torre]

[/QUOTE]



I might look into the kapersky stuff. I keep hearing a lot of people say it's the best out there.[/QUOTE]



Does MSE have a URL checker ? Most of the time I have contacted a virus/malware it has been while clicking URLs after a search.

I use Kaspersky Internet Security 2012 which performs well. Check Amazon and other online retailers, average cost is $20-25 for 1 year license. As stated above, no system is perfect. MSE gets positive reviews in this forum.

Let me say I am not a patient person. But with a virus you have as described above by Golden, I would recommend backup and clean install to positively insure it is removed.

 

[serpentracer]

Does MSE have a URL checker ? Most of the time I have contacted a virus/malware it has been while clicking URLs after a search.

I use Kaspersky Internet Security 2012 which performs well. Check Amazon and other online retailers, average cost is $20-25 for 1 year license. As stated above, no system is perfect. MSE gets positive reviews in this forum.

Let me say I am not a patient person. But with a virus you have as described above by Golden, I would recommend backup and clean install to positively insure it is removed.

no it doesn't have url checker but IE9 and firefox both do. but unless people are reporting the sites it goes unflagged.

oh I can tell you it's gone. you should have seen what it did to it. I couldn't even open the start menu. it was all blank. so I couldn't even access the control panel or nothing.
so this time I set some keyboard hotkeys to access all of the important things like the control panel, system retore, backup, etc.
I have external drives with a backup of all my important stuff along with a system image.

none of the malware removers find it in my system after MSE ran the third removal attempt. so I'm pretty confident it's gone.

 

[Golden]

Hi,

Correct me if I'm wrong, but don't you have the situation where it keeps returning by itself? You should reset your DNS as the Win32/Alureon family hijacks it for its own use. You need to reset your DNS.

Copy the following text exactly as shown into a new instance of NotePad:

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save this to your DESKTOP as FLUSH.BAT

Right-click on FLUSH.BAT and choose 'Run as administrator'. Your PC will reboot itself.

Regards,
Golden

 

[bigcitycat]

Start using noscript

 

[serpentracer]

Hi,

Correct me if I'm wrong, but don't you have the situation where it keeps returning by itself? You should reset your DNS as the Win32/Alureon family hijacks it for its own use. You need to reset your DNS.

Copy the following text exactly as shown into a new instance of NotePad:

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save this to your DESKTOP as FLUSH.BAT

Right-click on FLUSH.BAT and choose 'Run as administrator'. Your PC will reboot itself.

Regards,
Golden

no it seems to be fine. it's not acting up or anything.

 

[Qdos]

I do not find MSE at all as good as NOD32, have run comparison scans on infected archives and MSE misses a very significant number of finds that ESET manages to identify...

 

[whs]

No wonder, Eset is top shelf.