Fake virus scan (Win7 Defender)

[dach162]

All of a sudden I got a security system alert saying I had problems. It is Win7 Defender and they won't let me do anything with the file extension of .exe. I went to safe mode and can't start any programs at all. I know that Malwarebytes can remove it but I can't download Malwarebytes because it has an .exe file extension. All virus/spyware programs, or any other for that matter, can't be started. As soon as this hoax sees the .exe file, it brings itself up. Anybody got any good ideas? Thankfully I have a separate computer to send this from.

 

[DocBrown]

Welcome dach162,

I remember using a program called Rkill several years ago to stop this malware that locks up the .exe files

:ar: RKill - CNET Download.com

 

[dach162]

I have that but since it has a .exe, I can't download it to the computer. (I have in on a flash drive)

 

[Layback Bear]

This might help. Download using a clean computer.
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Sometimes renaming things like Malwarebytes will get past the infection.
Malwarbytes #21.exe
Also try using scans from Safe Mode and Rkill from Safe Mode.

 

[DocBrown]

You can also download it as a .com file to USB & then transfer to the infected computer

1. Do you want to run or save rkill.com (1.59 MB) from download.bleepingcomputer.com?
2. download.bleepingcomputer.com/grinler/​rkill.com

 

[dach162]

If this didn't have the .exe file it might work but anything (and I mean anything) with a .exe won't work. I can't pick up IE or any other program that has an executable file.

 

[Layback Bear]

I agree with Doc Rkill has always worked for me.
Please read this.
RKill - What it does and What it Doesn't - A brief introduction to the program
Don't keep telling us you can't, Try
Read the Defender off line.

 

[DocBrown]

Here is an old post from SF, but good info here

:ar: http://www.sevenforums.com/system-security/75745-rogue-virus-removal-tool.html

 

[dach162]

Thanks for all the quick information. The best answer was changing the .exe to .com and trying that. When I did, it allowed me to install malwarebytes and after scanning with that, it removed all of this foolish fake program. The key here was .com. This win7 defender takes over whenever a .exe is called for. Thanks again.

 

[DocBrown]

Congrats, Glad we could help

 

[marsmimar]

Just for future reference, RKill is offered under several different file names. As their instructions say, if malware terminates one file name, try another.

http://www.bleepingcomputer.com/download/rkill/

RKill download links:

• RKill.com Download Link
• RKill.exe Download Link
• RKill.scr Download Link
• eXplorer.exe Download Link - This renamed copy may trigger an alert from MBAM. It can be ignored and is safe.
• iExplore.exe Download Link
• uSeRiNiT.exe Download Link
• WiNlOgOn.exe Download Link

 

[Layback Bear]

So far so good. I would recommend doing a few more scans.
Search results

Free Online Virus Scanner | ESET

Download AdwCleaner 2.101 Free - Adware and toolbar remover - Softpedia

Please read and follow all instruction.
If you can could you tell us what infections were found by what scan?